linux-kernel - Re: [PATCH] isofs: avoid memory leak in iocharset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241106124000.kcrscsv5nrtporjs@quack3>
Date: Wed, 6 Nov 2024 13:40:00 +0100
From: Jan Kara <jack@...e.cz>
To: Hao Ge <hao.ge@...ux.dev>
Cc: jack@...e.cz, sandeen@...hat.com, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, Hao Ge <gehao@...inos.cn>
Subject: Re: [PATCH] isofs: avoid memory leak in iocharset

On Wed 06-11-24 16:28:41, Hao Ge wrote:
> From: Hao Ge <gehao@...inos.cn>
> 
> A memleak was found as below:
> 
> unreferenced object 0xffff0000d10164d8 (size 8):
>   comm "pool-udisksd", pid 108217, jiffies 4295408555
>   hex dump (first 8 bytes):
>     75 74 66 38 00 cc cc cc                          utf8....
>   backtrace (crc de430d31):
>     [<ffff800081046e6c>] kmemleak_alloc+0xb8/0xc8
>     [<ffff8000803e6c3c>] __kmalloc_node_track_caller_noprof+0x380/0x474
>     [<ffff800080363b74>] kstrdup+0x70/0xfc
>     [<ffff80007bb3c6a4>] isofs_parse_param+0x228/0x2c0 [isofs]
>     [<ffff8000804d7f68>] vfs_parse_fs_param+0xf4/0x164
>     [<ffff8000804d8064>] vfs_parse_fs_string+0x8c/0xd4
>     [<ffff8000804d815c>] vfs_parse_monolithic_sep+0xb0/0xfc
>     [<ffff8000804d81d8>] generic_parse_monolithic+0x30/0x3c
>     [<ffff8000804d8bfc>] parse_monolithic_mount_data+0x40/0x4c
>     [<ffff8000804b6a64>] path_mount+0x6c4/0x9ec
>     [<ffff8000804b6e38>] do_mount+0xac/0xc4
>     [<ffff8000804b7494>] __arm64_sys_mount+0x16c/0x2b0
>     [<ffff80008002b8dc>] invoke_syscall+0x7c/0x104
>     [<ffff80008002ba44>] el0_svc_common.constprop.1+0xe0/0x104
>     [<ffff80008002ba94>] do_el0_svc+0x2c/0x38
>     [<ffff800081041108>] el0_svc+0x3c/0x1b8
> 
> The opt->iocharset is freed inside the isofs_fill_super function,
> But there may be situations where it's not possible to
> enter this function.
> 
> For example, in the get_tree_bdev_flags function,when
> encountering the situation where "Can't mount, would change RO state,"
> In such a case, isofs_fill_super will not have the opportunity
> to be called,which means that opt->iocharset will not have the chance
> to be freed,ultimately leading to a memory leak.
> 
> Let's move the memory freeing of opt->iocharset into
> isofs_free_fc function.
> 
> Fixes: 1b17a46c9243 ("isofs: convert isofs to use the new mount API")
> Signed-off-by: Hao Ge <gehao@...inos.cn>

Thanks. I've added the patch to my tree.

								Honza
-- 
Jan Kara <jack@...e.com>
SUSE Labs, CR