Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1371811 > unrolled thread
| Started by | Sudip Mukherjee <sudipm.mukherjee@gmail.com> |
|---|---|
| First post | 2016-04-05 19:20 +0200 |
| Last post | 2016-04-07 01:00 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH 1/2] lkdtm: fix memory leak of val Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2016-04-05 19:20 +0200
Re: [PATCH 1/2] lkdtm: fix memory leak of val Kees Cook <keescook@chromium.org> - 2016-04-07 00:50 +0200
Re: [PATCH 1/2] lkdtm: fix memory leak of val Kees Cook <keescook@chromium.org> - 2016-04-07 01:00 +0200
| From | Sudip Mukherjee <sudipm.mukherjee@gmail.com> |
|---|---|
| Date | 2016-04-05 19:20 +0200 |
| Subject | [PATCH 1/2] lkdtm: fix memory leak of val |
| Message-ID | <rkCNX-7ui-3@gated-at.bofh.it> |
This case is supposed to read from a page after after it is freed, but
it missed freeing val if we are not able to get a free page.
Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
---
drivers/misc/lkdtm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 5f1a36b..2f0b022 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
}
case CT_READ_BUDDY_AFTER_FREE: {
unsigned long p = __get_free_page(GFP_KERNEL);
- int saw, *val = kmalloc(1024, GFP_KERNEL);
+ int saw, *val;
int *base;
if (!p)
break;
+ val = kmalloc(1024, GFP_KERNEL);
if (!val)
break;
--
1.9.1
[toc] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-04-07 00:50 +0200 |
| Message-ID | <rl4qS-2rx-9@gated-at.bofh.it> |
| In reply to | #1371811 |
On Tue, Apr 5, 2016 at 10:11 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> This case is supposed to read from a page after after it is freed, but
> it missed freeing val if we are not able to get a free page.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Thanks! Applied to my tree.
-Kees
> ---
> drivers/misc/lkdtm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
> index 5f1a36b..2f0b022 100644
> --- a/drivers/misc/lkdtm.c
> +++ b/drivers/misc/lkdtm.c
> @@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
> }
> case CT_READ_BUDDY_AFTER_FREE: {
> unsigned long p = __get_free_page(GFP_KERNEL);
> - int saw, *val = kmalloc(1024, GFP_KERNEL);
> + int saw, *val;
> int *base;
>
> if (!p)
> break;
>
> + val = kmalloc(1024, GFP_KERNEL);
> if (!val)
> break;
>
> --
> 1.9.1
>
--
Kees Cook
Chrome OS & Brillo Security
[toc] | [prev] | [next] | [standalone]
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Date | 2016-04-07 01:00 +0200 |
| Message-ID | <rl4Ay-2wG-9@gated-at.bofh.it> |
| In reply to | #1371811 |
On Tue, Apr 5, 2016 at 10:11 AM, Sudip Mukherjee
<sudipm.mukherjee@gmail.com> wrote:
> This case is supposed to read from a page after after it is freed, but
> it missed freeing val if we are not able to get a free page.
>
> Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
> ---
> drivers/misc/lkdtm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
> index 5f1a36b..2f0b022 100644
> --- a/drivers/misc/lkdtm.c
> +++ b/drivers/misc/lkdtm.c
> @@ -498,12 +498,13 @@ static void lkdtm_do_action(enum ctype which)
> }
> case CT_READ_BUDDY_AFTER_FREE: {
> unsigned long p = __get_free_page(GFP_KERNEL);
> - int saw, *val = kmalloc(1024, GFP_KERNEL);
> + int saw, *val;
> int *base;
>
> if (!p)
> break;
>
> + val = kmalloc(1024, GFP_KERNEL);
There's actually still a leak of "p" here, but I've fix that now too. Thanks!
-Kees
> if (!val)
> break;
>
> --
> 1.9.1
>
--
Kees Cook
Chrome OS & Brillo Security
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web