linux-kernel - Re: [Linux Kernel Bug] memory leak in ubi_attach

Open Source and information security mailing list archives

Message-ID: <CALGdzuryBbCqGAhox9ZWaQHD5dSQNApfGmCP+rYZ7O4MCRH+rw@mail.gmail.com>
Date: Mon, 22 Jan 2024 22:57:04 -0600
From: Chenyuan Yang <chenyuan0y@...il.com>
To: Zhihao Cheng <chengzhihao1@...wei.com>
Cc: linux-mtd@...ts.infradead.org, richard@....at, miquel.raynal@...tlin.com, 
	vigneshr@...com, linux-kernel@...r.kernel.org, syzkaller@...glegroups.com, 
	Zijie Zhao <zzjas98@...il.com>
Subject: Re: [Linux Kernel Bug] memory leak in ubi_attach

Hi Zhihao,

Thanks for your prompt reply! Here are the files related to this memory leak.

Best,
Chenyuan

On Mon, Jan 22, 2024 at 10:55 PM Zhihao Cheng <chengzhihao1@...wei.com> wrote:
>
> 在 2024/1/23 11:53, Chenyuan Yang 写道:
> > Dear Linux Kernel Developers for UBI,
> >
> > We encountered "memory leak in ubi_attach" when testing UBI with
> > Syzkaller and our generated specifications.
> >
> > syz repro: https://drive.google.com/file/d/17FoGw6akfufz05U-oRBP2wXmOiFF1VUq/view?usp=drive_link
> > C reproducer: https://drive.google.com/file/d/1ayd3lmHPvqNoI01pQEdU832EktpTUnZ_/view?usp=drive_link
> > report: https://drive.google.com/file/d/1hC2arY3FbQt-6L5rbDfY-DQ2oH82IIGq/view?usp=drive_link
> > stats: https://drive.google.com/file/d/1REig9fV0H1fYPWaiicc-JVLlCpo7TTw4/view?usp=drive_link
>
> I can't open above links in company, may you post these files in attachment?
>
> >
> > This memory leak is triggered by `ioctl$UBI_IOCATT`, where
> > `ubi_attach_info` invokes `kmem_cache_create`
> > (https://elixir.bootlin.com/linux/v6.7/source/drivers/mtd/ubi/attach.c#L1464).
> > It seems that the memory leak occurs when the slab cache is
> > successfully created. I apologize for not being able to conduct a
> > deeper analysis of the root cause, as my expertise in UBI drivers is
> > limited.
> >
> > If you have any questions or require more information, please feel
> > free to contact us.
> >
> > Reported-by: Chenyuan Yang <chenyuan0y@...il.com>
> >
> > Best,
> > Chenyuan
> >
> >
> > ______________________________________________________
> > Linux MTD discussion mailing list
> > http://lists.infradead.org/mailman/listinfo/linux-mtd/
> >
>

Download attachment "repro.report" of type "application/octet-stream" (2206 bytes)

Download attachment "repro.cprog" of type "application/octet-stream" (41955 bytes)

Download attachment "repro.prog" of type "application/octet-stream" (632 bytes)

Content of type "application/octet-stream" skipped

Content truncated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives