Skip to contentSkip to conversation

efivarfs: fix memory leak in efivarfs_create()

PATCH Applied Vamshi K Sthambamkadi 3 participants 3 messages Oct 23, 2020 – Nov 17, 2020

Subsystems (3)
Stable branch EFI EFI variable filesystem
lore
Share & tools
lore

Vamshi K Sthambamkadi

author
#0 lore raw

PATCH 1/1 efivarfs: fix memory leak in efivarfs_create()

kmemleak report:
unreferenced object 0xffff9b8915fcb000 (size 4096):
comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s) hex dump (first 32 bytes):

    2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  -...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
    [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
    [<00000000e6ee18fc>] path_openat+0xe4b/0x1120
    [<000000000ad0414f>] do_filp_open+0x91/0x100
    [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
    [<000000002a91be6d>] do_sys_open+0x46/0x80
    [<000000000a854999>] __x64_sys_openat+0x20/0x30
    [<00000000c50d89c9>] do_syscall_64+0x38/0x90
    [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

In efivarfs_create(), inode->i_private is setup with efivar_entry object which is never freed.

Signed-off-by Vamshi K Sthambamkadi <[email protected]>
---
 fs/efivarfs/super.c | 1 +
 1 file changed, 1 insertion(+)
fs/efivarfs/super.c +1 -0
index 15880a6..f943fd0 100644
@@ -21,6 +21,7 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
 	clear_inode(inode);
+	kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {
Signature · 1 line
2.7.4
maintainer Applied
#1 lore raw
Quoted 18 lines · Vamshi K Sthambamkadi

kmemleak report:
unreferenced object 0xffff9b8915fcb000 (size 4096):
comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s) hex dump (first 32 bytes):

    2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  -...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
    [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
    [<00000000e6ee18fc>] path_openat+0xe4b/0x1120
    [<000000000ad0414f>] do_filp_open+0x91/0x100
    [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
    [<000000002a91be6d>] do_sys_open+0x46/0x80
    [<000000000a854999>] __x64_sys_openat+0x20/0x30
    [<00000000c50d89c9>] do_syscall_64+0x38/0x90
    [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Quoted 4 lines

In efivarfs_create(), inode->i_private is setup with efivar_entry object which is never freed.

Signed-off-by Vamshi K Sthambamkadi <[email protected]>

Queued as a fix, thanks!

Quoted 19 lines
---
 fs/efivarfs/super.c | 1 +
 1 file changed, 1 insertion(+)
fs/efivarfs/super.c +1 -1
index 15880a6..f943fd0 100644
@@ -21,6 +21,7 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
        clear_inode(inode);
+       kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {
--

2.7.4

merge bot Applied
#2 lore raw
In reply to Vamshi K Sthambamkadi
The following commit has been merged into the efi/urgent branch of tip:

The following commit has been merged into the efi/urgent branch of tip:

Commit-ID:     fe5186cf12e30facfe261e9be6c7904a170bd822
Gitweb:        https://git.kernel.org/tip/fe5186cf12e30facfe261e9be6c7904a170bd822
Author:        Vamshi K Sthambamkadi <[email protected]>
AuthorDate:    Fri, 23 Oct 2020 17:24:39 +05:30
Committer:     Ard Biesheuvel <[email protected]>
CommitterDate: Mon, 26 Oct 2020 08:15:24 +01:00

efivarfs: fix memory leak in efivarfs_create()

kmemleak report:
unreferenced object 0xffff9b8915fcb000 (size 4096):
comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s) hex dump (first 32 bytes):

    2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  -...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0
    [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0
    [<00000000e6ee18fc>] path_openat+0xe4b/0x1120
    [<000000000ad0414f>] do_filp_open+0x91/0x100
    [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0
    [<000000002a91be6d>] do_sys_open+0x46/0x80
    [<000000000a854999>] __x64_sys_openat+0x20/0x30
    [<00000000c50d89c9>] do_syscall_64+0x38/0x90
    [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

In efivarfs_create(), inode->i_private is setup with efivar_entry object which is never freed.

Cc <[email protected]>
Signed-off-by Vamshi K Sthambamkadi <[email protected]>
Link https://lore.kernel.org/r/20201023115429.GA2479@cosmos open here
Signed-off-by Ard Biesheuvel <[email protected]>
---
 fs/efivarfs/super.c | 1 +
 1 file changed, 1 insertion(+)
fs/efivarfs/super.c +1 -0
index 15880a6..f943fd0 100644
@@ -21,6 +21,7 @@ LIST_HEAD(efivarfs_list);
 static void efivarfs_evict_inode(struct inode *inode)
 {
 	clear_inode(inode);
+	kfree(inode->i_private);
 }
 
 static const struct super_operations efivarfs_ops = {