linux-kernel - [PATCH -next 2/2] kobject: fix memory leak when kobject_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240925120747.1930709-3-cuigaosheng1@huawei.com>
Date: Wed, 25 Sep 2024 20:07:47 +0800
From: Gaosheng Cui <cuigaosheng1@...wei.com>
To: <gregkh@...uxfoundation.org>, <rafael@...nel.org>,
	<akpm@...ux-foundation.org>, <thunder.leizhen@...wei.com>,
	<cuigaosheng1@...wei.com>, <wangweiyang2@...wei.com>
CC: <linux-kernel@...r.kernel.org>, <stable@...r.kernel.org>
Subject: [PATCH -next 2/2] kobject: fix memory leak when kobject_add_varg() returns error

Inject fault while loading module, kobject_add_varg() may fail.
If it fails, the kset.kobj.name allocated by kobject_set_name_vargs()
may be leaked, the call trace as follow:

unreferenced object 0xffff8884ef4fccc0 (size 32):
  comm "modprobe", pid 56721, jiffies 4304802933
  backtrace (crc 4b069391):
    [<ffffffff85e9fb2b>] kmemleak_alloc+0x4b/0x80
    [<ffffffff83664674>] __kmalloc_node_track_caller_noprof+0x3d4/0x510
    [<ffffffff83510656>] kstrdup+0x46/0x80
    [<ffffffff8351070f>] kstrdup_const+0x6f/0x90
    [<ffffffff84213842>] kvasprintf_const+0x112/0x190
    [<ffffffff85d8446b>] kobject_set_name_vargs+0x5b/0x160
    [<ffffffff85d85969>] kobject_init_and_add+0xc9/0x170
    [<ffffffff83661788>] sysfs_slab_add+0x188/0x230
    [<ffffffff83665e24>] do_kmem_cache_create+0x4d4/0x5a0
    [<ffffffff835343cd>] __kmem_cache_create_args+0x18d/0x310
    [<ffffffffc64a08b4>] 0xffffffffc64a08b4
    [<ffffffffc64a005f>] 0xffffffffc64a005f
    [<ffffffff82a04198>] do_one_initcall+0xb8/0x590
    [<ffffffff82f0c626>] do_init_module+0x256/0x7d0
    [<ffffffff82f12f73>] load_module+0x5953/0x7010
    [<ffffffff82f14b0a>] init_module_from_file+0xea/0x140

To mitigate this, we need to check return value of kobject_add_internal,
and free the name when an error is encountered.

Fixes: 244f6cee9a92 ("kobject: add kobject_add_ng function")
Signed-off-by: Gaosheng Cui <cuigaosheng1@...wei.com>
---
 lib/kobject.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/lib/kobject.c b/lib/kobject.c
index ecca72622933..365e2ad12cba 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -371,7 +371,13 @@ static __printf(3, 0) int kobject_add_varg(struct kobject *kobj,
 		return retval;
 	}
 	kobj->parent = parent;
-	return kobject_add_internal(kobj);
+	retval = kobject_add_internal(kobj);
+	if (retval) {
+		kfree_const(kobj->name);
+		kobj->name = NULL;
+	}
+
+	return retval;
 }
 
 /**
-- 
2.25.1