linux-kernel - Re: module: fix memory leak on early load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 13 Feb 2017 10:33:10 -0800
From:   Jessica Yu <jeyu@...hat.com>
To:     "Luis R. Rodriguez" <mcgrof@...nel.org>
Cc:     rusty@...tcorp.com.au, mbenes@...e.cz, atomlin@...hat.com,
        pmladek@...e.com, hare@...e.com, akpm@...ux-foundation.org,
        linux-kernel@...r.kernel.org,
        "stable # v2 . 6 . 30" <stable@...r.kernel.org>
Subject: Re: module: fix memory leak on early load_module() failures

+++ Luis R. Rodriguez [10/02/17 14:06 -0800]:
>While looking for early possible module loading failures I was
>able to reproduce a memory leak possible with kmemleak. There
>are a few rare ways to trigger a failure:
>
>  o we've run into a failure while processing kernel parameters
>    (parse_args() returns an error)
>  o mod_sysfs_setup() fails
>  o we're a live patch module and copy_module_elf() fails
>
>Chances of running into this issue is really low.
>
>kmemleak splat:
>
>unreferenced object 0xffff9f2c4ada1b00 (size 32):
>  comm "kworker/u16:4", pid 82, jiffies 4294897636 (age 681.816s)
>  hex dump (first 32 bytes):
>    6d 65 6d 73 74 69 63 6b 30 00 00 00 00 00 00 00  memstick0.......
>    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>  backtrace:
>    [<ffffffff8c6cfeba>] kmemleak_alloc+0x4a/0xa0
>    [<ffffffff8c200046>] __kmalloc_track_caller+0x126/0x230
>    [<ffffffff8c1bc581>] kstrdup+0x31/0x60
>    [<ffffffff8c1bc5d4>] kstrdup_const+0x24/0x30
>    [<ffffffff8c3c23aa>] kvasprintf_const+0x7a/0x90
>    [<ffffffff8c3b5481>] kobject_set_name_vargs+0x21/0x90
>    [<ffffffff8c4fbdd7>] dev_set_name+0x47/0x50
>    [<ffffffffc07819e5>] memstick_check+0x95/0x33c [memstick]
>    [<ffffffff8c09c893>] process_one_work+0x1f3/0x4b0
>    [<ffffffff8c09cb98>] worker_thread+0x48/0x4e0
>    [<ffffffff8c0a2b79>] kthread+0xc9/0xe0
>    [<ffffffff8c6dab5f>] ret_from_fork+0x1f/0x40
>    [<ffffffffffffffff>] 0xffffffffffffffff
>
>Cc: stable <stable@...r.kernel.org> # v2.6.30
>Fixes: e180a6b7759a ("param: fix charp parameters set via sysfs")
>Reviewed-by: Miroslav Benes <mbenes@...e.cz>
>Reviewed-by: Aaron Tomlin <atomlin@...hat.com>
>Signed-off-by: Luis R. Rodriguez <mcgrof@...nel.org>

Pushed out. Thanks Luis!

>---
> kernel/module.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/kernel/module.c b/kernel/module.c
>index 38d4270925d4..8409a82424d2 100644
>--- a/kernel/module.c
>+++ b/kernel/module.c
>@@ -3722,6 +3722,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
> 	mod_sysfs_teardown(mod);
>  coming_cleanup:
> 	mod->state = MODULE_STATE_GOING;
>+	destroy_params(mod->kp, mod->num_kp);
> 	blocking_notifier_call_chain(&module_notify_list,
> 				     MODULE_STATE_GOING, mod);
> 	klp_module_going(mod);
>-- 
>2.10.2
>