linux-kernel - Re: [PATCH v2] s390/mm: Fix memory leak in add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251027152741.14551Cb6-hca@linux.ibm.com>
Date: Mon, 27 Oct 2025 16:27:41 +0100
From: Heiko Carstens <hca@...ux.ibm.com>
To: Miaoqian Lin <linmq006@...il.com>
Cc: Alexander Gordeev <agordeev@...ux.ibm.com>,
        Gerald Schaefer <gerald.schaefer@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH v2] s390/mm: Fix memory leak in add_marker() when
 kvrealloc fails

On Mon, Oct 27, 2025 at 11:08:38PM +0800, Miaoqian Lin wrote:
> The function has a memory leak when kvrealloc() fails.
> The function directly assigns NULL to the markers pointer, losing the
> reference to the previously allocated memory. This causes kvfree() in
> pt_dump_init() to free NULL instead of the leaked memory.
> 
> Fix by:
> 1. Using kvrealloc() uniformly for all allocations
> 2. Using a temporary variable to preserve the original pointer until
>    allocation succeeds
> 3. Removing the error path that sets markers_cnt=0 to keep
>    consistency between markers and markers_cnt
> 
> Found via static analysis and this is similar to commit 42378a9ca553
> ("bpf, verifier: Fix memory leak in array reallocation for stack state")
> 
> Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically")
> Cc: stable@...r.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@...il.com>
> ---
> changes in v2:
> - update the fixing logic to prevent memory leak in v1
> v1 link: https://lore.kernel.org/all/20251026091351.36275-1-linmq006@gmail.com/
> ---
>  arch/s390/mm/dump_pagetables.c | 22 +++++++++-------------
>  1 file changed, 9 insertions(+), 13 deletions(-)

Applied, thanks!