linux-kernel - Re: [PATCH v2] module: check if memory leak by module.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <06383e49-148e-e31f-e66e-e50db7df470b@virtuozzo.com>
Date:   Thu, 30 Mar 2017 17:31:45 +0300
From:   Andrey Ryabinin <aryabinin@...tuozzo.com>
To:     Pavel Machek <pavel@....cz>
CC:     Maninder Singh <maninder1.s@...sung.com>, <jeyu@...hat.com>,
        <rusty@...tcorp.com.au>, <akpm@...ux-foundation.org>,
        <chris@...is-wilson.co.uk>, <joonas.lahtinen@...ux.intel.com>,
        <mhocko@...e.com>, <keescook@...omium.org>, <jinb.park7@...il.com>,
        <anisse@...ier.eu>, <rafael.j.wysocki@...el.com>,
        <zijun_hu@....com>, <mingo@...nel.org>, <mawilcox@...rosoft.com>,
        <thgarnie@...gle.com>, <joelaf@...gle.com>,
        <kirill.shutemov@...ux.intel.com>, <linux-mm@...ck.org>,
        <linux-kernel@...r.kernel.org>, <pankaj.m@...sung.com>,
        <ajeet.y@...sung.com>, <hakbong5.lee@...sung.com>,
        <a.sahrawat@...sung.com>, <lalit.mohan@...sung.com>,
        <cpgs@...sung.com>, Vaneet Narang <v.narang@...sung.com>
Subject: Re: [PATCH v2] module: check if memory leak by module.



On 03/30/2017 04:37 PM, Pavel Machek wrote:
>  
>>  3) This might produce false positives. E.g. module may defer vfree() in workqueue, so the 
>>      actual vfree() call happens after module unloaded.
> 
> Umm. Really?
> 

I should have been more specific. I meant vfree() called by module from the interrupt context.
In that case the actual __vunmap() will be deferred via schedule_work() thus it might happen
after the module unloaded.
See 32fcfd40715e ("make vfree() safe to call from interrupt contexts")

> I agree that module may alloc memory and pass it to someone else. Ok
> so far.
> 

Right. In the case with vfree() from interrupt we actually pass the memory to
the core code to free it later. 

> But if module code executes after module is unloaded -- that is use
> after free -- right?

Sure, module code can't execute after module unloaded, it doesn't exist anymore.