linux-kernel - [PATCH] posix-timers: fix the pccontext memleak in posix_clock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20240315031310.21749-1-qiang.zhang1211@gmail.com>
Date: Fri, 15 Mar 2024 11:13:10 +0800
From: Zqiang <qiang.zhang1211@...il.com>
To: tglx@...utronix.de,
	liujingfeng@...nxin.com,
	qiang.zhang1211@...il.com
Cc: linux-kernel@...r.kernel.org
Subject: [PATCH] posix-timers: fix the pccontext memleak in posix_clock_open()

Currently, if the posix_clock structure's->ops.open return error in
posix_clock_open(), the pccontext object is not released, this commit
therefore invoke kfree() to released it.

unreferenced object 0xffff8881065327c0 (size 16):
  comm "syz-executor.7", pid 8994, jiffies 4295144661 (age 17.222s)
  hex dump (first 16 bytes):
    00 20 79 01 81 88 ff ff 00 00 00 00 00 00 00 00  . y.............
  backtrace:
    [<00000000fba736c4>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<00000000fba736c4>] slab_post_alloc_hook mm/slab.h:766 [inline]
    [<00000000fba736c4>] slab_alloc_node mm/slub.c:3478 [inline]
    [<00000000fba736c4>] __kmem_cache_alloc_node+0x1ee/0x250 mm/slub.c:3517
    [<00000000f8fcb419>] kmalloc_trace+0x22/0xc0 mm/slab_common.c:1098
    [<00000000afc910b4>] kmalloc include/linux/slab.h:600 [inline]
    [<00000000afc910b4>] kzalloc include/linux/slab.h:721 [inline]
    [<00000000afc910b4>] posix_clock_open+0xd3/0x250 kernel/time/posix-clock.c:126
    [<00000000b1a43627>] chrdev_open+0x24b/0x6a0 fs/char_dev.c:414
    [<00000000364febd5>] do_dentry_open+0x630/0x1580 fs/open.c:948
    [<00000000ac62c8f4>] do_open fs/namei.c:3622 [inline]
    [<00000000ac62c8f4>] path_openat+0x13f1/0x1c30 fs/namei.c:3779
    [<0000000087bfc1bc>] do_filp_open+0x1c5/0x410 fs/namei.c:3809
    [<0000000044db899a>] do_sys_openat2+0x139/0x190 fs/open.c:1437
    [<00000000ee967f42>] do_sys_open fs/open.c:1452 [inline]
    [<00000000ee967f42>] __do_sys_openat fs/open.c:1468 [inline]
    [<00000000ee967f42>] __se_sys_openat fs/open.c:1463 [inline]
    [<00000000ee967f42>] __x64_sys_openat+0x13d/0x1f0 fs/open.c:1463
    [<000000004fad64b5>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    [<000000004fad64b5>] do_syscall_64+0x3e/0xf0 arch/x86/entry/common.c:83
    [<00000000c2701c13>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

Reported-by: Liujingfeng <liujingfeng@...nxin.com>
Signed-off-by: Zqiang <qiang.zhang1211@...il.com>
---
 kernel/time/posix-clock.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index 9de66bbbb3d1..68990dd66956 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -137,6 +137,9 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
 
 	if (!err) {
 		get_device(clk->dev);
+	} else {
+		kfree(pccontext);
+		fp->private_data = NULL;
 	}
 out:
 	up_read(&clk->rwsem);
-- 
2.17.1