| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALYGNiP6H4wzA5oHr9y8gOUyVdxZQ4uwJEHXoz5poQZ88jYjgg@mail.gmail.com> Date: Mon, 20 Jul 2015 18:20:39 +0300 From: Konstantin Khlebnikov <koct9i@...il.com> To: Dongxing Zhang <dongxing.zhang@...el.com> Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, peter@...leysoftware.com, alan@...ux.intel.com, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, Xiaoming Wang <xiaoming.wang@...el.com> Subject: Re: [PATCH] tty/vt: Fix the memory leak in visual_init On Wed, Jun 10, 2015 at 10:21 AM, Dongxing Zhang <dongxing.zhang@...el.com> wrote: > If vc->vc_uni_pagedir_loc is not NULL, its refcount needs to be > decreased before vc_uni_pagedir_loc is re-assigned. > > unreferenced object 0xffff88002cdd13b0 (size 512): > comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) > hex dump (first 32 bytes): > 40 92 61 2b 00 88 ff ff 00 00 00 00 00 00 00 00 @.a+............ > 00 00 00 00 00 00 00 00 a0 ad 61 2b 00 88 ff ff ..........a+.... > backtrace: > [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 > [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 > [<ffffffff814ae7d3>] con_do_clear_unimap.isra.2+0x83/0xe0 > [<ffffffff814ae9b2>] con_clear_unimap+0x22/0x40 > [<ffffffff814a8db8>] vt_ioctl+0xeb8/0x1170 > [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 > [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 > [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 > [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 > [<ffffffffffffffff>] 0xffffffffffffffff > unreferenced object 0xffff88002b619240 (size 256): > comm "setfont", pid 503, jiffies 4294896503 (age 722.828s) > hex dump (first 32 bytes): > 90 bc 84 d5 00 88 ff ff 58 85 84 d5 00 88 ff ff ........X....... > 88 ac 84 d5 00 88 ff ff e0 b1 84 d5 00 88 ff ff ................ > backtrace: > [<ffffffff817b755e>] kmemleak_alloc+0x4e/0xb0 > [<ffffffff811d4898>] kmem_cache_alloc_trace+0x1c8/0x240 > [<ffffffff814ae286>] con_insert_unipair+0x86/0x170 > [<ffffffff814af107>] con_set_unimap+0x1b7/0x280 > [<ffffffff814a8d65>] vt_ioctl+0xe65/0x1170 > [<ffffffff8149b458>] tty_ioctl+0x208/0xca0 > [<ffffffff81207858>] do_vfs_ioctl+0x2f8/0x510 > [<ffffffff81207af1>] SyS_ioctl+0x81/0xa0 > [<ffffffff817ca2b2>] system_call_fastpath+0x16/0x75 > [<ffffffffffffffff>] 0xffffffffffffffff > > Signed-off-by: Dongxing Zhang <dongxing.zhang@...el.com> > Signed-off-by: Xiaoming Wang <xiaoming.wang@...el.com> Looks like leak happens when kernel does this: [ 5.010152] fb: switching to cirrusdrmfb from EFI VGA Here: [ 5.010438] [<ffffffff814bd5f9>] visual_init+0x149/0x150 [ 5.010441] [<ffffffff814bfaa9>] do_bind_con_driver+0x159/0x310 [ 5.010443] [<ffffffff814bffd6>] do_unbind_con_driver+0x1b6/0x210 [ 5.010462] [<ffffffff8143ff3b>] fbcon_event_notify+0x7cb/0x8b0 [ 5.010471] [<ffffffff810a2d85>] notifier_call_chain+0x65/0x90 [ 5.010475] [<ffffffff810a2e3e>] __blocking_notifier_call_chain+0x5e/0x90 [ 5.010478] [<ffffffff810a2e86>] blocking_notifier_call_chain+0x16/0x20 [ 5.010480] [<ffffffff8144309b>] fb_notifier_call_chain+0x1b/0x20 [ 5.010483] [<ffffffff81443f0c>] do_unregister_framebuffer+0x6c/0x130 [ 5.010487] [<ffffffff81444163>] do_remove_conflicting_framebuffers+0x153/0x180 [ 5.010491] [<ffffffff814444df>] remove_conflicting_framebuffers+0x3f/0x60 [ 5.010495] [<ffffffffa016daa1>] cirrus_pci_probe+0x91/0xd0 [cirrus] [ 5.010509] [<ffffffff8142382e>] local_pci_probe+0x4e/0xa0 [ 5.010512] [<ffffffff814244b3>] ? pci_match_device+0xe3/0x110 [ 5.010515] [<ffffffff814245f9>] pci_device_probe+0xd9/0x120 [ 5.010525] [<ffffffff81502155>] driver_probe_device+0x155/0x430 [ 5.010528] [<ffffffff815024d1>] __driver_attach+0xa1/0xb0 [ 5.010530] [<ffffffff81502430>] ? driver_probe_device+0x430/0x430 [ 5.010533] [<ffffffff8150023e>] bus_for_each_dev+0x5e/0x90 [ 5.010535] [<ffffffff815019be>] driver_attach+0x1e/0x20 [ 5.010536] [<ffffffff815016ee>] bus_add_driver+0x1be/0x290 [ 5.010538] [<ffffffff81503570>] driver_register+0x60/0xe0 [ 5.010540] [<ffffffff81423ba4>] __pci_register_driver+0x64/0x70 [ 5.010541] [<ffffffffa043f000>] ? 0xffffffffa043f000 [ 5.010553] [<ffffffffa00c8ad0>] drm_pci_init+0xe0/0x110 [drm] [ 5.010556] [<ffffffffa043f000>] ? 0xffffffffa043f000 [ 5.010560] [<ffffffffa043f03c>] cirrus_init+0x3c/0x1000 [cirrus] [ 5.010572] [<ffffffff8100212d>] do_one_initcall+0xad/0x1d0 [ 5.010588] [<ffffffff811e04d6>] ? kmem_cache_alloc_trace+0x2b6/0x300 [ 5.010601] [<ffffffff8110a9f4>] do_init_module+0x64/0x220 [ 5.010604] [<ffffffff8110cc4a>] load_module+0x130a/0x1990 [ 5.010606] [<ffffffff811083b0>] ? show_initstate+0x50/0x50 [ 5.010608] [<ffffffff8110d400>] SyS_init_module+0x130/0x180 [ 5.010616] [<ffffffff817b6bee>] entry_SYSCALL_64_fastpath+0x12/0x76 This patch helps. Thanks. Tested-by: Konstantin Khlebnikov <khlebnikov@...dex-team.ru> > --- > drivers/tty/vt/vt.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c > index 4a24eb2..334c502 100644 > --- a/drivers/tty/vt/vt.c > +++ b/drivers/tty/vt/vt.c > @@ -738,6 +738,8 @@ static void visual_init(struct vc_data *vc, int num, int init) > __module_get(vc->vc_sw->owner); > vc->vc_num = num; > vc->vc_display_fg = &master_display_fg; > + if (vc->vc_uni_pagedir_loc) > + con_free_unimap(vc); > vc->vc_uni_pagedir_loc = &vc->vc_uni_pagedir; > vc->vc_uni_pagedir = NULL; > vc->vc_hi_font_mask = 0; > -- > 1.9.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > the body of a message to majordomo@...r.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html > Please read the FAQ at http://www.tux.org/lkml/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists