linux-kernel - Re: [PATCH -next] jffs2: fix memory leak in jffs2_do_fill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c2f49973-e5be-475a-1b92-77fc6e86ba37@huawei.com>
Date:   Mon, 23 May 2022 14:00:21 +0800
From:   "libaokun (A)" <libaokun1@...wei.com>
To:     <richard@....at>, <dwmw2@...radead.org>,
        <linux-mtd@...ts.infradead.org>, <linux-kernel@...r.kernel.org>
CC:     <yukuai3@...wei.com>, Baokun Li <libaokun1@...wei.com>
Subject: Re: [PATCH -next] jffs2: fix memory leak in jffs2_do_fill_super

ping

在 2022/4/12 17:38, Baokun Li 写道:
> If jffs2_iget() or d_make_root() in jffs2_do_fill_super() returns
> an error, we can observe the following kmemleak report:
>
> --------------------------------------------
> unreferenced object 0xffff888105a65340 (size 64):
>    comm "mount", pid 710, jiffies 4302851558 (age 58.239s)
>    hex dump (first 32 bytes):
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>    backtrace:
>      [<ffffffff859c45e5>] kmem_cache_alloc_trace+0x475/0x8a0
>      [<ffffffff86160146>] jffs2_sum_init+0x96/0x1a0
>      [<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120
>      [<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810
>      [<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0
>      [...]
> unreferenced object 0xffff8881bd7f0000 (size 65536):
>    comm "mount", pid 710, jiffies 4302851558 (age 58.239s)
>    hex dump (first 32 bytes):
>      bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
>      bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb  ................
>    backtrace:
>      [<ffffffff858579ba>] kmalloc_order+0xda/0x110
>      [<ffffffff85857a11>] kmalloc_order_trace+0x21/0x130
>      [<ffffffff859c2ed1>] __kmalloc+0x711/0x8a0
>      [<ffffffff86160189>] jffs2_sum_init+0xd9/0x1a0
>      [<ffffffff86140e25>] jffs2_do_mount_fs+0x745/0x2120
>      [<ffffffff86149fec>] jffs2_do_fill_super+0x35c/0x810
>      [<ffffffff8614aae9>] jffs2_fill_super+0x2b9/0x3b0
>      [...]
> --------------------------------------------
>
> This is because the resources allocated in jffs2_sum_init() are not
> released. Call jffs2_sum_exit() to release these resources to solve
> the problem.
>
> Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time improvement)")
> Signed-off-by: Baokun Li <libaokun1@...wei.com>
> ---
>   fs/jffs2/fs.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
> index 71f03a5d36ed..f83a468b6488 100644
> --- a/fs/jffs2/fs.c
> +++ b/fs/jffs2/fs.c
> @@ -604,6 +604,7 @@ int jffs2_do_fill_super(struct super_block *sb, struct fs_context *fc)
>   	jffs2_free_raw_node_refs(c);
>   	kvfree(c->blocks);
>   	jffs2_clear_xattr_subsystem(c);
> +	jffs2_sum_exit(c);
>    out_inohash:
>   	kfree(c->inocache_list);
>    out_wbuf: