linux-kernel - [Linux Kernel Bug] memory leak in ubi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALGdzuo8_EXr4aUAw6X9S+yzMPi25Y82netPLWsd+3n-Ov9Pnw@mail.gmail.com>
Date: Mon, 22 Jan 2024 21:53:14 -0600
From: Chenyuan Yang <chenyuan0y@...il.com>
To: linux-mtd@...ts.infradead.org, richard@....at, miquel.raynal@...tlin.com, 
	vigneshr@...com
Cc: linux-kernel@...r.kernel.org, syzkaller@...glegroups.com, 
	Zijie Zhao <zzjas98@...il.com>
Subject: [Linux Kernel Bug] memory leak in ubi_attach

Dear Linux Kernel Developers for UBI,

We encountered "memory leak in ubi_attach" when testing UBI with
Syzkaller and our generated specifications.

syz repro: https://drive.google.com/file/d/17FoGw6akfufz05U-oRBP2wXmOiFF1VUq/view?usp=drive_link
C reproducer: https://drive.google.com/file/d/1ayd3lmHPvqNoI01pQEdU832EktpTUnZ_/view?usp=drive_link
report: https://drive.google.com/file/d/1hC2arY3FbQt-6L5rbDfY-DQ2oH82IIGq/view?usp=drive_link
stats: https://drive.google.com/file/d/1REig9fV0H1fYPWaiicc-JVLlCpo7TTw4/view?usp=drive_link

This memory leak is triggered by `ioctl$UBI_IOCATT`, where
`ubi_attach_info` invokes `kmem_cache_create`
(https://elixir.bootlin.com/linux/v6.7/source/drivers/mtd/ubi/attach.c#L1464).
It seems that the memory leak occurs when the slab cache is
successfully created. I apologize for not being able to conduct a
deeper analysis of the root cause, as my expertise in UBI drivers is
limited.

If you have any questions or require more information, please feel
free to contact us.

Reported-by: Chenyuan Yang <chenyuan0y@...il.com>

Best,
Chenyuan

Download attachment "repro.cprog" of type "application/octet-stream" (41955 bytes)

Download attachment "repro.prog" of type "application/octet-stream" (632 bytes)