From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3CF0FA3743 for ; Tue, 1 Nov 2022 13:47:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229944AbiKANrL (ORCPT ); Tue, 1 Nov 2022 09:47:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46230 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229487AbiKANrJ (ORCPT ); Tue, 1 Nov 2022 09:47:09 -0400 Received: from www62.your-server.de (www62.your-server.de [213.133.104.62]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 41E68DF9A; Tue, 1 Nov 2022 06:47:08 -0700 (PDT) Received: from sslproxy02.your-server.de ([78.47.166.47]) by www62.your-server.de with esmtpsa (TLSv1.3:TLS_AES_256_GCM_SHA384:256) (Exim 4.92.3) (envelope-from ) id 1oprbT-000Bjd-Nz; Tue, 01 Nov 2022 14:46:55 +0100 Received: from [85.1.206.226] (helo=linux.home) by sslproxy02.your-server.de with esmtpsa (TLSv1.3:TLS_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oprbT-000CPs-6k; Tue, 01 Nov 2022 14:46:55 +0100 Subject: Re: [PATCH bpf-next v2 1/3] bpf/verifier: Fix potential memory leak in array reallocation To: Bill Wendling , Kees Cook Cc: Alexei Starovoitov , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, Zhengchao Shao , Lorenz Bauer References: <20221029024444.gonna.633-kees@kernel.org> <20221029025433.2533810-1-keescook@chromium.org> From: Daniel Borkmann Message-ID: <2c6203ac-de2a-607e-0589-0a69f91e0479@iogearbox.net> Date: Tue, 1 Nov 2022 14:46:54 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.7.2 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.103.6/26706/Tue Nov 1 08:52:34 2022) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ +Lorenz ] On 10/31/22 9:16 PM, Bill Wendling wrote: > On Fri, Oct 28, 2022 at 7:55 PM Kees Cook wrote: >> >> If an error (NULL) is returned by krealloc(), callers of realloc_array() >> were setting their allocation pointers to NULL, but on error krealloc() >> does not touch the original allocation. This would result in a memory >> resource leak. Instead, free the old allocation on the error handling >> path. >> >> Cc: Alexei Starovoitov >> Cc: Daniel Borkmann >> Cc: John Fastabend >> Cc: Andrii Nakryiko >> Cc: Martin KaFai Lau >> Cc: Song Liu >> Cc: Yonghong Song >> Cc: KP Singh >> Cc: Stanislav Fomichev >> Cc: Hao Luo >> Cc: Jiri Olsa >> Cc: bpf@vger.kernel.org >> Signed-off-by: Kees Cook > > Reviewed-by: Bill Wendling > >> --- >> kernel/bpf/verifier.c | 9 +++++++-- >> 1 file changed, 7 insertions(+), 2 deletions(-) >> >> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c >> index 014ee0953dbd..eb8c34db74c7 100644 >> --- a/kernel/bpf/verifier.c >> +++ b/kernel/bpf/verifier.c >> @@ -1027,12 +1027,17 @@ static void *copy_array(void *dst, const void *src, size_t n, size_t size, gfp_t >> */ >> static void *realloc_array(void *arr, size_t old_n, size_t new_n, size_t size) >> { >> + void *new_arr; >> + >> if (!new_n || old_n == new_n) >> goto out; >> >> - arr = krealloc_array(arr, new_n, size, GFP_KERNEL); >> - if (!arr) >> + new_arr = krealloc_array(arr, new_n, size, GFP_KERNEL); >> + if (!new_arr) { >> + kfree(arr); >> return NULL; >> + } >> + arr = new_arr; Fyi, I took this fix into bpf tree and improved commit log a bit with the one from Zhengchao [0] given yours came in first. Fixes tag would have been nice, I added the c69431aab67a to the commit message while applying. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20221031070812.339883-1-shaozhengchao@huawei.com/ >> if (new_n > old_n) >> memset(arr + old_n * size, 0, (new_n - old_n) * size); >> -- >> 2.34.1 >>