Received: by 2002:a05:6a10:f347:0:0:0:0 with SMTP id d7csp4353584pxu; Wed, 9 Dec 2020 15:09:44 -0800 (PST) X-Google-Smtp-Source: ABdhPJxzwEKbgI7MwEgZRi+euClVAtyvIPEuHsUpoSlkrfznFM9wglDqfuTSRB4w1rvxoofkvNSZ X-Received: by 2002:a05:6402:37b:: with SMTP id s27mr4063499edw.266.1607555384650; Wed, 09 Dec 2020 15:09:44 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1607555384; cv=none; d=google.com; s=arc-20160816; b=sgEIhOt5OFKdjFM+NqUwSwVYeRXTMx8l/i+nUjJ+pkZysKPkzGxyd8DtuY7cLBNjs5 mhzavP3SpwPdd8ZUFz8pzGwA02C5hSggJNi+G3ZjyVNwyFs6xPlLmEFsMG4YTp+rrAZB GiOwMd8lzuzLwVrxwMJvJvh1qRaHCPdudplhm/SvhPB9R+evU4+AsDk2+WyVOWUx0KX7 B9eSeR8pWWuIms1jFOUUq+TuVidM+fF/4oze3aQQq8gvvClbs+sjeGkRv9MwjU83QXYi ViX4eAS6ENo4A/bIJ2iYJUqBK4+a+b2nU0c3AeNp1OfksvfHfILtXd5eFbOLP9VBON0i xn0w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=yVXinIZUdFTcwX5Gd1E0wTO6JehWHvWKwJnxTaaQZ2E=; b=J+vewe8HXpFg5KC02Z0f0qZ1c8Ac8K5ERxLN0T/YNhSLUqfFQ6uPky43RdnNQVA9nV TGbdQ5Jm5597cRG05fVt6t8XQV8XcouwuzfjIfuHHj8Oetd4thymHGHxLymfGro1YxQW Z/LbwN8mnmCqXkJRvk637m6n5veFrBAU/WRSlriiYIebSVu/tZT1D9QSRO2T78rKB40L DJNH/bMpR4NVttbcw7jfURfuDC4DQWC7V5JSw/5B86ul35xjK7tXfuTXvdfZR9FOlSbp eTPnGFEVaoF1WUYTOOLZbW09s1u4cU4DlBpjisaQIwnAehoteAme6ZFfcuS+IbJf5bxs 5b+g== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id v10si1469965ejy.467.2020.12.09.15.09.16; Wed, 09 Dec 2020 15:09:44 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731316AbgLIMGr (ORCPT + 99 others); Wed, 9 Dec 2020 07:06:47 -0500 Received: from szxga07-in.huawei.com ([45.249.212.35]:9407 "EHLO szxga07-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730559AbgLIMGo (ORCPT ); Wed, 9 Dec 2020 07:06:44 -0500 Received: from DGGEMS403-HUB.china.huawei.com (unknown [172.30.72.59]) by szxga07-in.huawei.com (SkyGuard) with ESMTP id 4CrbN733V6z7BYm; Wed, 9 Dec 2020 20:05:27 +0800 (CST) Received: from localhost.localdomain.localdomain (10.175.113.25) by DGGEMS403-HUB.china.huawei.com (10.3.19.203) with Microsoft SMTP Server id 14.3.487.0; Wed, 9 Dec 2020 20:05:49 +0800 From: Qinglang Miao To: Tejun Heo , Li Zefan , Johannes Weiner CC: , , Qinglang Miao Subject: [PATCH] cgroup: Fix memory leak when parsing multiple source parameters Date: Wed, 9 Dec 2020 20:13:22 +0800 Message-ID: <20201209121322.77665-1-miaoqinglang@huawei.com> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Content-Transfer-Encoding: 7BIT Content-Type: text/plain; charset=US-ASCII X-Originating-IP: [10.175.113.25] X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org A memory leak is found in cgroup1_parse_param() when multiple source parameters overwrite fc->source in the fs_context struct without free. unreferenced object 0xffff888100d930e0 (size 16): comm "mount", pid 520, jiffies 4303326831 (age 152.783s) hex dump (first 16 bytes): 74 65 73 74 6c 65 61 6b 00 00 00 00 00 00 00 00 testleak........ backtrace: [<000000003e5023ec>] kmemdup_nul+0x2d/0xa0 [<00000000377dbdaa>] vfs_parse_fs_string+0xc0/0x150 [<00000000cb2b4882>] generic_parse_monolithic+0x15a/0x1d0 [<000000000f750198>] path_mount+0xee1/0x1820 [<0000000004756de2>] do_mount+0xea/0x100 [<0000000094cafb0a>] __x64_sys_mount+0x14b/0x1f0 Fix this bug by permitting a single source parameter and rejecting with an error all subsequent ones. Fixes: 8d2451f4994f ("cgroup1: switch to option-by-option parsing") Reported-by: Hulk Robot Signed-off-by: Qinglang Miao --- kernel/cgroup/cgroup-v1.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c index 191c329e4..1fd7d3d18 100644 --- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -908,6 +908,9 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param) opt = fs_parse(fc, cgroup1_fs_parameters, param, &result); if (opt == -ENOPARAM) { if (strcmp(param->key, "source") == 0) { + if (fc->source) + return invalf(fc, "Multiple sources not + supported"); fc->source = param->string; param->string = NULL; return 0; -- 2.23.0