linux-kernel - Re: [PATCH 1/6] kexec: fix a memory leak in crash_shrink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZHaQ7qRYWX9FETu6@MiWiFi-R3L-srv>
Date:   Wed, 31 May 2023 08:13:00 +0800
From:   Baoquan He <bhe@...hat.com>
To:     Zhen Lei <thunder.leizhen@...wei.com>
Cc:     Eric Biederman <ebiederm@...ssion.com>, kexec@...ts.infradead.org,
        linux-kernel@...r.kernel.org,
        Michael Holzheu <holzheu@...ux.vnet.ibm.com>,
        Andrew Morton <akpm@...ux-foundation.org>
Subject: Re: [PATCH 1/6] kexec: fix a memory leak in crash_shrink_memory()

On 05/27/23 at 08:34pm, Zhen Lei wrote:
> If the value of parameter 'new_size' is in the semi-open and semi-closed
> interval (crashk_res.end - KEXEC_CRASH_MEM_ALIGN + 1, crashk_res.end], the
> calculation result of ram_res is:
> 	ram_res->start = crashk_res.end + 1
> 	ram_res->end   = crashk_res.end

If the new_size is smaller than KEXEC_CRASH_MEM_ALIGN, does it make
any sense except of testing purpose? Do we need to fail this kind of
shrinking, or just shrink all the left crash memory?

> The operation of function insert_resource() fails, and ram_res is not
> added to iomem_resource. As a result, the memory of the control block
> ram_res is leaked.
> 
> In fact, on all architectures, the start address and size of crashk_res
> are already aligned by KEXEC_CRASH_MEM_ALIGN. Therefore, we do not need to
> round up crashk_res.start again. Instead, we should round up 'new_size'
> in advance.
> 
> Fixes: 6480e5a09237 ("kdump: add missing RAM resource in crash_shrink_memory()")
> Fixes: 06a7f711246b ("kexec: premit reduction of the reserved memory size")
> Signed-off-by: Zhen Lei <thunder.leizhen@...wei.com>
> ---
>  kernel/kexec_core.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c
> index 3d578c6fefee385..22acee18195a591 100644
> --- a/kernel/kexec_core.c
> +++ b/kernel/kexec_core.c
> @@ -1122,6 +1122,7 @@ int crash_shrink_memory(unsigned long new_size)
>  	start = crashk_res.start;
>  	end = crashk_res.end;
>  	old_size = (end == 0) ? 0 : end - start + 1;
> +	new_size = roundup(new_size, KEXEC_CRASH_MEM_ALIGN);
>  	if (new_size >= old_size) {
>  		ret = (new_size == old_size) ? 0 : -EINVAL;
>  		goto unlock;
> @@ -1133,9 +1134,7 @@ int crash_shrink_memory(unsigned long new_size)
>  		goto unlock;
>  	}
>  
> -	start = roundup(start, KEXEC_CRASH_MEM_ALIGN);
> -	end = roundup(start + new_size, KEXEC_CRASH_MEM_ALIGN);
> -
> +	end = start + new_size;
>  	crash_free_reserved_phys_range(end, crashk_res.end);
>  
>  	if ((start == end) && (crashk_res.parent != NULL))
> -- 
> 2.25.1
>