From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932335AbdJXMZF (ORCPT ); Tue, 24 Oct 2017 08:25:05 -0400 Received: from szxga04-in.huawei.com ([45.249.212.190]:8985 "EHLO szxga04-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751920AbdJXMZB (ORCPT ); Tue, 24 Oct 2017 08:25:01 -0400 From: JianKang Chen To: , , , CC: , Subject: [PATCH] kernel/kprobes: add check to avoid kprobe memory leak Date: Tue, 24 Oct 2017 20:17:02 +0800 Message-ID: <1508847422-63641-1-git-send-email-chenjiankang1@huawei.com> X-Mailer: git-send-email 1.7.12.4 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.175.102.37] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090202.59EF311B.00E6,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: 212da815f9fa55f2435db13609d6e215 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The function register_kretprobe is used to initialize a struct kretprobe and allocate a list table for kprobe instance. However,in this function, there is a memory leak. The test case: static struct kretprobe rp; struct kretprobe *rps[10]={&rp ,&rp ,&rp , &rp ,&rp ,&rp ,&rp ,&rp ,&rp,&rp}; static int ret_handler(struct kretprobe_instance *ri, struct pt_regs *regs) { printk(KERN_DEBUG "ret_handler\n"); return 0; } static int entry_handler(struct kretprobe_instance *ri, struct pt_regs *regs) { printk(KERN_DEBUG "entry_handler\n"); return 0; } static int __init kretprobe_init(void) { int ret; rp.kp.addr = (kprobe_opcode_t *)kallsyms_lookup_name("do_fork"); rp.handler=ret_handler; rp.entry_handler=entry_handler; rp.maxactive = 1; ret = register_kretprobes(rps,10); if (ret < 0) { return -1; } Result: unreferenced object 0xffff8012aea35500 (size 64): comm "insmod", pid 31966, jiffies 4309153380 (age 111.356s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 85 37 fc ff 7f ff ff ..........7..... 08 55 a3 ae 12 80 ff ff 01 00 00 00 00 00 00 00 .U.............. backtrace: [] create_object+0x1e0/0x3f0 [] kmemleak_alloc+0x6c/0xf0 [] __kmalloc+0x23c/0x2e0 [] register_kretprobe+0x12c/0x350 [] register_kretprobes+0x48/0xa0 [] 0xffff7ffffc380058 [] do_one_initcall+0x120/0x260 [] do_init_module+0xf0/0x288 [] load_module+0x1824/0x1b50 [] SyS_finit_module+0xc8/0x100 [] __sys_trace_return+0x0/0x4 [] 0xffffffffffffffff when there are two same struct kretprobe rp, the INIT_HLIST_HEAD() will result in a empty list table rp->free_instances. The memory leak will happen. So it needs to check the list table before INIT_HLIST_HEAD(). Reported-and-tested-by: Wen Kang Signed-off-by: JianKang Chen Signed-off-by: xie yisheng Signed-off-by: Bixuan Cui --- kernel/kprobes.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/kprobes.c b/kernel/kprobes.c index a1606a4..8b3330c 100644 --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1948,6 +1948,10 @@ int register_kretprobe(struct kretprobe *rp) #endif } raw_spin_lock_init(&rp->lock); + + if (!hlist_empty(&rp->free_instances)) + return -EBUSY; + INIT_HLIST_HEAD(&rp->free_instances); for (i = 0; i < rp->maxactive; i++) { inst = kmalloc(sizeof(struct kretprobe_instance) + -- 1.7.12.4