linux-kernel - Re: [PATCH] s390/mm: Fix memory leak in add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251027101451.14551A49-hca@linux.ibm.com>
Date: Mon, 27 Oct 2025 11:14:51 +0100
From: Heiko Carstens <hca@...ux.ibm.com>
To: Miaoqian Lin <linmq006@...il.com>
Cc: Alexander Gordeev <agordeev@...ux.ibm.com>,
        Gerald Schaefer <gerald.schaefer@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>, linux-s390@...r.kernel.org,
        linux-kernel@...r.kernel.org, bpf@...r.kernel.org,
        stable@...r.kernel.org
Subject: Re: [PATCH] s390/mm: Fix memory leak in add_marker() when kvrealloc
 fails

On Sun, Oct 26, 2025 at 05:13:51PM +0800, Miaoqian Lin wrote:
> When kvrealloc() fails, the original markers memory is leaked
> because the function directly assigns the NULL to the markers pointer,
> losing the reference to the original memory.
> 
> As a result, the kvfree() in pt_dump_init() ends up freeing NULL instead
> of the previously allocated memory.
> 
> Fix this by using a temporary variable to store kvrealloc()'s return
> value and only update the markers pointer on success.
> 
> Found via static anlaysis and this is similar to commit 42378a9ca553
> ("bpf, verifier: Fix memory leak in array reallocation for stack state")
> 
> Fixes: d0e7915d2ad3 ("s390/mm/ptdump: Generate address marker array dynamically")
> Cc: stable@...r.kernel.org
> Signed-off-by: Miaoqian Lin <linmq006@...il.com>
> ---
>  arch/s390/mm/dump_pagetables.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/s390/mm/dump_pagetables.c b/arch/s390/mm/dump_pagetables.c
> index 9af2aae0a515..0f2e0c93a1e0 100644
> --- a/arch/s390/mm/dump_pagetables.c
> +++ b/arch/s390/mm/dump_pagetables.c
> @@ -291,16 +291,19 @@ static int ptdump_cmp(const void *a, const void *b)
>  
>  static int add_marker(unsigned long start, unsigned long end, const char *name)
>  {
> +	struct addr_marker *new_markers;
>  	size_t oldsize, newsize;
>  
>  	oldsize = markers_cnt * sizeof(*markers);
>  	newsize = oldsize + 2 * sizeof(*markers);
>  	if (!oldsize)
> -		markers = kvmalloc(newsize, GFP_KERNEL);
> +		new_markers = kvmalloc(newsize, GFP_KERNEL);
>  	else
> -		markers = kvrealloc(markers, newsize, GFP_KERNEL);
> -	if (!markers)
> +		new_markers = kvrealloc(markers, newsize, GFP_KERNEL);
> +	if (!new_markers)
>  		goto error;
> +
> +	markers = new_markers;

This is not better to the situation before. If the allocation fails,
markers_cnt will be set to zero, but the old valid markers pointer will stay,
which means that the next call to add_marker() will allocate a new area via
kvmalloc() instead of kvrealloc(), and thus leaking the old area too.

add_marker() needs to changes to return in a manner that both marker and
marker_cnt correlate with each other. And I guess it is also easily possible
to get rid of the two different allocation paths.

Care to send a new version?