linux-kernel - Re: [PATCH] efivarfs: fix memory leak in efivarfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXEaLF7kvWORrTF+UM8qCbgzXzr4WLtOTM_aDm8Ggyao5Q@mail.gmail.com>
Date:   Mon, 26 Oct 2020 08:15:59 +0100
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@...il.com>
Cc:     Matthew Garrett <matthew.garrett@...ula.com>,
        Jeremy Kerr <jk@...abs.org>,
        linux-efi <linux-efi@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] efivarfs: fix memory leak in efivarfs_create()

On Fri, 23 Oct 2020 at 13:54, Vamshi K Sthambamkadi
<vamshi.k.sthambamkadi@...il.com> wrote:
>
> kmemleak report:
>   unreferenced object 0xffff9b8915fcb000 (size 4096):
>   comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s)
>   hex dump (first 32 bytes):
>     2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  -...............
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
>     [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
>     [<00000000e6ee18fc>] path_openat+0xe4b/0x1120
>     [<000000000ad0414f>] do_filp_open+0x91/0x100
>     [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
>     [<000000002a91be6d>] do_sys_open+0x46/0x80
>     [<000000000a854999>] __x64_sys_openat+0x20/0x30
>     [<00000000c50d89c9>] do_syscall_64+0x38/0x90
>     [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> In efivarfs_create(), inode->i_private is setup with efivar_entry
> object which is never freed.
>
> Signed-off-by: Vamshi K Sthambamkadi <vamshi.k.sthambamkadi@...il.com>

Queued as a fix, thanks!

> ---
>  fs/efivarfs/super.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
> index 15880a6..f943fd0 100644
> --- a/fs/efivarfs/super.c
> +++ b/fs/efivarfs/super.c
> @@ -21,6 +21,7 @@ LIST_HEAD(efivarfs_list);
>  static void efivarfs_evict_inode(struct inode *inode)
>  {
>         clear_inode(inode);
> +       kfree(inode->i_private);
>  }
>
>  static const struct super_operations efivarfs_ops = {
> --
> 2.7.4
>