Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <6bb11497-c6bd-41ea-409a-fbddcf75ea97@paragon-software.com>
Date:   Fri, 30 Sep 2022 19:21:49 +0300
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.11.0
Subject: Re: [PATCH] fs/ntfs3: fix memory leak in put_ntfs()
Content-Language: en-US
To:     Karthik Alapati <mail@karthek.com>,
        Nathan Chancellor <nathan@kernel.org>,
        Nick Desaulniers <ndesaulniers@google.com>,
        Tom Rix <trix@redhat.com>
CC:     <ntfs3@lists.linux.dev>, <linux-kernel@vger.kernel.org>,
        <llvm@lists.linux.dev>
References: <Yw7k0VQm+8l8JKWr@karthik-strix-linux.karthek.com>
From:   Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
In-Reply-To: <Yw7k0VQm+8l8JKWr@karthik-strix-linux.karthek.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 8/31/22 07:34, Karthik Alapati wrote:
> free options in put_ntfs() rather than in ntfs_put_super()
> 
> BUG: memory leak
> unreferenced object 0xffff8881104f3720 (size 32):
>    comm "syz-executor634", pid 3605, jiffies 4294945517 (age 12.630s)
>    hex dump (first 32 bytes):
>      e0 36 4f 10 81 88 ff ff 80 57 e1 85 ff ff ff ff  .6O......W......
>      00 00 00 00 00 00 00 00 c0 ff c0 ff 00 00 00 00  ................
>    backtrace:
>      [<ffffffff81b23ef2>] kmalloc include/linux/slab.h:600 [inline]
>      [<ffffffff81b23ef2>] kzalloc include/linux/slab.h:733 [inline]
>      [<ffffffff81b23ef2>] ntfs_init_fs_context+0x22/0x1e0 fs/ntfs3/super.c:1397
>      [<ffffffff81650045>] alloc_fs_context+0x225/0x3b0 fs/fs_context.c:290
>      [<ffffffff8162bed3>] do_new_mount fs/namespace.c:3025 [inline]
>      [<ffffffff8162bed3>] path_mount+0x6f3/0x10d0 fs/namespace.c:3370
>      [<ffffffff8162cffe>] do_mount fs/namespace.c:3383 [inline]
>      [<ffffffff8162cffe>] __do_sys_mount fs/namespace.c:3591 [inline]
>      [<ffffffff8162cffe>] __se_sys_mount fs/namespace.c:3568 [inline]
>      [<ffffffff8162cffe>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
>      [<ffffffff845e4855>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>      [<ffffffff845e4855>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
>      [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> BUG: memory leak
> unreferenced object 0xffff8881104f36e0 (size 32):
>    comm "syz-executor634", pid 3605, jiffies 4294945517 (age 12.630s)
>    hex dump (first 32 bytes):
>      6d 61 63 63 79 72 69 6c 6c 69 63 00 00 00 00 00  maccyrillic.....
>      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>    backtrace:
>      [<ffffffff814c5b1d>] kmemdup_nul+0x2d/0x70 mm/util.c:152
>      [<ffffffff8164f66e>] vfs_parse_fs_string+0x6e/0xd0 fs/fs_context.c:178
>      [<ffffffff8164f7b0>] generic_parse_monolithic+0xe0/0x130 fs/fs_context.c:224
>      [<ffffffff8162c374>] do_new_mount fs/namespace.c:3036 [inline]
>      [<ffffffff8162c374>] path_mount+0xb94/0x10d0 fs/namespace.c:3370
>      [<ffffffff8162cffe>] do_mount fs/namespace.c:3383 [inline]
>      [<ffffffff8162cffe>] __do_sys_mount fs/namespace.c:3591 [inline]
>      [<ffffffff8162cffe>] __se_sys_mount fs/namespace.c:3568 [inline]
>      [<ffffffff8162cffe>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
>      [<ffffffff845e4855>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
>      [<ffffffff845e4855>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
>      [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
> 
> Link: https://syzkaller.appspot.com/bug?id=332ba47915d0e39e94b42a622f195f0804ecb67f
> Reported-by: syzbot+9d67170b20e8f94351c8@syzkaller.appspotmail.com
> Signed-off-by: Karthik Alapati <mail@karthek.com>
> ---
>   fs/ntfs3/super.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c
> index 47012c9bf505..ffb76a5bfd4f 100644
> --- a/fs/ntfs3/super.c
> +++ b/fs/ntfs3/super.c
> @@ -439,6 +439,7 @@ static void init_once(void *foo)
>    */
>   static noinline void put_ntfs(struct ntfs_sb_info *sbi)
>   {
> +	put_mount_options(sbi->options);
>   	kfree(sbi->new_rec);
>   	kvfree(ntfs_put_shared(sbi->upcase));
>   	kfree(sbi->def_table);
> @@ -482,7 +483,6 @@ static void ntfs_put_super(struct super_block *sb)
>   	/* Mark rw ntfs as clear, if possible. */
>   	ntfs_set_state(sbi, NTFS_DIRTY_CLEAR);
>   
> -	put_mount_options(sbi->options);
>   	put_ntfs(sbi);
>   	sb->s_fs_info = NULL;
>   

Hello
This patch failed our tests and caused email from kernel test robot,
so I can't accept it.
But the memory leak is a concern, thanks for the report.