linux-kernel - Re: [PATCH v2] mtd: spi-nor: fix memory leak when using debugfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 08 Feb 2023 15:24:31 +0100
From:   Michael Walle <michael@...le.cc>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org,
        Tudor Ambarus <tudor.ambarus@...rochip.com>,
        Pratyush Yadav <pratyush@...nel.org>,
        Miquel Raynal <miquel.raynal@...tlin.com>,
        Richard Weinberger <richard@....at>,
        Vignesh Raghavendra <vigneshr@...com>,
        linux-mtd@...ts.infradead.org, stable <stable@...nel.org>
Subject: Re: [PATCH v2] mtd: spi-nor: fix memory leak when using
 debugfs_lookup()

Am 2023-02-08 15:12, schrieb Greg Kroah-Hartman:
> On Wed, Feb 08, 2023 at 02:36:23PM +0100, Michael Walle wrote:
>> Am 2023-02-08 13:57, schrieb Greg Kroah-Hartman:
>> > When calling debugfs_lookup() the result must have dput() called on it,
>> > otherwise the memory will leak over time.
>> >
>> > Cc: Tudor Ambarus <tudor.ambarus@...rochip.com>
>> > Cc: Pratyush Yadav <pratyush@...nel.org>
>> > Cc: Michael Walle <michael@...le.cc>
>> > Cc: Miquel Raynal <miquel.raynal@...tlin.com>
>> > Cc: Richard Weinberger <richard@....at>
>> > Cc: Vignesh Raghavendra <vigneshr@...com>
>> > Cc: linux-mtd@...ts.infradead.org
>> > Cc: stable <stable@...nel.org>
>> > Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
>> > ---
>> > v2: fix up to work when module is removed and added, making the fix
>> >     much simpler.
>> >
>> >  drivers/mtd/spi-nor/debugfs.c | 1 +
>> >  1 file changed, 1 insertion(+)
>> >
>> > diff --git a/drivers/mtd/spi-nor/debugfs.c
>> > b/drivers/mtd/spi-nor/debugfs.c
>> > index ff895f6758ea..af41fbc09a97 100644
>> > --- a/drivers/mtd/spi-nor/debugfs.c
>> > +++ b/drivers/mtd/spi-nor/debugfs.c
>> > @@ -242,6 +242,7 @@ void spi_nor_debugfs_register(struct spi_nor *nor)
>> >
>> >  	d = debugfs_create_dir(dev_name(nor->dev), rootdir);
>> >  	nor->debugfs_root = d;
>> > +	dput(rootdir);
>> 
>> rootdir might either be the return value of debugfs_lookup() or
>> debugfs_create_dir(). dput() is probably wrong for the latter,
>> right? Also there is an early return, where the dput() is missing,
>> too.
> 
> {sigh}
> 
> Yeah, this is all wrong, sorry.  Let me fix this up again, properly.
> And to do it properly, let's have the module remove the directory if it
> is unloaded, like a good module should :)

There were some complications. IIRC you'd need to do reference counting,
to determine whether you are the last user of the rootdir. Other subsys
create an empty rootdir in their .init(). But that was hard to do in 
MTD.
Again memory is hazy.. Therefore, I resorted to create it on the fly if
there isn't already one.

Maybe you got some better/simpler idea :)

-michael