netdev - Re: [PATCH] net-sysfs: Fix reference count leak in rx|netdev_queue_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 20 Nov 2019 08:59:26 +0200
From:   jouni.hogander@...kie.com (Jouni Högander)
To:     David Miller <davem@...emloft.net>
Cc:     netdev@...r.kernel.org, lukas.bulwahn@...il.com
Subject: Re: [PATCH] net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject

David Miller <davem@...emloft.net> writes:

> From: jouni.hogander@...kie.com
> Date: Tue, 19 Nov 2019 11:51:21 +0200
>
>> kobject_init_and_add takes reference even when it fails.
>
> I see this in the comment above kobject_init_and_add() but not in the
> code.
>
> Where does the implementation of kobject_init_and_add() actually take
> such a reference?

kobject_init_and_add -> kobject_init -> kobject_init_internal -> kref_init

kref_init initializes ref_count as 1.

>
> Did you discover this by code inspection, or by an actual bug that was
> triggered?  If by an actual bug, please provide the OOPS and/or checker
> trace that indicated a leak was happening here.

Originally found it via memory leak identified by Syzkaller. I will
submit new one with memleak dump.

>
> I don't see anything actually wrong here because kobject_init_and_add()
> doesn't actually seem to do what it's comment suggests...

See the code path above.

BR,

Jouni Högander