Re: [PATCH] fs:Fix kmemleak leak warning in getname_flags about working on unitialized memory

[nick <xerofoify@gmail.com>]

On 2016-08-04 08:18 AM, Tetsuo Handa wrote:
> On 2016/08/04 6:48, Nicholas Krause wrote:
>> This fixes a kmemleak leak warning complaining about working on
>> unitializied memory as found in the function, getname_flages. Seems
>> that we are indeed working on unitialized memory, as the filename
>> char pointer is never made to point to the filname structure's result
>> member for holding it's name, fix this by using memcpy to copy the
>> filname structure pointer's, name to the char pointer passed to this
>> function.
>>
>> Signed-off-by: Nicholas Krause <xerofoify@gmail.com>
>> ---
>>  fs/namei.c         | 1 +
>>  mm/early_ioremap.c | 1 +
>>  2 files changed, 2 insertions(+)
>>
>> diff --git a/fs/namei.c b/fs/namei.c
>> index c386a32..6b18d57 100644
>> --- a/fs/namei.c
>> +++ b/fs/namei.c
>> @@ -196,6 +196,7 @@ getname_flags(const char __user *filename, int flags, int *empty)
>>  		}
>>  	}
>>  
>> +	memcpy((char *)result->name, filename, len);
> 
> This filename is a __user pointer. Reading with memcpy() is not safe.
Indeed that is dangerous, I will test a v2 seeing if it is also fixed using
copy_to_user with the same pointers to kernel memory space into user space 
like this with memcpy.
Good Catch,
Nick
> 
>>  	result->uptr = filename;
>>  	result->aname = NULL;
>>  	audit_getname(result);
> 

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>