linux-kernel - Re: [PATCH] params: fix potential memory leak in add_sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1408576214.9540.2.camel@infradead.org>
Date:	Wed, 20 Aug 2014 18:10:14 -0500
From:	David Woodhouse <dwmw2@...radead.org>
To:	"rusty@...tcorp.com.au" <rusty@...tcorp.com.au>
Cc:	"arjun024@...il.com" <arjun024@...il.com>,
	"torvalds@...ux-foundation.org" <torvalds@...ux-foundation.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"jg1.han@...sung.com" <jg1.han@...sung.com>,
	"akpm@...ux-foundation.org" <akpm@...ux-foundation.org>
Subject: Re: [PATCH] params: fix potential memory leak in add_sysfs_param()

On Wed, 2014-08-20 at 22:17 +0000, Woodhouse, David wrote:
> 
> Except that in the failure case we *free* the old mk->mp and never free
> mk->mp->grp.attrs so it *is* indeed lost.
> 
> A simpler version of Arjun's patch might look like this:
> 
> diff --git a/kernel/params.c b/kernel/params.c
> index 34f5270..f9459bc 100644
> --- a/kernel/params.c
> +++ b/kernel/params.c
> @@ -613,7 +613,6 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
>                        sizeof(*mk->mp) + sizeof(mk->mp->attrs[0]) * (num+1),
>                        GFP_KERNEL);
>         if (!new) {
> -               kfree(attrs);
>                 err = -ENOMEM;
>                 goto fail;
>         }
> @@ -653,7 +652,10 @@ static __modinit int add_sysfs_param(struct module_kobject *mk,
>  fail_free_new:
>         kfree(new);
>  fail:
> -       mk->mp = NULL;
> +       if (mk->mp) {
> +               kfree(mk->mp->grp.attrs);
> +               mk->mp = NULL;
> +       }
>         return err;
>  }

Of course this and Arjun's original *both* fail to fix the classic bug
in the 'new = krealloc(mk->mp…)' bit, failing to free the old mk->mp if
the realloc fails. I think my alternative fix that didn't kill the old
params is probably the better way forward.

-- 
dwmw2


Download attachment "smime.p7s" of type "application/x-pkcs7-signature" (5745 bytes)