Re: module: fix memory leak on early load_module() failures

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



+++ Luis R. Rodriguez [10/02/17 14:06 -0800]:
While looking for early possible module loading failures I was
able to reproduce a memory leak possible with kmemleak. There
are a few rare ways to trigger a failure:

 o we've run into a failure while processing kernel parameters
   (parse_args() returns an error)
 o mod_sysfs_setup() fails
 o we're a live patch module and copy_module_elf() fails

Chances of running into this issue is really low.

kmemleak splat:

unreferenced object 0xffff9f2c4ada1b00 (size 32):
 comm "kworker/u16:4", pid 82, jiffies 4294897636 (age 681.816s)
 hex dump (first 32 bytes):
   6d 65 6d 73 74 69 63 6b 30 00 00 00 00 00 00 00  memstick0.......
   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
 backtrace:
   [<ffffffff8c6cfeba>] kmemleak_alloc+0x4a/0xa0
   [<ffffffff8c200046>] __kmalloc_track_caller+0x126/0x230
   [<ffffffff8c1bc581>] kstrdup+0x31/0x60
   [<ffffffff8c1bc5d4>] kstrdup_const+0x24/0x30
   [<ffffffff8c3c23aa>] kvasprintf_const+0x7a/0x90
   [<ffffffff8c3b5481>] kobject_set_name_vargs+0x21/0x90
   [<ffffffff8c4fbdd7>] dev_set_name+0x47/0x50
   [<ffffffffc07819e5>] memstick_check+0x95/0x33c [memstick]
   [<ffffffff8c09c893>] process_one_work+0x1f3/0x4b0
   [<ffffffff8c09cb98>] worker_thread+0x48/0x4e0
   [<ffffffff8c0a2b79>] kthread+0xc9/0xe0
   [<ffffffff8c6dab5f>] ret_from_fork+0x1f/0x40
   [<ffffffffffffffff>] 0xffffffffffffffff

Cc: stable <stable@xxxxxxxxxxxxxxx> # v2.6.30
Fixes: e180a6b7759a ("param: fix charp parameters set via sysfs")
Reviewed-by: Miroslav Benes <mbenes@xxxxxxx>
Reviewed-by: Aaron Tomlin <atomlin@xxxxxxxxxx>
Signed-off-by: Luis R. Rodriguez <mcgrof@xxxxxxxxxx>

Pushed out. Thanks Luis!

---
kernel/module.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/kernel/module.c b/kernel/module.c
index 38d4270925d4..8409a82424d2 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3722,6 +3722,7 @@ static int load_module(struct load_info *info, const char __user *uargs,
	mod_sysfs_teardown(mod);
 coming_cleanup:
	mod->state = MODULE_STATE_GOING;
+	destroy_params(mod->kp, mod->num_kp);
	blocking_notifier_call_chain(&module_notify_list,
				     MODULE_STATE_GOING, mod);
	klp_module_going(mod);
--
2.10.2

--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]