[prev in list] [next in list] [prev in thread] [next in thread] 

List:       git-commits-head
Subject:    HID: hidraw: fix memory leak in hidraw_release()
From:       Linux Kernel Mailing List <linux-kernel () vger ! kernel ! org>
Date:       2022-08-31 17:19:55
Message-ID: git-mailbomb-linux-master-a5623a203cffe2d2b84d2f6c989d9017db1856af () kernel ! org
[Download RAW message or body]

Commit:     a5623a203cffe2d2b84d2f6c989d9017db1856af
Parent:     cd11d1a6114bd4bc6450ae59f6e110ec47362126
Refname:    refs/heads/master
Web:        https://git.kernel.org/torvalds/c/a5623a203cffe2d2b84d2f6c989d9017db1856af
                
Author:     Karthik Alapati <mail@karthek.com>
AuthorDate: Thu Jul 28 21:13:17 2022 +0530
Committer:  Jiri Kosina <jkosina@suse.cz>
CommitDate: Thu Aug 25 11:30:50 2022 +0200

    HID: hidraw: fix memory leak in hidraw_release()
    
    Free the buffered reports before deleting the list entry.
    
    BUG: memory leak
    unreferenced object 0xffff88810e72f180 (size 32):
      comm "softirq", pid 0, jiffies 4294945143 (age 16.080s)
      hex dump (first 32 bytes):
        64 f3 c6 6a d1 88 07 04 00 00 00 00 00 00 00 00  d..j............
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      backtrace:
        [<ffffffff814ac6c3>] kmemdup+0x23/0x50 mm/util.c:128
        [<ffffffff8357c1d2>] kmemdup include/linux/fortify-string.h:440 [inline]
        [<ffffffff8357c1d2>] hidraw_report_event+0xa2/0x150 drivers/hid/hidraw.c:521
        [<ffffffff8356ddad>] hid_report_raw_event+0x27d/0x740 \
                drivers/hid/hid-core.c:1992
        [<ffffffff8356e41e>] hid_input_report+0x1ae/0x270 drivers/hid/hid-core.c:2065
        [<ffffffff835f0d3f>] hid_irq_in+0x1ff/0x250 drivers/hid/usbhid/hid-core.c:284
        [<ffffffff82d3c7f9>] __usb_hcd_giveback_urb+0xf9/0x230 \
                drivers/usb/core/hcd.c:1670
        [<ffffffff82d3cc26>] usb_hcd_giveback_urb+0x1b6/0x1d0 \
                drivers/usb/core/hcd.c:1747
        [<ffffffff82ef1e14>] dummy_timer+0x8e4/0x14c0 \
                drivers/usb/gadget/udc/dummy_hcd.c:1988
        [<ffffffff812f50a8>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1474
        [<ffffffff812f5586>] expire_timers kernel/time/timer.c:1519 [inline]
        [<ffffffff812f5586>] __run_timers.part.0+0x316/0x430 kernel/time/timer.c:1790
        [<ffffffff812f56e4>] __run_timers kernel/time/timer.c:1768 [inline]
        [<ffffffff812f56e4>] run_timer_softirq+0x44/0x90 kernel/time/timer.c:1803
        [<ffffffff848000e6>] __do_softirq+0xe6/0x2ea kernel/softirq.c:571
        [<ffffffff81246db0>] invoke_softirq kernel/softirq.c:445 [inline]
        [<ffffffff81246db0>] __irq_exit_rcu kernel/softirq.c:650 [inline]
        [<ffffffff81246db0>] irq_exit_rcu+0xc0/0x110 kernel/softirq.c:662
        [<ffffffff84574f02>] sysvec_apic_timer_interrupt+0xa2/0xd0 \
                arch/x86/kernel/apic/apic.c:1106
        [<ffffffff84600c8b>] asm_sysvec_apic_timer_interrupt+0x1b/0x20 \
                arch/x86/include/asm/idtentry.h:649
        [<ffffffff8458a070>] native_safe_halt arch/x86/include/asm/irqflags.h:51 \
                [inline]
        [<ffffffff8458a070>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 \
                [inline]
        [<ffffffff8458a070>] acpi_safe_halt drivers/acpi/processor_idle.c:111 \
                [inline]
        [<ffffffff8458a070>] acpi_idle_do_entry+0xc0/0xd0 \
drivers/acpi/processor_idle.c:554  
    Link: https://syzkaller.appspot.com/bug?id=19a04b43c75ed1092021010419b5e560a8172c4f
  Reported-by: syzbot+f59100a0428e6ded9443@syzkaller.appspotmail.com
    Signed-off-by: Karthik Alapati <mail@karthek.com>
    Signed-off-by: Jiri Kosina <jkosina@suse.cz>
---
 drivers/hid/hidraw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 681614a8302a5..197b1e7bf029e 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -350,6 +350,8 @@ static int hidraw_release(struct inode * inode, struct file * \
file)  down_write(&minors_rwsem);
 
 	spin_lock_irqsave(&hidraw_table[minor]->list_lock, flags);
+	for (int i = list->tail; i < list->head; i++)
+		kfree(list->buffer[i].value);
 	list_del(&list->node);
 	spin_unlock_irqrestore(&hidraw_table[minor]->list_lock, flags);
 	kfree(list);


[prev in list] [next in list] [prev in thread] [next in thread]