linux-kernel - [PATCH] s390/mm: Fix memory leak in add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20251026091351.36275-1-linmq006@gmail.com>
Date: Sun, 26 Oct 2025 17:13:51 +0800
From: Miaoqian Lin <linmq006@...il.com>
To: Alexander Gordeev <agordeev@...ux.ibm.com>,
	Gerald Schaefer <gerald.schaefer@...ux.ibm.com>,
	Heiko Carstens <hca@...ux.ibm.com>,
	Vasily Gorbik <gor@...ux.ibm.com>,
	Christian Borntraeger <borntraeger@...ux.ibm.com>,
	Sven Schnelle <svens@...ux.ibm.com>,
	linux-s390@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	bpf@...r.kernel.org
Cc: linmq006@...il.com,
	stable@...r.kernel.org
Subject: [PATCH] s390/mm: Fix memory leak in add_marker() when kvrealloc fails

When kvrealloc() fails, the original markers memory is leaked
because the function directly assigns the NULL to the markers pointer,
losing the reference to the original memory.

As a result, the kvfree() in pt_dump_init() ends up freeing NULL instead
of the previously allocated memory.

Fix this by using a temporary variable to store kvrealloc()'s return
value and only update the markers pointer on success.

Found via static anlaysis and this is similar to commit 42378a9ca553
("bpf, verifier: Fix memory leak in array reallocation for stack state")

Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically")
Cc: stable@...r.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@...il.com>
---
 arch/s390/mm/dump_pagetables.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
index 9af2aae0a515..0f2e0c93a1e0 100644
--- a/arch/s390/mm/dump_pagetables.c
+++ b/arch/s390/mm/dump_pagetables.c
@@ -291,16 +291,19 @@ static int ptdump_cmp(const void *a, const void *b)
 
 static int add_marker(unsigned long start, unsigned long end, const char *name)
 {
+	struct addr_marker *new_markers;
 	size_t oldsize, newsize;
 
 	oldsize = markers_cnt * sizeof(*markers);
 	newsize = oldsize + 2 * sizeof(*markers);
 	if (!oldsize)
-		markers = kvmalloc(newsize, GFP_KERNEL);
+		new_markers = kvmalloc(newsize, GFP_KERNEL);
 	else
-		markers = kvrealloc(markers, newsize, GFP_KERNEL);
-	if (!markers)
+		new_markers = kvrealloc(markers, newsize, GFP_KERNEL);
+	if (!new_markers)
 		goto error;
+
+	markers = new_markers;
 	markers[markers_cnt].is_start = 1;
 	markers[markers_cnt].start_address = start;
 	markers[markers_cnt].size = end - start;
-- 
2.39.5 (Apple Git-154)