* [PATCH 1/2] lkdtm: fix memory leak of val
@ 2016-04-05 17:11 Sudip Mukherjee
2016-04-05 17:11 ` [PATCH 2/2] lkdtm: fix memory leak of base Sudip Mukherjee
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Sudip Mukherjee @ 2016-04-05 17:11 UTC (permalink / raw)
To: Arnd Bergmann, Greg Kroah-Hartman, Kees Cook
Cc: linux-kernel, Sudip Mukherjee
This case is supposed to read from a page after after it is freed, but
it missed freeing val if we are not able to get a free page.
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
drivers/misc/lkdtm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 5f1a36b..2f0b022 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
}
case CT_READ_BUDDY_AFTER_FREE: {
unsigned long p = __get_free_page(GFP_KERNEL);
- int saw, *val = kmalloc(1024, GFP_KERNEL);
+ int saw, *val;
int *base;
if (!p)
break;
+ val = kmalloc(1024, GFP_KERNEL);
if (!val)
break;
--
1.9.1
^ permalink raw reply [flat|nested] 5+ messages in thread* [PATCH 2/2] lkdtm: fix memory leak of base
2016-04-05 17:11 [PATCH 1/2] lkdtm: fix memory leak of val Sudip Mukherjee
@ 2016-04-05 17:11 ` Sudip Mukherjee
2016-04-06 22:49 ` Kees Cook
2016-04-06 22:48 ` [PATCH 1/2] lkdtm: fix memory leak of val Kees Cook
2016-04-06 22:53 ` Kees Cook
2 siblings, 1 reply; 5+ messages in thread
From: Sudip Mukherjee @ 2016-04-05 17:11 UTC (permalink / raw)
To: Arnd Bergmann, Greg Kroah-Hartman, Kees Cook
Cc: linux-kernel, Sudip Mukherjee
This case is supposed to read from a memory after it has been freed,
but we missed freeing base if the memory 'val' could not be allocated.
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
drivers/misc/lkdtm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 2f0b022..5b3a63c 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -458,8 +458,10 @@ static void lkdtm_do_action(enum ctype which)
break;
val = kmalloc(len, GFP_KERNEL);
- if (!val)
+ if (!val) {
+ kfree(base);
break;
+ }
*val = 0x12345678;
base[offset] = *val;
--
1.9.1
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH 2/2] lkdtm: fix memory leak of base
2016-04-05 17:11 ` [PATCH 2/2] lkdtm: fix memory leak of base Sudip Mukherjee
@ 2016-04-06 22:49 ` Kees Cook
0 siblings, 0 replies; 5+ messages in thread
From: Kees Cook @ 2016-04-06 22:49 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Arnd Bergmann, Greg Kroah-Hartman, LKML
On Tue, Apr 5, 2016 at 10:11 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> This case is supposed to read from a memory after it has been freed,
> but we missed freeing base if the memory 'val' could not be allocated.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Also applied. Thanks!
-Kees
> ---
> drivers/misc/lkdtm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
> index 2f0b022..5b3a63c 100644
> --- a/drivers/misc/lkdtm.c
> +++ b/drivers/misc/lkdtm.c
> @@ -458,8 +458,10 @@ static void lkdtm_do_action(enum ctype which)
> break;
>
> val = kmalloc(len, GFP_KERNEL);
> - if (!val)
> + if (!val) {
> + kfree(base);
> break;
> + }
>
> *val = 0x12345678;
> base[offset] = *val;
> --
> 1.9.1
>
--
Kees Cook
Chrome OS & Brillo Security
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH 1/2] lkdtm: fix memory leak of val
2016-04-05 17:11 [PATCH 1/2] lkdtm: fix memory leak of val Sudip Mukherjee
2016-04-05 17:11 ` [PATCH 2/2] lkdtm: fix memory leak of base Sudip Mukherjee
@ 2016-04-06 22:48 ` Kees Cook
2016-04-06 22:53 ` Kees Cook
2 siblings, 0 replies; 5+ messages in thread
From: Kees Cook @ 2016-04-06 22:48 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Arnd Bergmann, Greg Kroah-Hartman, LKML
On Tue, Apr 5, 2016 at 10:11 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> This case is supposed to read from a page after after it is freed, but
> it missed freeing val if we are not able to get a free page.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Thanks! Applied to my tree.
-Kees
> ---
> drivers/misc/lkdtm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
> index 5f1a36b..2f0b022 100644
> --- a/drivers/misc/lkdtm.c
> +++ b/drivers/misc/lkdtm.c
> @@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
> }
> case CT_READ_BUDDY_AFTER_FREE: {
> unsigned long p = __get_free_page(GFP_KERNEL);
> - int saw, *val = kmalloc(1024, GFP_KERNEL);
> + int saw, *val;
> int *base;
>
> if (!p)
> break;
>
> + val = kmalloc(1024, GFP_KERNEL);
> if (!val)
> break;
>
> --
> 1.9.1
>
--
Kees Cook
Chrome OS & Brillo Security
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH 1/2] lkdtm: fix memory leak of val
2016-04-05 17:11 [PATCH 1/2] lkdtm: fix memory leak of val Sudip Mukherjee
2016-04-05 17:11 ` [PATCH 2/2] lkdtm: fix memory leak of base Sudip Mukherjee
2016-04-06 22:48 ` [PATCH 1/2] lkdtm: fix memory leak of val Kees Cook
@ 2016-04-06 22:53 ` Kees Cook
2 siblings, 0 replies; 5+ messages in thread
From: Kees Cook @ 2016-04-06 22:53 UTC (permalink / raw)
To: Sudip Mukherjee; +Cc: Arnd Bergmann, Greg Kroah-Hartman, LKML
On Tue, Apr 5, 2016 at 10:11 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> This case is supposed to read from a page after after it is freed, but
> it missed freeing val if we are not able to get a free page.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> ---
> drivers/misc/lkdtm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
> index 5f1a36b..2f0b022 100644
> --- a/drivers/misc/lkdtm.c
> +++ b/drivers/misc/lkdtm.c
> @@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
> }
> case CT_READ_BUDDY_AFTER_FREE: {
> unsigned long p = __get_free_page(GFP_KERNEL);
> - int saw, *val = kmalloc(1024, GFP_KERNEL);
> + int saw, *val;
> int *base;
>
> if (!p)
> break;
>
> + val = kmalloc(1024, GFP_KERNEL);
There's actually still a leak of "p" here, but I've fix that now too. Thanks!
-Kees
> if (!val)
> break;
>
> --
> 1.9.1
>
--
Kees Cook
Chrome OS & Brillo Security
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2016-04-06 22:53 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-04-05 17:11 [PATCH 1/2] lkdtm: fix memory leak of val Sudip Mukherjee
2016-04-05 17:11 ` [PATCH 2/2] lkdtm: fix memory leak of base Sudip Mukherjee
2016-04-06 22:49 ` Kees Cook
2016-04-06 22:48 ` [PATCH 1/2] lkdtm: fix memory leak of val Kees Cook
2016-04-06 22:53 ` Kees Cook
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®