[PATCH] [SECURITY, 2.4] Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL

[PATCH] [SECURITY, 2.4] Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL

[Horms]

This is CAN-2005-3181, and a backport of
829841146878e082613a49581ae252c071057c23 from Linus's 2.6 tree to 2.4.

Original Description and Sign-Off:

Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL

The nameidata "last.name" is always allocated with "__getname()", and
should always be free'd with "__putname()".

Using "putname()" without the underscores will leak memory, because the
allocation will have been hidden from the AUDITSYSCALL code.

Arguably the real bug is that the AUDITSYSCALL code is really broken,
but in the meantime this fixes the problem people see.

Reported by Robert Derr, patch by Rick Lindsley.

Acked-by: Al Viro <viro@ftp.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

My sign off, indicating I think it applies to 2.4:

Signed-off-by: Horms <horms@verge.net.au>

--- from-0001/fs/namei.c
+++ to-work/fs/namei.c	2005-10-11 18:23:56.000000000 +0900
@@ -1198,18 +1198,18 @@ do_link:
 	if (nd->last_type != LAST_NORM)
 		goto exit;
 	if (nd->last.name[nd->last.len]) {
-		putname(nd->last.name);
+		__putname(nd->last.name);
 		goto exit;
 	}
 	error = -ELOOP;
 	if (count++==32) {
-		putname(nd->last.name);
+		__putname(nd->last.name);
 		goto exit;
 	}
 	dir = nd->dentry;
 	down(&dir->d_inode->i_sem);
 	dentry = lookup_hash(&nd->last, nd->dentry);
-	putname(nd->last.name);
+	__putname(nd->last.name);
 	goto do_last;
 }
 

Re: [PATCH] [SECURITY, 2.4] Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL

[Arjan van de Ven]

On Fri, 2005-10-28 at 18:27 +0900, Horms wrote:
> This is CAN-2005-3181, and a backport of
> 829841146878e082613a49581ae252c071057c23 from Linus's 2.6 tree to 2.4.
> 
> Original Description and Sign-Off:
> 
> Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL
> 
> The nameidata "last.name" is always allocated with "__getname()", and
> should always be free'd with "__putname()".
> 
> Using "putname()" without the underscores will leak memory, because the
> allocation will have been hidden from the AUDITSYSCALL code.

> My sign off, indicating I think it applies to 2.4:


since there is no such thing as CONFIG_AUDITSYSCALL in any 2.4 kernel, I
really think this is entirely NOT relevant to 2.4.....

Re: [PATCH] [SECURITY, 2.4] Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL

[Horms]

On Fri, Oct 28, 2005 at 12:00:46PM +0200, Arjan van de Ven wrote:
> On Fri, 2005-10-28 at 18:27 +0900, Horms wrote:
> > This is CAN-2005-3181, and a backport of
> > 829841146878e082613a49581ae252c071057c23 from Linus's 2.6 tree to 2.4.
> > 
> > Original Description and Sign-Off:
> > 
> > Avoid 'names_cache' memory leak with CONFIG_AUDITSYSCALL
> > 
> > The nameidata "last.name" is always allocated with "__getname()", and
> > should always be free'd with "__putname()".
> > 
> > Using "putname()" without the underscores will leak memory, because the
> > allocation will have been hidden from the AUDITSYSCALL code.
> 
> > My sign off, indicating I think it applies to 2.4:
> 
> 
> since there is no such thing as CONFIG_AUDITSYSCALL in any 2.4 kernel, I
> really think this is entirely NOT relevant to 2.4.....

Thanks, I withdraw the patch.

-- 
Horms