linux-kernel - Re: [PATCH] perf/x86/uncore: fix a potential double-free in uncore_type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4e1e710a.1d65f.18c3926bb7d.Coremail.dinghao.liu@zju.edu.cn>
Date:   Tue, 5 Dec 2023 16:44:48 +0800 (GMT+08:00)
From:   dinghao.liu@....edu.cn
To:     "Zhenyu Wang" <zhenyuw@...ux.intel.com>
Cc:     "Peter Zijlstra" <peterz@...radead.org>,
        "Ingo Molnar" <mingo@...hat.com>,
        "Arnaldo Carvalho de Melo" <acme@...nel.org>,
        "Mark Rutland" <mark.rutland@....com>,
        "Alexander Shishkin" <alexander.shishkin@...ux.intel.com>,
        "Jiri Olsa" <jolsa@...nel.org>,
        "Namhyung Kim" <namhyung@...nel.org>,
        "Ian Rogers" <irogers@...gle.com>,
        "Adrian Hunter" <adrian.hunter@...el.com>,
        "Thomas Gleixner" <tglx@...utronix.de>,
        "Borislav Petkov" <bp@...en8.de>,
        "Dave Hansen" <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>,
        "Colin Ian King" <colin.i.king@...il.com>,
        linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] perf/x86/uncore: fix a potential double-free in
 uncore_type_init

> On 2023.12.05 11:27:09 +0800, Dinghao Liu wrote:
> > When kzalloc for pmus[i].boxes fails, we should clean up pmus
> > to prevent memleak. However, when kzalloc for attr_group fails,
> > pmus has been assigned to type->pmus, and freeing will be done
> > later on by the callers. The chain is: uncore_type_init ->
> > uncore_types_init -> uncore_pci_init -> uncore_types_exit ->
> > uncore_type_exit. Therefore, freeing pmus in uncore_type_init
> > may cause a double-free. Fix this by setting type->pmus to
> > NULL after kfree.
> 
> Change is ok but the call trace you wrote here is reversed or malformed??
> With that fixed or cleared.
> 

Thanks for your advice. I will fix it and resend a new patch soon.

Regards,
Dinghao