[syzbot] [mtd?] memory leak in phram_setup

[syzbot] [mtd?] memory leak in phram_setup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    24a19b953e2a Linux 7.3-rc7
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15a128a5580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=eeccc827207f48ec
dashboard link: https://syzkaller.appspot.com/bug?extid=c9d8bc9f8ccc03799e1f
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=110d73d1580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1025968e580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0f1e259089c6/disk-24a19b95.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/6b65050296a3/vmlinux-24a19b95.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb73ff77ea56/bzImage-24a19b95.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c9d8bc9f8ccc03799e1f@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88810afde7f8 (size 8):
  comm "syz.0.17", pid 5903, jiffies 4294943995
  hex dump (first 8 bytes):
    70 30 00 00 00 00 00 00                          p0......
  backtrace (crc 43334c2):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_node_track_caller_noprof+0x40d/0x560 mm/slub.c:5545
    __kmemdup_nul mm/util.c:64 [inline]
    kstrdup+0x3c/0x80 mm/util.c:84
    parse_name drivers/mtd/devices/phram.c:224 [inline]
    phram_setup+0x1c2/0x360 drivers/mtd/devices/phram.c:286
    phram_param_call+0xe4/0x110 drivers/mtd/devices/phram.c:349
    param_attr_store+0x99/0x130 kernel/params.c:591
    module_attr_store+0x3d/0x60 kernel/params.c:906
    sysfs_kf_write+0x94/0xb0 fs/sysfs/file.c:145
    kernfs_fop_write_iter+0x1f1/0x2d0 fs/kernfs/file.c:345
    new_sync_write fs/read_write.c:595 [inline]
    vfs_write+0x3ae/0x720 fs/read_write.c:687
    ksys_write+0xa5/0x170 fs/read_write.c:739
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810afdebe8 (size 8):
  comm "syz.0.18", pid 5905, jiffies 4294943995
  hex dump (first 8 bytes):
    70 30 00 00 00 00 00 00                          p0......
  backtrace (crc 43334c2):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_node_track_caller_noprof+0x40d/0x560 mm/slub.c:5545
    __kmemdup_nul mm/util.c:64 [inline]
    kstrdup+0x3c/0x80 mm/util.c:84
    parse_name drivers/mtd/devices/phram.c:224 [inline]
    phram_setup+0x1c2/0x360 drivers/mtd/devices/phram.c:286
    phram_param_call+0xe4/0x110 drivers/mtd/devices/phram.c:349
    param_attr_store+0x99/0x130 kernel/params.c:591
    module_attr_store+0x3d/0x60 kernel/params.c:906
    sysfs_kf_write+0x94/0xb0 fs/sysfs/file.c:145
    kernfs_fop_write_iter+0x1f1/0x2d0 fs/kernfs/file.c:345
    new_sync_write fs/read_write.c:595 [inline]
    vfs_write+0x3ae/0x720 fs/read_write.c:687
    ksys_write+0xa5/0x170 fs/read_write.c:739
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810afde5b8 (size 8):
  comm "syz.0.19", pid 5908, jiffies 4294943996
  hex dump (first 8 bytes):
    70 30 00 00 00 00 00 00                          p0......
  backtrace (crc 43334c2):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_node_track_caller_noprof+0x40d/0x560 mm/slub.c:5545
    __kmemdup_nul mm/util.c:64 [inline]
    kstrdup+0x3c/0x80 mm/util.c:84
    parse_name drivers/mtd/devices/phram.c:224 [inline]
    phram_setup+0x1c2/0x360 drivers/mtd/devices/phram.c:286
    phram_param_call+0xe4/0x110 drivers/mtd/devices/phram.c:349
    param_attr_store+0x99/0x130 kernel/params.c:591
    module_attr_store+0x3d/0x60 kernel/params.c:906
    sysfs_kf_write+0x94/0xb0 fs/sysfs/file.c:145
    kernfs_fop_write_iter+0x1f1/0x2d0 fs/kernfs/file.c:345
    new_sync_write fs/read_write.c:595 [inline]
    vfs_write+0x3ae/0x720 fs/read_write.c:687
    ksys_write+0xa5/0x170 fs/read_write.c:739
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [PATCH] mtd: phram: fix memory leak in phram_setup()

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] mtd: phram: fix memory leak in phram_setup()
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master


phram_setup() allocates the device name with kstrdup() in
parse_name(). The error paths that follow (illegal start address,
illegal device length, illegal erasesize, illegal erasesize or len,
and len not a multiple of erasesize) use the parse_err() macro, which
expands to pr_err() followed by an immediate "return 1". The
"goto error" statements after it are therefore never reached, and
kfree(name) at the error label is skipped, leaking the name.

Replace parse_err() with pr_err() at those sites so control reaches
the error label and frees the name. Leave the parse_err() calls that
run before parse_name() alone, since nothing has been allocated yet.

As a side effect, these paths now return a negative errno instead of
1, which is the correct convention for a module parameter setter.

Reported-by: syzbot+c9d8bc9f8ccc03799e1f@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=c9d8bc9f8ccc03799e1f
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/mtd/devices/phram.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index b42cadcd76b1..7aed57b31967 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -289,34 +289,34 @@ static int phram_setup(const char *val)
 
 	ret = parse_num64(&start, token[1]);
 	if (ret) {
-		parse_err("illegal start address\n");
+		pr_err("illegal start address\n");
 		goto error;
 	}
 
 	ret = parse_num64(&len, token[2]);
 	if (ret) {
-		parse_err("illegal device length\n");
+		pr_err("illegal device length\n");
 		goto error;
 	}
 
 	if (token[3]) {
 		ret = parse_num64(&erasesize, token[3]);
 		if (ret) {
-			parse_err("illegal erasesize\n");
+			pr_err("illegal erasesize\n");
 			goto error;
 		}
 	}
 
 	if (len == 0 || erasesize == 0 || erasesize > len
 	    || erasesize > UINT_MAX) {
-		parse_err("illegal erasesize or len\n");
+		pr_err("illegal erasesize or len\n");
 		ret = -EINVAL;
 		goto error;
 	}
 
 	div_u64_rem(len, (uint32_t)erasesize, &rem);
 	if (rem) {
-		parse_err("len is not multiple of erasesize\n");
+		pr_err("len is not multiple of erasesize\n");
 		ret = -EINVAL;
 		goto error;
 	}
-- 
2.43.0