linux-kernel - Re: [PATCH 3/3] net-sysfs: Fix error path for kobject_init_and

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 8 May 2019 22:52:23 +0800
From:   "wanghai (M)" <wanghai26@...wei.com>
To:     Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        "Tobin C. Harding" <tobin@...nel.org>
CC:     "David S. Miller" <davem@...emloft.net>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Tyler Hicks <tyhicks@...onical.com>,
        "Ido Schimmel" <idosch@...lanox.com>,
        Alexander Duyck <alexander.h.duyck@...el.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        YueHaibing <yuehaibing@...wei.com>,
        Amritha Nambiar <amritha.nambiar@...el.com>,
        Dmitry Torokhov <dmitry.torokhov@...il.com>,
        <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 3/3] net-sysfs: Fix error path for kobject_init_and_add()


在 2019/5/1 0:11, Andy Shevchenko 写道:
> On Tue, Apr 30, 2019 at 10:28:17AM +1000, Tobin C. Harding wrote:
>> Currently error return from kobject_init_and_add() is not followed by a
>> call to kobject_put().  This means there is a memory leak.
>>
>> Add call to kobject_put() in error path of kobject_init_and_add().
> It's not obvious to me if this will help to fix what is stated in the
> (reverted) commit 6b70fc94afd1 ("net-sysfs: Fix memory leak in
> netdev_register_kobject")?
>
> If so, perhaps we need to tell syzkaller guys about this.
Thanks for reminding. It seems that the bug has not been completely fixed.

in netdev_register_kobject():

1746         error = device_add(dev);
1747         if (error)
1748                 return error;
1749
1750         error = register_queue_kobjects(ndev);
1751         if (error) {
1752                 device_del(dev);
1753                 return error;
1754         }

This only fixes a memory leak after a failure in 
register_queue_kobjects(). If device_add() fails, kobject_put() still 
cann't be called, and the memory leak still exists.