genetlink: Prevent memory leak when krealloc fail

[PATCH] genetlink: Prevent memory leak when krealloc fail

Posted by Kamil Duljas 2 years, 1 month ago

genl_allocate_reserve_groups() allocs new memory in while loop
but if krealloc fail, the memory allocated by kzalloc is not freed.
It seems allocated memory is unnecessary when the function
returns -ENOMEM

Signed-off-by: Kamil Duljas <kamil.duljas@gmail.com>
---
 net/netlink/genetlink.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 92ef5ed2e7b0..82273d6eaea3 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -437,8 +437,10 @@ static int genl_allocate_reserve_groups(int n_groups, int *first_id)
 			} else {
 				new_groups = krealloc(mc_groups, nlen,
 						      GFP_KERNEL);
-				if (!new_groups)
+				if (!new_groups) {
+					kfree(mc_groups);
 					return -ENOMEM;
+				}
 				mc_groups = new_groups;
 				for (i = 0; i < BITS_TO_LONGS(n_groups); i++)
 					mc_groups[mc_groups_longs + i] = 0;
-- 
2.42.0.windows.2

Re: [PATCH] genetlink: Prevent memory leak when krealloc fail

Posted by Florian Westphal 2 years, 1 month ago

Kamil Duljas <kamil.duljas@gmail.com> wrote:
> genl_allocate_reserve_groups() allocs new memory in while loop
> but if krealloc fail, the memory allocated by kzalloc is not freed.
> It seems allocated memory is unnecessary when the function
> returns -ENOMEM

Why should it be free'd?  mc_groups is not a local variable.

>  				new_groups = krealloc(mc_groups, nlen,
>  						      GFP_KERNEL);
> -				if (!new_groups)
> +				if (!new_groups) {
> +					kfree(mc_groups);
>  					return -ENOMEM;
> +				}

How did you test this?  AFAICS this results in use-after-free for every
access to mc_groups after this error path is taken.

Existing code looks correct, we can't grow mc_groups and return an
error.

Re: [PATCH] genetlink: Prevent memory leak when krealloc fail

Posted by Kamil Duljas 2 years, 1 month ago

Yes, you're right. I did not think about it. So if we have a static
pointer that may be resued, should not restore the pointer as at the
beginning?
static unsigned long *mc_groups = &mc_group_start;

At this moment we don't know how much memory is allocated. What do you
think about this?

>                               new_groups = krealloc(mc_groups, nlen,
>                                                     GFP_KERNEL);
> -                             if (!new_groups)
> +                             if (!new_groups) {
> +                                     kfree(mc_groups);
> +                                     mc_groups = &mc_group_start;
>                                       return -ENOMEM;
> +                             }


sob., 18 lis 2023 o 13:02 Florian Westphal <fw@strlen.de> napisał(a):
>
> Kamil Duljas <kamil.duljas@gmail.com> wrote:
> > genl_allocate_reserve_groups() allocs new memory in while loop
> > but if krealloc fail, the memory allocated by kzalloc is not freed.
> > It seems allocated memory is unnecessary when the function
> > returns -ENOMEM
>
> Why should it be free'd?  mc_groups is not a local variable.
>
> >                               new_groups = krealloc(mc_groups, nlen,
> >                                                     GFP_KERNEL);
> > -                             if (!new_groups)
> > +                             if (!new_groups) {
> > +                                     kfree(mc_groups);
> >                                       return -ENOMEM;
> > +                             }
>
> How did you test this?  AFAICS this results in use-after-free for every
> access to mc_groups after this error path is taken.
>
> Existing code looks correct, we can't grow mc_groups and return an
> error.



-- 
Pozdrawiam,
Kamil Duljas

Re: [PATCH] genetlink: Prevent memory leak when krealloc fail

Posted by Florian Westphal 2 years, 1 month ago

Kamil Duljas <kamil.duljas@gmail.com> wrote:
> Yes, you're right. I did not think about it. So if we have a static
> pointer that may be resued, should not restore the pointer as at the
> beginning?
> static unsigned long *mc_groups = &mc_group_start;
> 
> At this moment we don't know how much memory is allocated. What do you
> think about this?

We do: mc_groups_longs.

> >                               new_groups = krealloc(mc_groups, nlen,
> >                                                     GFP_KERNEL);
> > -                             if (!new_groups)
> > +                             if (!new_groups) {
> > +                                     kfree(mc_groups);
> > +                                     mc_groups = &mc_group_start;
> >                                       return -ENOMEM;
> > +                             }

Seems wrong to shrink when we can't grow.  Whats the point?