linux-kernel - memleak around kobject_init_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 27 Apr 2019 18:13:30 +1000
From:   "Tobin C. Harding" <me@...in.cc>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J. Wysocki" <rafael@...nel.org>
Cc:     cl@...ux.com, tycho@...ho.ws, willy@...radead.org,
        linux-kernel@...r.kernel.org
Subject: memleak around kobject_init_and_add()

(Note at bottom on reasons for 'To' list 'Cc' list)

Hi,

kobject_init_and_add() seems to be routinely misused.  A failed call to this
function requires a call to kobject_put() otherwise we leak memory.

Examples memleaks can be seen in:

	mm/slub.c
	fs/btrfs/sysfs.c
	fs/xfs/xfs_sysfs.h: xfs_sysfs_init()

 Question: Do we fix the misuse or fix the API?

$ git grep kobject_init_and_add | wc -l
117

Either way, we will have to go through all 117 call sites and check them.  I
don't mind fixing them all but I don't want to do it twice because I chose the
wrong option.  Reaching out to those more experienced for a suggestion please.

Fix the API
-----------

Typically init functions do not require cleanup if they fail, this argument
leads to this patch

diff --git a/lib/kobject.c b/lib/kobject.c
index aa89edcd2b63..62328054bbd0 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -453,6 +453,9 @@ int kobject_init_and_add(struct kobject *kobj, struct kobj_type *ktype,
 	retval = kobject_add_varg(kobj, parent, fmt, args);
 	va_end(args);

+	if (retval)
+		kobject_put(kobj);
+
 	return retval;
 }
 EXPORT_SYMBOL_GPL(kobject_init_and_add);

Fix all the call sites
----------------------

Go through all 117 call sites and add kobj_put() in the error path.

This example from mm/slub.c

diff --git a/mm/slub.c b/mm/slub.c
index d30ede89f4a6..84a9d6c06c27 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -5756,8 +5756,10 @@ static int sysfs_slab_add(struct kmem_cache *s)

 	s->kobj.kset = kset;
 	err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
-	if (err)
+	if (err) {
+		kobject_put(&s->kobj);
 		goto out;
+	}

 	err = sysfs_create_group(&s->kobj, &slab_attr_group);
 	if (err)

thanks,
Tobin.

This is a Saturday afternoon 'drinking some wine, hacking on the kernel'
email.  Sending it to the lib/kobject.c maintainers for obvious
reasons.  CC'd a few extra people who I thought might be interested to
take the weight of Greg and Rafael :)