lkml.org 
[lkml]   [2020]   [Jun]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 067/190] mm/slub: fix a memory leak in sysfs_slab_add()
    Date
    From: Wang Hai <wanghai38@huawei.com>

    commit dde3c6b72a16c2db826f54b2d49bdea26c3534a2 upstream.

    syzkaller reports for memory leak when kobject_init_and_add() returns an
    error in the function sysfs_slab_add() [1]

    When this happened, the function kobject_put() is not called for the
    corresponding kobject, which potentially leads to memory leak.

    This patch fixes the issue by calling kobject_put() even if
    kobject_init_and_add() fails.

    [1]
    BUG: memory leak
    unreferenced object 0xffff8880a6d4be88 (size 8):
    comm "syz-executor.3", pid 946, jiffies 4295772514 (age 18.396s)
    hex dump (first 8 bytes):
    70 69 64 5f 33 00 ff ff pid_3...
    backtrace:
    kstrdup+0x35/0x70 mm/util.c:60
    kstrdup_const+0x3d/0x50 mm/util.c:82
    kvasprintf_const+0x112/0x170 lib/kasprintf.c:48
    kobject_set_name_vargs+0x55/0x130 lib/kobject.c:289
    kobject_add_varg lib/kobject.c:384 [inline]
    kobject_init_and_add+0xd8/0x170 lib/kobject.c:473
    sysfs_slab_add+0x1d8/0x290 mm/slub.c:5811
    __kmem_cache_create+0x50a/0x570 mm/slub.c:4384
    create_cache+0x113/0x1e0 mm/slab_common.c:407
    kmem_cache_create_usercopy+0x1a1/0x260 mm/slab_common.c:505
    kmem_cache_create+0xd/0x10 mm/slab_common.c:564
    create_pid_cachep kernel/pid_namespace.c:54 [inline]
    create_pid_namespace kernel/pid_namespace.c:96 [inline]
    copy_pid_ns+0x77c/0x8f0 kernel/pid_namespace.c:148
    create_new_namespaces+0x26b/0xa30 kernel/nsproxy.c:95
    unshare_nsproxy_namespaces+0xa7/0x1e0 kernel/nsproxy.c:229
    ksys_unshare+0x3d2/0x770 kernel/fork.c:2969
    __do_sys_unshare kernel/fork.c:3037 [inline]
    __se_sys_unshare kernel/fork.c:3035 [inline]
    __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3035
    do_syscall_64+0xa1/0x530 arch/x86/entry/common.c:295

    Fixes: 80da026a8e5d ("mm/slub: fix slab double-free in case of duplicate sysfs filename")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Wang Hai <wanghai38@huawei.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Link: http://lkml.kernel.org/r/20200602115033.1054-1-wanghai38@huawei.com
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    mm/slub.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/mm/slub.c
    +++ b/mm/slub.c
    @@ -5727,8 +5727,10 @@ static int sysfs_slab_add(struct kmem_ca

    s->kobj.kset = kset;
    err = kobject_init_and_add(&s->kobj, &slab_ktype, NULL, "%s", name);
    - if (err)
    + if (err) {
    + kobject_put(&s->kobj);
    goto out;
    + }

    err = sysfs_create_group(&s->kobj, &slab_attr_group);
    if (err)

    \
     
     \ /
      Last update: 2020-06-19 18:37    [W:4.265 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site