linux-kernel - [Linux Kernel Bug] memory leak in posix_clock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALGdzupf2Eh-_E-0ZyHa23sHKqo7-e==A9DR9FDsiMNPjtpbEg@mail.gmail.com>
Date: Wed, 24 Jan 2024 10:22:48 -0600
From: Chenyuan Yang <chenyuan0y@...il.com>
To: davem@...emloft.net, reibax@...il.com, linux-kernel@...r.kernel.org
Cc: syzkaller@...glegroups.com, Zijie Zhao <zzjas98@...il.com>
Subject: [Linux Kernel Bug] memory leak in posix_clock_open

Dear Linux Developers for Posix Timer,

We encountered "memory leak in posix_clock_open" when testing the
posix timer with
Syzkaller and our generated specifications.

```
BUG: memory leak
unreferenced object 0xffff888000f66fa0 (size 16):
  comm "syz-executor.0", pid 21073, jiffies 4295079945 (age 8.800s)
  hex dump (first 16 bytes):
    00 b8 d6 0d 80 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8162788a>] kmemleak_alloc_recursive
include/linux/kmemleak.h:42 [inline]
    [<ffffffff8162788a>] slab_post_alloc_hook mm/slab.h:766 [inline]
    [<ffffffff8162788a>] slab_alloc_node mm/slub.c:3478 [inline]
    [<ffffffff8162788a>] __kmem_cache_alloc_node+0x2fa/0x3e0 mm/slub.c:3517
    [<ffffffff81572354>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1098
    [<ffffffff81388b0e>] kmalloc include/linux/slab.h:600 [inline]
    [<ffffffff81388b0e>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff81388b0e>] posix_clock_open+0x5e/0xe0
kernel/time/posix-clock.c:126
    [<ffffffff81692d69>] chrdev_open+0x119/0x340 fs/char_dev.c:414
    [<ffffffff81680706>] do_dentry_open+0x336/0x9e0 fs/open.c:948
    [<ffffffff816a9659>] do_open fs/namei.c:3622 [inline]
    [<ffffffff816a9659>] path_openat+0x1799/0x1b00 fs/namei.c:3779
    [<ffffffff816aa5ce>] do_filp_open+0xce/0x1b0 fs/namei.c:3809
    [<ffffffff816843ed>] do_sys_openat2+0xdd/0x130 fs/open.c:1440
    [<ffffffff81684d53>] do_sys_open fs/open.c:1455 [inline]
    [<ffffffff81684d53>] __do_sys_openat fs/open.c:1471 [inline]
    [<ffffffff81684d53>] __se_sys_openat fs/open.c:1466 [inline]
    [<ffffffff81684d53>] __x64_sys_openat+0x83/0xe0 fs/open.c:1466
    [<ffffffff84ae676f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
    [<ffffffff84ae676f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b

BUG: leak checking failed
```
I have attached the reproducible C program and its configuration for
this crash. Please note that the C program has not been minimized
because there were issues with syz-repro.

For this memory leak, it seems that the `pccontext` allocated by
kzalloc (https://elixir.bootlin.com/linux/v6.7/source/kernel/time/posix-clock.c#L126)
is not released correctly.

If you have any questions or require more information, please feel
free to contact us.

Reported-by: Chenyuan Yang <chenyuan0y@...il.com>

Best,
Chenyuan

Download attachment "repro.c" of type "application/octet-stream" (104879 bytes)

Download attachment "report" of type "application/octet-stream" (1724 bytes)

Download attachment "config" of type "application/octet-stream" (242732 bytes)