linux-kernel - Re: [PATCH] regmap: debugfs: really fix memory leak in regmap_debugfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 30 Jun 2020 15:59:11 +0100
From:   Mark Brown <broonie@...nel.org>
To:     Juergen Borleis <jbe@...gutronix.de>
Cc:     linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "Rafael J . Wysocki" <rafael@...nel.org>, kernel@...gutronix.de
Subject: Re: [PATCH] regmap: debugfs: really fix memory leak in
 regmap_debugfs_init()

On Tue, Jun 30, 2020 at 12:06:50PM +0200, Juergen Borleis wrote:

>   unreferenced object 0xec548c80 (size 64):
>   comm "swapper/0", pid 1, jiffies 4294937356 (age 3385.690s)
>   hex dump (first 32 bytes):
>     64 75 6d 6d 79 2d 69 6f 6d 75 78 63 2d 67 70 72  dummy-iomuxc-gpr
>     40 32 30 65 30 30 30 30 00 7d cc fa 7c df bf 7d  @20e0000.}..|..}
>   backtrace:
>     [<703904e1>] __kmalloc_track_caller+0x1dc/0x43c
>     [<523053d0>] kvasprintf+0x64/0xd8
>     [<0d94bbe5>] kasprintf+0x38/0x5c

Please think hard before including complete backtraces in upstream
reports, they are very large and contain almost no useful information
relative to their size so often obscure the relevant content in your
message. If part of the backtrace is usefully illustrative (it often is
for search engines if nothing else) then it's usually better to pull out
the relevant sections.

> For this specific i.MX device the regmap_debugfs_init() function is called
> twice for the same object:

> - first call: with name = "iomuxc-gpr@...0000", but the underlying device
>   has no name yet. So, regmap_debugfs_init() allocates the string
>   "dummy-iomuxc-gpr@...0000" into 'map->debugfs_name' (and this string is
>   the one 'kmemleak' reports in its output).

> - second call: with name = "gpr" and the underlying device now has the
>   name "20e0000.iomuxc". So, regmap_debugfs_init() again allocates
>   a string "20e0000.iomuxc-gpr" into 'map->debugfs_name'.

This sounds like an issue in and of itself - why are we initializing the
same regmap twice without first destroying it?

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)