netdev - Leak in virtio_net in net-next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <0674ca1b-020f-4f93-94d0-104964566e3f@kernel.dk>
Date: Thu, 9 May 2024 11:44:16 -0600
From: Jens Axboe <axboe@...nel.dk>
To: netdev <netdev@...r.kernel.org>, Jakub Kicinski <kuba@...nel.org>
Cc: danielj@...dia.com, jiri@...dia.com, hengqi@...ux.alibaba.com,
 Jason Wang <jasowang@...hat.com>, Paolo Abeni <pabeni@...hat.com>
Subject: Leak in virtio_net in net-next

Hi,

Starting working on a small networking series this morning, and
was instantly greeted by:

[   13.018662] kmemleak: 2 new suspected memory leaks (see /sys/kernel/debug/kmemleak)

when booting my vm image. Details:

# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff000006479aa0 (size 8):
  comm "kworker/3:1", pid 98, jiffies 4294892862
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    [<00000000e3a8eaad>] kmemleak_alloc+0x30/0x38
    [<0000000067412f7a>] kmalloc_trace+0x234/0x364
    [<0000000077402ae2>] virtnet_rx_mode_work+0x144/0x78c
    [<00000000a7f96032>] process_one_work+0x538/0x1048
    [<000000002cbbcce6>] worker_thread+0x760/0xbd4
    [<0000000077f92d4a>] kthread+0x2dc/0x368
    [<0000000051ca839f>] ret_from_fork+0x10/0x20
unreferenced object 0xffff000006479ac0 (size 8):
  comm "kworker/3:1", pid 98, jiffies 4294892862
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    [<00000000e3a8eaad>] kmemleak_alloc+0x30/0x38
    [<0000000067412f7a>] kmalloc_trace+0x234/0x364
    [<0000000077402ae2>] virtnet_rx_mode_work+0x144/0x78c
    [<00000000a7f96032>] process_one_work+0x538/0x1048
    [<000000002cbbcce6>] worker_thread+0x760/0xbd4
    [<0000000077f92d4a>] kthread+0x2dc/0x368
    [<0000000051ca839f>] ret_from_fork+0x10/0x20

and taking a quick look at the virtio_net commits that are in that tree,
this one introduces the leaks:

commit ff7c7d9f5261e4372e541e6bb6781b386a839b48
Author: Daniel Jurgens <danielj@...dia.com>
Date:   Fri May 3 23:24:41 2024 +0300

    virtio_net: Remove command data from control_buf

I didn't look into debugging this, figured if I can trigger this by just
booting a vm in 10 seconds, it should be trivial for the
authors/testers/reviewers to sort out.

-- 
Jens Axboe