linux-kernel - Re: INFO: REPRODUCED: memory leak in gpio device in 6.2-rc6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 8 Feb 2023 20:55:24 +0100
From:   Mirsad Goran Todorovac <mirsad.todorovac@....unizg.hr>
To:     linux-gpio@...r.kernel.org
Cc:     Linus Walleij <linus.walleij@...aro.org>,
        Bartosz Golaszewski <brgl@...ev.pl>,
        linux-kernel@...r.kernel.org,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        Bartosz Golaszewski <brgl@...ev.pl>
Subject: Re: INFO: REPRODUCED: memory leak in gpio device in 6.2-rc6

Hi all,

On 31. 01. 2023. 10:36, Mirsad Goran Todorovac wrote:
> Hi all,
> 
> I came across this memory leak apparently in the GPIO device driver.
> It is still present in 6.2-rc6 release candidate kernel (just ran kselftest).
> 
> This is a vanilla Torvalds tree kernel with MGLRU and KMEMLEAK (obviously)
> enabled.
> 
> If you think this bug is significant, I can attempt the bug bisect in the
> environment that triggered it (Lenovo LENOVO_MT_10TX_BU_Lenovo_FM_V530S-07ICB)
> with BIOS M22KT49A from 11/10/2022 and AlmaLinux 8.7.
> 
> Here is the /sys/kernel/debug/kmemleak output:
> 
> unreferenced object 0xffff9e67ad71f160 (size 32):
>   comm "gpio-sim.sh", pid 208926, jiffies 4372229685 (age 2101.564s)
>   hex dump (first 32 bytes):
>     67 70 69 6f 2d 73 69 6d 2e 30 2d 6e 6f 64 65 30  gpio-sim.0-node0
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<0000000098bf3d1b>] slab_post_alloc_hook+0x91/0x320
>     [<00000000da3205c5>] __kmem_cache_alloc_node+0x1bf/0x2b0
>     [<00000000aa51a58a>] __kmalloc_node_track_caller+0x55/0x140
>     [<00000000bd682ecc>] kvasprintf+0x6b/0xd0
>     [<00000000a3431d55>] kasprintf+0x4e/0x70
>     [<00000000f52d2629>] gpio_sim_device_config_live_store+0x401/0x59d [gpio_sim]
>     [<00000000673fc6df>] configfs_write_iter+0xcc/0x130
>     [<000000001d5d0829>] vfs_write+0x2b4/0x3d0
>     [<00000000d2336251>] ksys_write+0x61/0xe0
>     [<00000000f7015bb1>] __x64_sys_write+0x1a/0x20
>     [<000000008ac743d2>] do_syscall_64+0x58/0x80
>     [<000000004d7b7d50>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
> [root@...mtodorov marvin]#

The new development on the bug is that it probably requires some superuser privileges
or some capability to be exploited, for it requires access to configfs,
but it was reproduced on different hardware as well.

The minimum reproducing script is attached, with its output log.

>From the testing "age" of the unreferenced object I assume that it is allocated earlier
in a part of script I am unable to locate or specify, but orphaned at the end of the script.

root@...me/user/kernel_bugs/gpio-sim# time ./gpio-reproduce-min.sh
2.14. Lines can be hogged
Scanning stage 2.14.7 ... done.
Sleeping 60 seconds ... done.
Stage 2.14.7 clean.
Rescanning stage 2.14.7 ... done.
Sleeping 60 seconds ... done.
unreferenced object 0xffff9593b9d16bc0 (size 32):
  comm "gpio-reproduce-", pid 7594, jiffies 4295865460 (age 136.184s)
  hex dump (first 32 bytes):
    67 70 69 6f 2d 73 69 6d 2e 30 2d 6e 6f 64 65 30  gpio-sim.0-node0
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000fe76444b>] __kmem_cache_alloc_node+0x380/0x4e0
    [<0000000099f63f55>] __kmalloc_node_track_caller+0x55/0x140
    [<00000000c4efe87f>] kvasprintf+0x6b/0xd0
    [<000000000c0f91cd>] kasprintf+0x4e/0x70
    [<000000003434d9b5>] gpio_sim_device_config_live_store+0x401/0x59d [gpio_sim]
    [<0000000052ce6759>] configfs_write_iter+0xcc/0x130
    [<0000000006087fd2>] vfs_write+0x2b4/0x3d0
    [<000000008a17e041>] ksys_write+0x61/0xe0
    [<000000007bded8ea>] __x64_sys_write+0x1a/0x20
    [<00000000e1220148>] do_syscall_64+0x58/0x80
    [<0000000006093069>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

real	2m16.398s
user	0m0.023s
sys	0m16.360s
root@...me/user/kernel_bugs/gpio-sim# 

The effect is cummulative:

root@...vin-IdeaPad-3-15ITL6:/home/user/kernel_bugs/gpio-sim# cat /sys/kernel/debug/kmemleak 
unreferenced object 0xffff9593b9d16bc0 (size 32):
  comm "gpio-reproduce-", pid 7594, jiffies 4295865460 (age 520.296s)
  hex dump (first 32 bytes):
    67 70 69 6f 2d 73 69 6d 2e 30 2d 6e 6f 64 65 30  gpio-sim.0-node0
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000fe76444b>] __kmem_cache_alloc_node+0x380/0x4e0
    [<0000000099f63f55>] __kmalloc_node_track_caller+0x55/0x140
    [<00000000c4efe87f>] kvasprintf+0x6b/0xd0
    [<000000000c0f91cd>] kasprintf+0x4e/0x70
    [<000000003434d9b5>] gpio_sim_device_config_live_store+0x401/0x59d [gpio_sim]
    [<0000000052ce6759>] configfs_write_iter+0xcc/0x130
    [<0000000006087fd2>] vfs_write+0x2b4/0x3d0
    [<000000008a17e041>] ksys_write+0x61/0xe0
    [<000000007bded8ea>] __x64_sys_write+0x1a/0x20
    [<00000000e1220148>] do_syscall_64+0x58/0x80
    [<0000000006093069>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
unreferenced object 0xffff95938918fb40 (size 32):
  comm "gpio-reproduce-", pid 7675, jiffies 4295954327 (age 164.832s)
  hex dump (first 32 bytes):
    67 70 69 6f 2d 73 69 6d 2e 30 2d 6e 6f 64 65 30  gpio-sim.0-node0
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000fe76444b>] __kmem_cache_alloc_node+0x380/0x4e0
    [<0000000099f63f55>] __kmalloc_node_track_caller+0x55/0x140
    [<00000000c4efe87f>] kvasprintf+0x6b/0xd0
    [<000000000c0f91cd>] kasprintf+0x4e/0x70
    [<000000003434d9b5>] gpio_sim_device_config_live_store+0x401/0x59d [gpio_sim]
    [<0000000052ce6759>] configfs_write_iter+0xcc/0x130
    [<0000000006087fd2>] vfs_write+0x2b4/0x3d0
    [<000000008a17e041>] ksys_write+0x61/0xe0
    [<000000007bded8ea>] __x64_sys_write+0x1a/0x20
    [<00000000e1220148>] do_syscall_64+0x58/0x80
    [<0000000006093069>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
unreferenced object 0xffff9594a3cf1820 (size 32):
  comm "gpio-reproduce-", pid 7721, jiffies 4295976853 (age 74.728s)
  hex dump (first 32 bytes):
    67 70 69 6f 2d 73 69 6d 2e 30 2d 6e 6f 64 65 30  gpio-sim.0-node0
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000fe76444b>] __kmem_cache_alloc_node+0x380/0x4e0
    [<0000000099f63f55>] __kmalloc_node_track_caller+0x55/0x140
    [<00000000c4efe87f>] kvasprintf+0x6b/0xd0
    [<000000000c0f91cd>] kasprintf+0x4e/0x70
    [<000000003434d9b5>] gpio_sim_device_config_live_store+0x401/0x59d [gpio_sim]
    [<0000000052ce6759>] configfs_write_iter+0xcc/0x130
    [<0000000006087fd2>] vfs_write+0x2b4/0x3d0
    [<000000008a17e041>] ksys_write+0x61/0xe0
    [<000000007bded8ea>] __x64_sys_write+0x1a/0x20
    [<00000000e1220148>] do_syscall_64+0x58/0x80
    [<0000000006093069>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
root@...vin-IdeaPad-3-15ITL6:/home/user/kernel_bugs/gpio-sim# 

With sufficient privileges (or possibly even without them), an exploit can be devised
to automate allocation of orphaned objects, at a rate of a couple per second (PoC attached).

Regards,

-- 
Mirsad Goran Todorovac
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
 
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
The European Union

View attachment "gpio-trace.log" of type "text/x-log" (2418 bytes)

Download attachment "gpio-reproduce-min.sh" of type "application/x-shellscript" (5067 bytes)

Download attachment "gpio-min-iterate.sh" of type "application/x-shellscript" (5166 bytes)