| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <Z8g8vhS9rqQ_ez48@google.com>
Date: Wed, 5 Mar 2025 11:59:58 +0000
From: Alice Ryhl <aliceryhl@...gle.com>
To: Sudeep Holla <sudeep.holla@....com>, Cristian Marussi <cristian.marussi@....com>
Cc: linux-arm-kernel@...ts.infradead.org, arm-scmi@...r.kernel.org,
linux-kernel@...r.kernel.org
Subject: [Bug report] Memory leak in scmi_device_create
Dear SYSTEM CONTROL & POWER/MANAGEMENT INTERFACE (SCPI/SCMI) Message
Protocol drivers maintainers,
I flashed a v6.13-rc3 kernel onto a Rock5B board and noticed the
following output in my terminal:
[ 687.694465] kmemleak: 4 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
It seems that there is a memory leak for devices created with
scmi_device_create.
This was with a kernel running v6.13-rc3, but as far as I can tell, no
relevant changes have landed since v6.13-rc3. My tree *does* include
commit 295416091e44 ("firmware: arm_scmi: Fix slab-use-after-free in
scmi_bus_notifier()"). I've only seen this kmemleak report once, so it's
not happening consistently.
See below for the full kmemleak report.
Alice
$ sudo cat /sys/kernel/debug/kmemleak
unreferenced object 0xffffff8106c86000 (size 2048):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 32 bytes):
02 00 00 00 10 00 00 00 c0 01 bc 03 81 ff ff ff ................
60 67 ba 03 81 ff ff ff 18 60 c8 06 81 ff ff ff `g.......`......
backtrace (crc feae9680):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
[<00000000a8b3dfe1>] __scmi_device_create+0xb4/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
[<00000000984a3176>] driver_attach+0x34/0x44
[<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
[<00000000747fce19>] driver_register+0xc0/0x1a0
[<0000000081cb8754>] __platform_driver_register+0x40/0x50
unreferenced object 0xffffff8103bc01c0 (size 32):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 32 bytes):
5f 5f 73 63 6d 69 5f 74 72 61 6e 73 70 6f 72 74 __scmi_transport
5f 64 65 76 69 63 65 5f 72 78 5f 31 30 00 ff ff _device_rx_10...
backtrace (crc 8dab7ca7):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<00000000500dbc08>] __kmalloc_node_track_caller_noprof+0x234/0x528
[<000000004990eea4>] kstrdup+0x48/0x80
[<00000000ad4d2923>] kstrdup_const+0x30/0x3c
[<00000000e9d3bdc3>] __scmi_device_create+0xd4/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
[<00000000984a3176>] driver_attach+0x34/0x44
[<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
unreferenced object 0xffffff8103ba6760 (size 16):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 16 bytes):
73 63 6d 69 5f 64 65 76 2e 32 00 03 81 ff ff ff scmi_dev.2......
backtrace (crc ccc21b9a):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<00000000500dbc08>] __kmalloc_node_track_caller_noprof+0x234/0x528
[<00000000cdc440a0>] kvasprintf+0x90/0x11c
[<00000000500fc732>] kvasprintf_const+0x98/0x138
[<0000000030e28143>] kobject_set_name_vargs+0x68/0x104
[<00000000f15f6ece>] dev_set_name+0x6c/0x98
[<00000000c1f76eb4>] __scmi_device_create+0x17c/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
unreferenced object 0xffffff810637c800 (size 512):
comm "swapper/0", pid 1, jiffies 4294893094
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 00 1e ee 83 c0 ff ff ff ................
backtrace (crc 732b3ae6):
[<00000000197aa008>] kmemleak_alloc+0x34/0xa0
[<0000000056fe02c9>] __kmalloc_cache_noprof+0x1e0/0x450
[<0000000026a3cb30>] device_add+0x54/0x570
[<00000000e515c343>] device_register+0x20/0x30
[<0000000042008204>] __scmi_device_create+0x184/0x2b4
[<000000008714917b>] scmi_device_create+0x40/0x194
[<000000001818f3cf>] scmi_chan_setup+0x144/0x3b8
[<00000000970bad38>] scmi_probe+0x584/0xa78
[<000000002600d2fd>] platform_probe+0xbc/0xf0
[<00000000f6f556b4>] really_probe+0x1b8/0x520
[<00000000eed93d59>] __driver_probe_device+0xe0/0x1d8
[<00000000d613b754>] driver_probe_device+0x6c/0x208
[<00000000187a9170>] __driver_attach+0x168/0x328
[<00000000e3ff1834>] bus_for_each_dev+0x14c/0x178
[<00000000984a3176>] driver_attach+0x34/0x44
[<00000000fc35bf2a>] bus_add_driver+0x1bc/0x358
Powered by blists - more mailing lists