netdev - Re: [PATCH net] net: qrtr: Fix memory leak in qrtr_tun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 23 Feb 2021 15:39:51 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Takeshi Misawa <jeliantsurux@...il.com>
Cc:     David Howells <dhowells@...hat.com>,
        Bjorn Andersson <bjorn.andersson@...aro.org>,
        netdev@...r.kernel.org
Subject: Re: [PATCH net] net: qrtr: Fix memory leak in qrtr_tun_open

On Mon, 22 Feb 2021 08:44:27 +0900 Takeshi Misawa wrote:
> If qrtr_endpoint_register() failed, tun is leaked.
> Fix this, by freeing tun in error path.
> 
> syzbot report:
> BUG: memory leak
> unreferenced object 0xffff88811848d680 (size 64):
>   comm "syz-executor684", pid 10171, jiffies 4294951561 (age 26.070s)
>   hex dump (first 32 bytes):
>     80 dd 0a 84 ff ff ff ff 00 00 00 00 00 00 00 00  ................
>     90 d6 48 18 81 88 ff ff 90 d6 48 18 81 88 ff ff  ..H.......H.....
>   backtrace:
>     [<0000000018992a50>] kmalloc include/linux/slab.h:552 [inline]
>     [<0000000018992a50>] kzalloc include/linux/slab.h:682 [inline]
>     [<0000000018992a50>] qrtr_tun_open+0x22/0x90 net/qrtr/tun.c:35
>     [<0000000003a453ef>] misc_open+0x19c/0x1e0 drivers/char/misc.c:141
>     [<00000000dec38ac8>] chrdev_open+0x10d/0x340 fs/char_dev.c:414
>     [<0000000079094996>] do_dentry_open+0x1e6/0x620 fs/open.c:817
>     [<000000004096d290>] do_open fs/namei.c:3252 [inline]
>     [<000000004096d290>] path_openat+0x74a/0x1b00 fs/namei.c:3369
>     [<00000000b8e64241>] do_filp_open+0xa0/0x190 fs/namei.c:3396
>     [<00000000a3299422>] do_sys_openat2+0xed/0x230 fs/open.c:1172
>     [<000000002c1bdcef>] do_sys_open fs/open.c:1188 [inline]
>     [<000000002c1bdcef>] __do_sys_openat fs/open.c:1204 [inline]
>     [<000000002c1bdcef>] __se_sys_openat fs/open.c:1199 [inline]
>     [<000000002c1bdcef>] __x64_sys_openat+0x7f/0xe0 fs/open.c:1199
>     [<00000000f3a5728f>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>     [<000000004b38b7ec>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> Fixes: 28fb4e59a47d ("net: qrtr: Expose tunneling endpoint to user space")
> Reported-by: syzbot+5d6e4af21385f5cfc56a@...kaller.appspotmail.com
> Signed-off-by: Takeshi Misawa <jeliantsurux@...il.com>

Applied, thanks!