linux-kernel - [PATCH] hw_random: free rng

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 14 Mar 2013 22:24:45 +0900
From:	Satoru Takeuchi <satoru.takeuchi@...il.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	Satoru Takeuchi <satoru.takeuchi@...il.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	linux-kernel@...r.kernel.org, stable@...r.kernel.org,
	Aurelien Jarno <aurelien@...el32.net>,
	Matt Mackall <mpm@...enic.com>,
	Herbert Xu <herbert@...dor.apana.org.au>
Subject: [PATCH] hw_random: free rng_buffer at module exit

At Thu, 14 Mar 2013 17:11:21 +1030,
Rusty Russell wrote:
> 
> Satoru Takeuchi <satoru.takeuchi@...il.com> writes:
> > Hi Rusty,
> >
> > At Tue, 12 Mar 2013 15:43:33 -0700,
> > Greg Kroah-Hartman wrote:
> >> @@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
> >>  
> >>  	mutex_lock(&rng_mutex);
> >>  
> >> +	/* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
> >> +	err = -ENOMEM;
> >> +	if (!rng_buffer) {
> >> +		rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
> >
> > rng_buffer is now kmalloc-ed, but not kfree-ed. Shoudn't it be kfree-ed
> > at hwrng_unregister()? If my suspect is correct, the same problem is
> > in 3.8.3-rc1 and 3.0.69-rc1. I'm OK to make a patch, but it'll be after
> > some hours.
> >
> > Corecct me if I'm wrong.
> 
> Yes, it would be nice to free it, but it really makes sense to free it
> in module_cleanup() (which would have to be written, as the module
> currently doesn't have one).
> 
> Cheers,
> Rusty.

From: Satoru Takeuchi <satoru.takeuchi@...il.com>

rng-core module allocates rng_buffer by kmalloc() since commit
f7f154f1246ccc5a0a7e9ce50932627d60a0c878. But this buffer won't be
freed and there is a memory leak possibility at module exit.

Signed-off-by: Satoru Takeuchi <satoru.takeuchi@...il.com>
Cc: Rusty Russell <rusty@...tcorp.com.au>
Cc: Matt Mackall <mpm@...enic.com>
Cc: Herbert Xu <herbert@...dor.apana.org.au>
Cc: Aurelien Jarno <aurelien@...el32.net>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: stable@...r.kernel.org

---
 drivers/char/hw_random/core.c |    9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 69ae597..a0f7724 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -380,6 +380,15 @@ void hwrng_unregister(struct hwrng *rng)
 }
 EXPORT_SYMBOL_GPL(hwrng_unregister);
 
+static void __exit hwrng_exit(void)
+{
+	mutex_lock(&rng_mutex);
+	BUG_ON(current_rng);
+	kfree(rng_buffer);
+	mutex_unlock(&rng_mutex);
+}
+
+module_exit(hwrng_exit);
 
 MODULE_DESCRIPTION("H/W Random Number Generator (RNG) driver");
 MODULE_LICENSE("GPL");
-- 
1.7.10.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/