In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add<\/p>\n
iommu_mock_device_add() first calls iommu_fwspec_init(), which on
\nsuccess allocates both dev->iommu (via dev_iommu_get()) and
\ndev->iommu->fwspec. If the subsequent device_add(dev) call fails,
\nthe error path only calls iommu_fwspec_free(dev), which frees
\nfwspec but leaves dev->iommu still allocated.<\/p>\n
This triggers the following kmemleak report when fuzzing with Syzkaller:<\/p>\n
BUG: memory leak
\nunreferenced object 0xffff888011e0a200 (size 192):
\n comm “syz.1.1695”, pid 24885, jiffies 4295222527
\n hex dump (first 32 bytes):
\n 00 00 00 00 00 00 00 00 00 00 00 00 ad 4e ad de ………….N..
\n ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff …………….
\n backtrace (crc 25df5bb3):
\n kmemleak_alloc_recursive include\/linux\/kmemleak.h:44 [inline]
\n slab_post_alloc_hook mm\/slub.c:4575 [inline]
\n slab_alloc_node mm\/slub.c:4899 [inline]
\n __kmalloc_cache_noprof+0x47a\/0x710 mm\/slub.c:5415
\n kmalloc_noprof include\/linux\/slab.h:950 [inline]
\n kzalloc_noprof include\/linux\/slab.h:1188 [inline]
\n dev_iommu_get+0x10c\/0x1a0 drivers\/iommu\/iommu.c:408
\n iommu_fwspec_init+0x288\/0x4d0 drivers\/iommu\/iommu.c:3087
\n iommu_mock_device_add+0x46\/0xb0 drivers\/iommu\/iommu.c:385
\n mock_dev_create drivers\/iommu\/iommufd\/selftest.c:1025 [inline]
\n iommufd_test_mock_domain drivers\/iommu\/iommufd\/selftest.c:1066 [inline]
\n iommufd_test+0x2f8a\/0x6190 drivers\/iommu\/iommufd\/selftest.c:2072
\n iommufd_fops_ioctl+0x367\/0x540 drivers\/iommu\/iommufd\/main.c:533
\n vfs_ioctl fs\/ioctl.c:51 [inline]
\n __do_sys_ioctl fs\/ioctl.c:597 [inline]
\n __se_sys_ioctl fs\/ioctl.c:583 [inline]
\n __x64_sys_ioctl+0x18e\/0x210 fs\/ioctl.c:583
\n do_syscall_x64 arch\/x86\/entry\/syscall_64.c:63 [inline]
\n do_syscall_64+0x116\/0x800 arch\/x86\/entry\/syscall_64.c:94
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Fix this by calling dev_iommu_free(dev) instead of iommu_fwspec_free(dev)
\nin the device_add() failure path. dev_iommu_free() frees both fwspec
\nand the outer dev_iommu struct and clears dev->iommu.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add<\/p>\n
iommu_mock_device_add() first calls iommu_fwspec_i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21371","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21371","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21371"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21371"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21371"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}