linux-kernel - Re: [syzbot] memory leak in __mdiobus

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Sep 2021 02:27:33 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     syzbot <syzbot+398e7dc692ddbbb4cfec@...kaller.appspotmail.com>,
        gregkh@...uxfoundation.org, linux-kernel@...r.kernel.org,
        rafael@...nel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] memory leak in __mdiobus_register

On 9/26/21 04:28, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    d9fb678414c0 Merge tag 'afs-fixes-20210913' of git://git.k..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=131c754b300000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f0de362a1f17687e
> dashboard link: https://syzkaller.appspot.com/bug?extid=398e7dc692ddbbb4cfec
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=145650d1300000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=105ccde7300000
> 

Looks like MDIOBUS_ALLOCATED indicated 2 states:

	1. Bus is only allocated
	2. Bus allocated and __mdiobus_register() fails, but
	   device_register() was called

These 2 cases should be handled separately, i.e. we need to call 
put_device() if device_register() was called.

To handle this situation we can add new state MDIOBUS_DEV_REGISTERED and 
handle it properly


Just for thoughts and syzbot testing

#syz test
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


With regards,
Pavel Skripkin






View attachment "ph" of type "text/plain" (998 bytes)