linux-kernel - Re: [PATCH -next] sysctl: fix memleak in proc_sys_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20200813164931.GW4332@42.do-not-panic.com>
Date:   Thu, 13 Aug 2020 16:49:31 +0000
From:   Luis Chamberlain <mcgrof@...nel.org>
To:     Yang Yingliang <yangyingliang@...wei.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        keescook@...omium.org, yzaikin@...gle.com, willy@...radead.org,
        hch@....de
Subject: Re: [PATCH -next] sysctl: fix memleak in proc_sys_call_handler()

On Tue, Aug 04, 2020 at 03:45:03PM +0000, Yang Yingliang wrote:
> I got a memleak report when doing some fuzz test:
> 
> BUG: memory leak
> unreferenced object 0xffff888103f3da00 (size 64):
> comm "syz-executor.0", pid 2270, jiffies 4295404698 (age 46.593s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<000000004f2c0607>] kmalloc include/linux/slab.h:559 [inline]
> [<000000004f2c0607>] kzalloc include/linux/slab.h:666 [inline]
> [<000000004f2c0607>] proc_sys_call_handler+0x1d4/0x480 fs/proc/proc_sysctl.c:574
> [<000000005ec6a16b>] call_write_iter include/linux/fs.h:1876 [inline]
> [<000000005ec6a16b>] new_sync_write+0x3c5/0x5b0 fs/read_write.c:515
> [<00000000bbeebb83>] vfs_write+0x4e8/0x670 fs/read_write.c:595
> [<000000009d967c93>] ksys_write+0x10c/0x220 fs/read_write.c:648
> [<00000000139f6002>] do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
> [<00000000b7d61f44>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> Go to free buff when copy_from_iter_full() is failed.
> 
> Fixes: 1dea05cbc0d7 ("sysctl: Convert to iter interfaces")
> Reported-by: Hulk Robot <hulkci@...wei.com>
> Signed-off-by: Yang Yingliang <yangyingliang@...wei.com>

Acked-by: Luis Chamberlain <mcgrof@...nel.org>

Good catch.

  Luis
> ---
>  fs/proc/proc_sysctl.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
> index 9f6b9c3e3fda..a4a3122f8a58 100644
> --- a/fs/proc/proc_sysctl.c
> +++ b/fs/proc/proc_sysctl.c
> @@ -578,7 +578,7 @@ static ssize_t proc_sys_call_handler(struct kiocb *iocb, struct iov_iter *iter,
>  	if (write) {
>  		error = -EFAULT;
>  		if (!copy_from_iter_full(kbuf, count, iter))
> -			goto out;
> +			goto out_free_buf;
>  		kbuf[count] = '\0';
>  	}
>  
> -- 
> 2.25.1
>