linux-kernel - [PATCH] ufs: Fix memory leak in the unlink path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20180705150415.25070-1-lhenriques@suse.com>
Date:   Thu,  5 Jul 2018 16:04:15 +0100
From:   Luis Henriques <lhenriques@...e.com>
To:     Evgeniy Dushistov <dushistov@...l.ru>
Cc:     linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        Luis Henriques <lhenriques@...e.com>
Subject: [PATCH] ufs: Fix memory leak in the unlink path

While running generic xfstests against ufs (ufstype=44bsd), a lot of memory
leaks were reported by kmemleak (in particular with generic/074).  It is
easily reproducible by simply doing:

  dd if=/dev/zero of=test bs=1024 count=1024
  unlink test

which will result in having kmemleak reporting:

unreferenced object 0xffff8800623f8980 (size 96):
  comm "unlink", pid 172, jiffies 4294905029 (age 60.804s)
  hex dump (first 32 bytes):
    e0 06 00 00 00 00 00 00 08 00 00 00 00 00 00 00  ................
    50 51 df 59 00 88 ff ff a8 50 df 59 00 88 ff ff  PQ.Y.....P.Y....
  backtrace:
    [<00000000ceff4f7a>] free_full_branch+0xdc/0x6b0
    [<0000000085b47ac6>] ufs_truncate_blocks+0x1532/0x19f0
    [<000000008edf50d0>] ufs_evict_inode+0xa5/0xe0
    [<00000000561ed122>] evict+0x384/0x530
    [<0000000082158199>] iput+0x407/0x5f0
    [<00000000a3a41e2b>] do_unlinkat+0x470/0x4d0
    [<0000000006651ccb>] do_syscall_64+0x21e/0x580
    [<000000008771be7f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
    [<000000005a459012>] 0xffffffffffffffff

Fix this by kfree'ing the ufs_buffer_head allocated through ubh_bread in
free_full_branch.  While there, drop the NULL check as this is already done
in bforget.

Cc: stable@...r.kernel.org
Signed-off-by: Luis Henriques <lhenriques@...e.com>
---
 fs/ufs/util.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/fs/ufs/util.c b/fs/ufs/util.c
index 4fa633f84274..76df052701b0 100644
--- a/fs/ufs/util.c
+++ b/fs/ufs/util.c
@@ -131,8 +131,9 @@ void ubh_bforget (struct ufs_buffer_head * ubh)
 	unsigned i;
 	if (!ubh) 
 		return;
-	for ( i = 0; i < ubh->count; i++ ) if ( ubh->bh[i] ) 
+	for ( i = 0; i < ubh->count; i++ )
 		bforget (ubh->bh[i]);
+	kfree (ubh);
 }
  
 int ubh_buffer_dirty (struct ufs_buffer_head * ubh)