linux-kernel - Re: [PATCH] audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 3 Aug 2022 13:24:26 -0700
From:   Peilin Ye <yepeilin.cs@...il.com>
To:     Paul Moore <paul@...l-moore.com>
Cc:     Jens Axboe <axboe@...nel.dk>,
        Pavel Begunkov <asml.silence@...il.com>,
        Eric Paris <eparis@...hat.com>,
        Peilin Ye <peilin.ye@...edance.com>, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-audit@...hat.com
Subject: Re: [PATCH] audit, io_uring, io-wq: Fix memory leak in
 io_sq_thread() and io_wqe_worker()

Hi,

On Wed, Aug 03, 2022 at 03:28:19PM -0400, Paul Moore wrote:
> On Wed, Aug 3, 2022 at 9:16 AM Paul Moore <paul@...l-moore.com> wrote:
> > On Wed, Aug 3, 2022 at 1:03 AM Peilin Ye <yepeilin.cs@...il.com> wrote:
> > > Hi all,
> > >
> > > A better way to fix this memleak would probably be checking
> > > @args->io_thread in copy_process()?  Something like:
> > >
> > >     if (args->io_thread)
> > >         retval = audit_alloc_kernel();
> > >     else
> > >         retval = audit_alloc();
> > >
> > > But I didn't want to add another if to copy_process() for this bugfix.
> > > Please suggest, thanks!
> >
> > Thanks for the report and patch!  I'll take a closer look at this
> > today and get back to you.
> 
> I think the best solution to this is simply to remove the calls to
> audit_alloc_kernel() in the io_uring and io-wq code, as well as the
> audit_alloc_kernel() function itself.  As long as create_io_thread()
> ends up calling copy_process to create the new kernel thread the
> audit_context should be allocated correctly.  Peilin Ye, are you able
> to draft a patch to do that and give it a test?

Sure, I will write a v2 today.  Thanks for the suggestion!

> For those that may be wondering how this happened (I definitely was!),
> it looks like when I first started working on the LSM/audit support
> for io_uring it was before the v5.12-rc1 release when
> create_io_thread() was introduced.  Prior to create_io_thread() it
> appears that io_uring/io-wq wasn't calling into copy_process() and
> thus was not getting an audit_context allocated in the kernel thread's
> task_struct; the solution for those original development drafts was to
> add a call to a new audit_alloc_kernel() which would handle the
> audit_context allocation.  Unfortunately, I didn't notice the move to
> create_io_thread() during development and the redundant
> audit_alloc_kernel() calls remained :/

Thanks,
Peilin Ye