linux-kernel - Re: [PATCH v2 0/3] Refactor __kmem_cache

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y2IgUwTH/dO06Tot@hyeyoo>
Date:   Wed, 2 Nov 2022 16:46:27 +0900
From:   Hyeonggon Yoo <42.hyeyoo@...il.com>
To:     Liu Shixin <liushixin2@...wei.com>
Cc:     Christoph Lameter <cl@...ux.com>,
        Pekka Enberg <penberg@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Vlastimil Babka <vbabka@...e.cz>,
        Roman Gushchin <roman.gushchin@...ux.dev>, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 0/3] Refactor __kmem_cache_create() and fix memory leak

On Mon, Oct 31, 2022 at 09:47:44PM +0800, Liu Shixin wrote:
> I found a memory leak of kobj->name in sysfs_slab_add() which is introduced
> by 80da026a8e5d ("mm/slub: fix slab double-free in case of duplicate sysfs filename").
> Following the rules stated in the comment for kobject_init_and_add():

Thank you for reporting this! Indeed it seems tried to fix double free but
introduced a leak.

>  If this function returns an error, kobject_put() must be called to
>  properly clean up the memory associated with the object.
> 
> We should use kobject_put() to free kobject.

But what to do if a cache is created early and later sysfs_slab_add() failed?
(Which is unlikely on normal condition)

With this series it introduces use-after-free if sysfs_slab_add() in
slab_sysfs_init() failed.  Should we just call BUG() or something like that?

> But we can't simply add kobject_put() since it will free kmem_cache too.
> If we use kobject_put(), we need to skip other release functions.
> 
> In this series, We refactor the code to separate sysfs_slab_add() and
> debugfs_slab_add() from __kmem_cache_create(), and then use kobject_put()
> to free kobject in sysfs_slab_add(). This can fix the memory leak of
> kobject->name.
> 
> v1->v2: Fix build error reported by kernel test robot <lkp@...el.com>.
> 
> Liu Shixin (3):
>   mm/slab_common: Move cache_name to create_cache()
>   mm/slub: Refactor __kmem_cache_create()
>   mm/slub: Fix memory leak of kobj->name in sysfs_slab_add()
> 
>  include/linux/slub_def.h | 11 +++++++++
>  mm/slab_common.c         | 44 ++++++++++++++++++----------------
>  mm/slub.c                | 52 ++++++++++------------------------------
>  3 files changed, 48 insertions(+), 59 deletions(-)
> 
> -- 
> 2.25.1
> 

-- 
Thanks,
Hyeonggon