linux-kernel - Re: [PATCH 1/6] afs: Fix missing put on afs_read objects and missing get on the key therein

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAB9dFduo9smK9VvPPKYPFXNdyvQu723UsnrfVDRvk8Eq+g7gFg@mail.gmail.com>
Date:   Fri, 10 Sep 2021 18:10:42 -0300
From:   Marc Dionne <marc.dionne@...istor.com>
To:     David Howells <dhowells@...hat.com>
Cc:     linux-afs@...ts.infradead.org,
        Markus Suvanto <markus.suvanto@...il.com>,
        linux-fsdevel@...r.kernel.org,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/6] afs: Fix missing put on afs_read objects and missing
 get on the key therein

On Wed, Sep 8, 2021 at 12:58 PM David Howells <dhowells@...hat.com> wrote:
>
> The afs_read objects created by afs_req_issue_op() get leaked because
> afs_alloc_read() returns a ref and then afs_fetch_data() gets its own ref
> which is released when the operation completes, but the initial ref is
> never released.
>
> Fix this by discarding the initial ref at the end of afs_req_issue_op().
>
> This leak also covered another bug whereby a ref isn't got on the key
> attached to the read record by afs_req_issue_op().  This isn't a problem as
> long as the afs_read req never goes away...
>
> Fix this by calling key_get() in afs_req_issue_op().
>
> This was found by the generic/074 test.  It leaks a bunch of kmalloc-192
> objects each time it is run, which can be observed by watching
> /proc/slabinfo.
>
> Fixes: f7605fa869cf ("afs: Fix leak of afs_read objects")
> Reported-by: Marc Dionne <marc.dionne@...istor.com>
> Signed-off-by: David Howells <dhowells@...hat.com>
> cc: linux-afs@...ts.infradead.org
> Link: https://lore.kernel.org/r/163010394740.3035676.8516846193899793357.stgit@warthog.procyon.org.uk/
> ---
>
>  fs/afs/file.c |    3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/fs/afs/file.c b/fs/afs/file.c
> index db035ae2a134..6688fff14b0b 100644
> --- a/fs/afs/file.c
> +++ b/fs/afs/file.c
> @@ -295,7 +295,7 @@ static void afs_req_issue_op(struct netfs_read_subrequest *subreq)
>         fsreq->subreq   = subreq;
>         fsreq->pos      = subreq->start + subreq->transferred;
>         fsreq->len      = subreq->len   - subreq->transferred;
> -       fsreq->key      = subreq->rreq->netfs_priv;
> +       fsreq->key      = key_get(subreq->rreq->netfs_priv);
>         fsreq->vnode    = vnode;
>         fsreq->iter     = &fsreq->def_iter;
>
> @@ -304,6 +304,7 @@ static void afs_req_issue_op(struct netfs_read_subrequest *subreq)
>                         fsreq->pos, fsreq->len);
>
>         afs_fetch_data(fsreq->vnode, fsreq);
> +       afs_put_read(fsreq);
>  }
>
>  static int afs_symlink_readpage(struct page *page)

Tested that it prevents the leak of about 49K kmalloc-192 objects for
a run of generic/074.

Reviewed-and-tested-by: Marc Dionne <marc.dionne@...istor.com>

Marc