linux-kernel - Re: [BUG RESEND] [BISECTED]: selftest: ftracetest: memleak in vfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6e8cf1cf-44bd-9d17-1c9d-d25c02f614fc@alu.unizg.hr>
Date:   Wed, 5 Apr 2023 06:01:20 +0200
From:   Mirsad Goran Todorovac <mirsad.todorovac@....unizg.hr>
To:     Eric Biggers <ebiggers@...nel.org>
Cc:     LKML <linux-kernel@...r.kernel.org>,
        Alexander Viro <viro@...iv.linux.org.uk>,
        linux-fsdevel@...r.kernel.org,
        Thorsten Leemhuis <regressions@...mhuis.info>,
        Ulf Hansson <ulf.hansson@...aro.org>,
        Steven Rostedt <rostedt@...dmis.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Shuah Khan <shuah@...nel.org>, linux-kselftest@...r.kernel.org
Subject: Re: [BUG RESEND] [BISECTED]: selftest: ftracetest: memleak in
 vfs_write()

On 05. 04. 2023. 00:07, Eric Biggers wrote:
> Hi Mirsad,
> 
> On Tue, Apr 04, 2023 at 09:52:10PM +0200, Mirsad Goran Todorovac wrote:
>>   backtrace:
>>     [<ffffffffb4afb23c>] slab_post_alloc_hook+0x8c/0x3e0
>>     [<ffffffffb4b02b19>] __kmem_cache_alloc_node+0x1d9/0x2a0
>>     [<ffffffffb4a77785>] __kmalloc+0x55/0x160
>>     [<ffffffffb493a913>] tracing_log_err+0x1a3/0x1d0
>>     [<ffffffffb4959049>] append_filter_err.isra.13+0x119/0x190
>>     [<ffffffffb495a89f>] create_filter+0xbf/0xe0
>>     [<ffffffffb495ab10>] create_event_filter+0x10/0x20
>>     [<ffffffffb495c040>] set_trigger_filter+0xa0/0x180
>>     [<ffffffffb495d745>] event_trigger_parse+0xf5/0x160
>>     [<ffffffffb495c889>] trigger_process_regex+0xc9/0x120
>>     [<ffffffffb495c976>] event_trigger_write+0x86/0xf0
>>     [<ffffffffb4b52dc2>] vfs_write+0xf2/0x520
>>     [<ffffffffb4b533d8>] ksys_write+0x68/0xe0
>>     [<ffffffffb4b5347e>] __x64_sys_write+0x1e/0x30
>>     [<ffffffffb586619c>] do_syscall_64+0x5c/0x90
>>     [<ffffffffb5a000ae>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
>>
>> Please find the complete debug info at the URL:
>>
>> https://domac.alu.unizg.hr/~mtodorov/linux/bugreports/ftracetest/
>>
>> Bisect log is [edited]:
>>
>>> git bisect good a92ce570c81dc0feaeb12a429b4bc65686d17967
>>> # good: [c6f613e5f35b0e2154d5ca12f0e8e0be0c19be9a] ipmi/watchdog: use strscpy() to instead of strncpy()
>>> git bisect good c6f613e5f35b0e2154d5ca12f0e8e0be0c19be9a
>>> # good: [90b12f423d3c8a89424c7bdde18e1923dfd0941e] Merge tag 'for-linus-6.2-1' of https://github.com/cminyard/linux-ipmi
>>> git bisect good 90b12f423d3c8a89424c7bdde18e1923dfd0941e
>>> # first bad commit: [71946a25f357a51dcce849367501d7fb04c0465b] Merge tag 'mmc-v6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc
>>>
>>> The commit was merged on December 13th 2022.
>>
>> The amount of applied diffs in the culprit commit 71946a25f357a51dcce849367501d7fb04c0465b
>> prevents me from bisecting further - I do not know which changes depend of which, and which
>> can be tested independently.
>>
>> Hopefully I might come up with a reproducer, but I need some feedback first. Maybe there
>> are ways to narrow down the lines of code that could have caused the leaks, yet I am
>> completely new to the kernel/trace subtree.
>>
>> Apologies for not Cc:ing Ulf nine weeks ago, but it was an omission, not deliberate act.
>>
> 
> This looks like an issue with the tracing subsystem.  I appreciate that you've
> now added the tracing maintainers to Cc.  I don't think your bisection to commit
> 71946a25f357 ("Merge tag 'mmc-v6.2' ...") is correct; that looks unrelated.
> 
> - Eric

Hi, Eric,

In the light of Steven's correct fix, you are obviously right, so I will investigate
where the bisect went wrong.

I should have added selftest/ftrace/ftracetest developers already on Jan 27th, and it
would be fixed for 6.2 already :-/

The good news is that I seem to be improving in hunting down the memleaks. Hopefully
I will hunt down a real security exploit?

All the best.

Best regards,
Mirsad

-- 
Mirsad Goran Todorovac
Sistem inženjer
Grafički fakultet | Akademija likovnih umjetnosti
Sveučilište u Zagrebu
 
System engineer
Faculty of Graphic Arts | Academy of Fine Arts
University of Zagreb, Republic of Croatia
The European Union

"I see something approaching fast ... Will it be friends with me?"