[PATCH] posix-timers: fix the pccontext memleak in posix_clock_open()

Zqiang posted 1 patch 1 year, 10 months ago
kernel/time/posix-clock.c | 3 +++
1 file changed, 3 insertions(+)
[PATCH] posix-timers: fix the pccontext memleak in posix_clock_open()
Posted by Zqiang 1 year, 10 months ago
Currently, if the posix_clock structure's->ops.open return error in
posix_clock_open(), the pccontext object is not released, this commit
therefore invoke kfree() to released it.

unreferenced object 0xffff8881065327c0 (size 16):
  comm "syz-executor.7", pid 8994, jiffies 4295144661 (age 17.222s)
  hex dump (first 16 bytes):
    00 20 79 01 81 88 ff ff 00 00 00 00 00 00 00 00  . y.............
  backtrace:
    [<00000000fba736c4>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<00000000fba736c4>] slab_post_alloc_hook mm/slab.h:766 [inline]
    [<00000000fba736c4>] slab_alloc_node mm/slub.c:3478 [inline]
    [<00000000fba736c4>] __kmem_cache_alloc_node+0x1ee/0x250 mm/slub.c:3517
    [<00000000f8fcb419>] kmalloc_trace+0x22/0xc0 mm/slab_common.c:1098
    [<00000000afc910b4>] kmalloc include/linux/slab.h:600 [inline]
    [<00000000afc910b4>] kzalloc include/linux/slab.h:721 [inline]
    [<00000000afc910b4>] posix_clock_open+0xd3/0x250 kernel/time/posix-clock.c:126
    [<00000000b1a43627>] chrdev_open+0x24b/0x6a0 fs/char_dev.c:414
    [<00000000364febd5>] do_dentry_open+0x630/0x1580 fs/open.c:948
    [<00000000ac62c8f4>] do_open fs/namei.c:3622 [inline]
    [<00000000ac62c8f4>] path_openat+0x13f1/0x1c30 fs/namei.c:3779
    [<0000000087bfc1bc>] do_filp_open+0x1c5/0x410 fs/namei.c:3809
    [<0000000044db899a>] do_sys_openat2+0x139/0x190 fs/open.c:1437
    [<00000000ee967f42>] do_sys_open fs/open.c:1452 [inline]
    [<00000000ee967f42>] __do_sys_openat fs/open.c:1468 [inline]
    [<00000000ee967f42>] __se_sys_openat fs/open.c:1463 [inline]
    [<00000000ee967f42>] __x64_sys_openat+0x13d/0x1f0 fs/open.c:1463
    [<000000004fad64b5>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    [<000000004fad64b5>] do_syscall_64+0x3e/0xf0 arch/x86/entry/common.c:83
    [<00000000c2701c13>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

Reported-by: Liujingfeng <liujingfeng@qianxin.com>
Signed-off-by: Zqiang <qiang.zhang1211@gmail.com>
---
 kernel/time/posix-clock.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index 9de66bbbb3d1..68990dd66956 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -137,6 +137,9 @@ static int posix_clock_open(struct inode *inode, struct file *fp)
 
 	if (!err) {
 		get_device(clk->dev);
+	} else {
+		kfree(pccontext);
+		fp->private_data = NULL;
 	}
 out:
 	up_read(&clk->rwsem);
-- 
2.17.1