[LTS 8.8] netdevsim: Fix memory leak of nsim_dev->fa_cookie #341
+1
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jira VULN-65788 cve CVE-2022-49803 commit-author Wang Yufen <wangyufen@huawei.com> commit 064bc73 kmemleak reports this issue: unreferenced object 0xffff8881bac872d0 (size 8): comm "sh", pid 58603, jiffies 4481524462 (age 68.065s) hex dump (first 8 bytes): 04 00 00 00 de ad be ef ........ backtrace: [<00000000c80b8577>] __kmalloc+0x49/0x150 [<000000005292b8c6>] nsim_dev_trap_fa_cookie_write+0xc1/0x210 [netdevsim] [<0000000093d78e77>] full_proxy_write+0xf3/0x180 [<000000005a662c16>] vfs_write+0x1c5/0xaf0 [<000000007aabf84a>] ksys_write+0xed/0x1c0 [<000000005f1d2e47>] do_syscall_64+0x3b/0x90 [<000000006001c6ec>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios: nsim_dev_trap_fa_cookie_write() kmalloc() fa_cookie nsim_dev->fa_cookie = fa_cookie .. nsim_drv_remove() The fa_cookie allocked in nsim_dev_trap_fa_cookie_write() is not freed. To fix, add kfree(nsim_dev->fa_cookie) to nsim_drv_remove(). Fixes: d3cbb90 ("netdevsim: add ACL trap reporting cookie as a metadata") Signed-off-by: Wang Yufen <wangyufen@huawei.com> Cc: Jiri Pirko <jiri@mellanox.com> Link: https://lore.kernel.org/r/1668504625-14698-1-git-send-email-wangyufen@huawei.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 064bc73) Signed-off-by: Marcin Wcisło <marcin.wcislo@conclusive.pl>
bmastbergen
requested review from
kerneltoast,
jainanmol84,
PlaidCat,
bmastbergen and
thefossguy-ciq
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
[LTS 8.8]
CVE-2022-49803
VULN-65788
Problem
https://www.cve.org/CVERecord?id=CVE-2022-49803
Background
The
netdevsimis a module simulating a network device in Linux. It's a developer testing tool that can be used to test various control path networking APIs.The memory leak described in CVE occurs after unloading the module, provided that some data was written through debugfs to the "flow action cookie" metadata storage associated with the simulated device.
This CVE appears to be one of the retroactive CVEs, filed for bugs which were fixed long before (fix commit 064bc73 date 2022-11-16 vs CVE publication date 2025-05-01).
Applicability
The
netdevsimmodule is enabled by theCONFIG_NETDEVSIMoption which ismin all configurations of LTS 8.8:The d3cbb90 commit identified in the fix commit 064bc73 as introducing the bug is present in
ciqlts8_8history, backported in the centos8 history rebuild commit a1c405c (1). The fix commit 064bc73 is not present and neither it's backported (2)The bug replication confirms the applicability.
Solution
As mentioned before, the mainline fix is in the 064bc73 commit. It applies with cherry-pick to
ciqlts8_8without modifications.kABI check: passed
Boot test: passed
boot-test.log
Kselftests: passed relative
Coverage
All net-related tests (except the unstable ones):
net/forwarding(exceptsch_tbf_ets.sh,tc_actions.sh,mirror_gre_vlan_bridge_1q.sh,sch_tbf_prio.sh,sch_tbf_root.sh,ipip_hier_gre_keys.sh,sch_ets.sh,mirror_gre_bridge_1d_vlan.sh),net/mptcp(exceptsimult_flows.sh),net(excepttxtimestamp.sh,udpgso_bench.sh,ip_defrag.sh,gro.sh,xfrm_policy.sh,udpgro_fwd.sh,reuseport_addr_any.sh,reuseaddr_conflict),netfilter(exceptnft_trans_stress.sh)Reference
kselftests–ciqlts8_8–run1.log
kselftests–ciqlts8_8–run2.log
kselftests–ciqlts8_8–run3.log
Patch
kselftests–ciqlts8_8-CVE-2022-49803–run1.log
kselftests–ciqlts8_8-CVE-2022-49803–run2.log
kselftests–ciqlts8_8-CVE-2022-49803–run3.log
Comparison
The results for the reference and patched kernel are the same.
Specific tests: passed
Reference
The bug was successfully replicated on
ciqlts8_8compiled with theCONFIG_DEBUG_KMEMLEAKoption set. Same steps were used as in #340Patch
The same steps repeated on the patched kernel produced no memory leaks logs.