linux-kernel - Re: [PATCH v2] net: qrtr: free flow in __qrtr_node

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 30 Jun 2020 16:28:13 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     cjhuang@...eaurora.org
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        ath11k@...ts.infradead.org
Subject: Re: [PATCH v2] net: qrtr: free flow in __qrtr_node_release

From: Carl Huang <cjhuang@...eaurora.org>
Date: Tue, 30 Jun 2020 14:52:51 +0800

> The flow is allocated in qrtr_tx_wait, but not freed when qrtr node
> is released. (*slot) becomes NULL after radix_tree_iter_delete is
> called in __qrtr_node_release. The fix is to save (*slot) to a
> vairable and then free it.
> 
> This memory leak is catched when kmemleak is enabled in kernel,
> the report looks like below:
> 
> unreferenced object 0xffffa0de69e08420 (size 32):
>   comm "kworker/u16:3", pid 176, jiffies 4294918275 (age 82858.876s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 28 84 e0 69 de a0 ff ff  ........(..i....
>     28 84 e0 69 de a0 ff ff 03 00 00 00 00 00 00 00  (..i............
>   backtrace:
>     [<00000000e252af0a>] qrtr_node_enqueue+0x38e/0x400 [qrtr]
>     [<000000009cea437f>] qrtr_sendmsg+0x1e0/0x2a0 [qrtr]
>     [<000000008bddbba4>] sock_sendmsg+0x5b/0x60
>     [<0000000003beb43a>] qmi_send_message.isra.3+0xbe/0x110 [qmi_helpers]
>     [<000000009c9ae7de>] qmi_send_request+0x1c/0x20 [qmi_helpers]
> 
> Signed-off-by: Carl Huang <cjhuang@...eaurora.org>

Applied and queued up for -stable, thanks.