linux-kernel - Re: [PATCH] net: microchip: vcap api: Fix memory leaks in vcap_api_encode_rule

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <D4T2M90I0282.D2DYJ3EITRTH@microchip.com>
Date: Fri, 11 Oct 2024 17:10:08 +0200
From: Jens Emil Schulz Østergaard
	<jensemil.schulzostergaard@...rochip.com>
To: Daniel Machon <daniel.machon@...rochip.com>, Jinjie Ruan
	<ruanjinjie@...wei.com>
CC: <lars.povlsen@...rochip.com>, <Steen.Hegelund@...rochip.com>,
	<davem@...emloft.net>, <edumazet@...gle.com>, <kuba@...nel.org>,
	<pabeni@...hat.com>, <UNGLinuxDriver@...rochip.com>,
	<linux-arm-kernel@...ts.infradead.org>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] net: microchip: vcap api: Fix memory leaks in
 vcap_api_encode_rule_test()

On Fri Oct 11, 2024 at 12:24 PM CEST, Daniel Machon wrote:
> > Cc: stable@...r.kernel.org
> > Fixes: a3c1e45156ad ("net: microchip: vcap: Fix use-after-free error in kunit test")
> > Signed-off-by: Jinjie Ruan <ruanjinjie@...wei.com>
> > ---
> >  drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
> > index f2a5a36fdacd..7251121ab196 100644
> > --- a/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
> > +++ b/drivers/net/ethernet/microchip/vcap/vcap_api_kunit.c
> > @@ -1444,6 +1444,8 @@ static void vcap_api_encode_rule_test(struct kunit *test)
> > 
> >         ret = vcap_del_rule(&test_vctrl, &test_netdev, id);
> >         KUNIT_EXPECT_EQ(test, 0, ret);
> > +
> > +       vcap_free_rule(rule);
> >  }
>
> Wait, should vcap_del_rule not handle the freeing of the rule?
> Maybe Emil can shed some light on this..
>
> /Daniel
>

No, this is a bug. I made the mistake of thinking that vcap_del_rule freed the
rule.

However, it frees an internal copy of the rule, which is made in vcap_add_rule.
The local copy must still be freed. I reproduced the leak and the patch fixes
this.

/Emil