linux-kernel - Re: [PATCH 1/3] x86/kexec: fix memory leak of elf header buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20211122015529.GA7968@MiWiFi-R3L-srv>
Date:   Mon, 22 Nov 2021 09:55:29 +0800
From:   Baoquan He <bhe@...hat.com>
To:     linux-kernel@...r.kernel.org
Cc:     kexec@...ts.infradead.org, dyoung@...hat.com,
        akpm@...ux-foundation.org
Subject: Re: [PATCH 1/3] x86/kexec: fix memory leak of elf header buffer

On 10/29/21 at 03:24pm, Baoquan He wrote:
> This is reported by kmemleak detector:
> 
> unreferenced object 0xffffc900002a9000 (size 4096):
>   comm "kexec", pid 14950, jiffies 4295110793 (age 373.951s)
>   hex dump (first 32 bytes):
>     7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00  .ELF............
>     04 00 3e 00 01 00 00 00 00 00 00 00 00 00 00 00  ..>.............
>   backtrace:
>     [<0000000016a8ef9f>] __vmalloc_node_range+0x101/0x170
>     [<000000002b66b6c0>] __vmalloc_node+0xb4/0x160
>     [<00000000ad40107d>] crash_prepare_elf64_headers+0x8e/0xcd0
>     [<0000000019afff23>] crash_load_segments+0x260/0x470
>     [<0000000019ebe95c>] bzImage64_load+0x814/0xad0
>     [<0000000093e16b05>] arch_kexec_kernel_image_load+0x1be/0x2a0
>     [<000000009ef2fc88>] kimage_file_alloc_init+0x2ec/0x5a0
>     [<0000000038f5a97a>] __do_sys_kexec_file_load+0x28d/0x530
>     [<0000000087c19992>] do_syscall_64+0x3b/0x90
>     [<0000000066e063a4>] entry_SYSCALL_64_after_hwframe+0x44/0xae
> 
> In crash_prepare_elf64_headers(), a buffer is allocated via vmalloc() to
> store elf headers. While it's not freed back to system correctly when
> kdump kernel is reloaded or unloaded. Then memory leak is caused.
> 
> Fix it by introducing x86 specific function
> arch_kimage_file_post_load_cleanup(), and freeing the buffer there.
> 
> Signed-off-by: Baoquan He <bhe@...hat.com>

It deserves to add a Fixes tag, and this drawback exists since
kexec_file_load added. It wastes one page of memory, or severa pages
depending on the cpu numbers, not sure if it deserves to cc stable.

Fixes: cb1052581e2b ("kexec: implementation of new syscall kexec_file_load")


> ---
>  arch/x86/kernel/machine_kexec_64.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
> index 131f30fdcfbd..fd8223fa2de5 100644
> --- a/arch/x86/kernel/machine_kexec_64.c
> +++ b/arch/x86/kernel/machine_kexec_64.c
> @@ -511,6 +511,15 @@ int arch_kexec_apply_relocations_add(struct purgatory_info *pi,
>  	       (int)ELF64_R_TYPE(rel[i].r_info), value);
>  	return -ENOEXEC;
>  }
> +
> +int arch_kimage_file_post_load_cleanup(struct kimage *image)
> +{
> +	vfree(image->elf_headers);
> +	image->elf_headers = NULL;
> +	image->elf_headers_sz = 0;
> +
> +	return kexec_image_post_load_cleanup_default(image);
> +}
>  #endif /* CONFIG_KEXEC_FILE */
>  
>  static int
> -- 
> 2.17.2
>