linux-kernel - Re: [Memory Leak] free kprobe before optimized

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5036E13A.6070901@hitachi.com>
Date:	Fri, 24 Aug 2012 11:04:42 +0900
From:	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
To:	akhilesh kumar <kumarakhilesh479@...il.com>
Cc:	ananth@...ibm.com, anil.s.keshavamurthy@...el.com,
	davem@...emloft.net, linux-kernel@...r.kernel.org,
	yrl.pp-manager.tt@...achi.com
Subject: Re: [Memory Leak] free kprobe before optimized_kprobe free

(2012/08/24 2:05), akhilesh kumar wrote:
> From a77438899c7295299b59cdca8d1816ea69d6ed8e Mon Sep 17 00:00:00 2001
> From: Akhilesh Kumar <akhilesh.lxr@...il.com>
> Date: Fri, 10 Aug 2012 14:02:07 +0530
> Subject:[Memory Leak] free kprobe before optimized_kprobe free
> 
> Free *ap before *op otherwise ap pointer will be Dangling

Nack, since ap == op, this causes double free.

/*
 * Internal structure for direct jump optimized probe
 */
struct optimized_kprobe {
        struct kprobe kp;
        struct list_head list;  /* list for optimizing queue */
        struct arch_optimized_insn optinsn;
};

Please look into alloc_aggr_kprobe() which allocates
optimized_kprobe, and returns op->kp.

Thank you,

> 
> Signed-off-by: Akhilesh Kumar <akhilesh.lxr@...il.com>
> ---
>  kernel/kprobes.c |    1 +
>  1 files changed, 1 insertions(+), 0 deletions(-)
> 
> diff --git a/kernel/kprobes.c b/kernel/kprobes.c
> index c62b854..ff0a97b 100644
> --- a/kernel/kprobes.c
> +++ b/kernel/kprobes.c
> @@ -767,6 +767,7 @@ static __kprobes void
> try_to_optimize_kprobe(struct kprobe *p)
>  	if (!arch_prepared_optinsn(&op->optinsn)) {
>  		/* If failed to setup optimizing, fallback to kprobe */
>  		arch_remove_optimized_kprobe(op);
> +		kfree(ap);
>  		kfree(op);
>  		return;
>  	}
> 


-- 
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@...achi.com


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/