[PATCH] posix-timers: fix the pccontext memleak in posix_clock_open()

From: Zqiang
Date: Thu Mar 14 2024 - 23:13:24 EST


Currently, if the posix_clock structure's->ops.open return error in
posix_clock_open(), the pccontext object is not released, this commit
therefore invoke kfree() to released it.

unreferenced object 0xffff8881065327c0 (size 16):
comm "syz-executor.7", pid 8994, jiffies 4295144661 (age 17.222s)
hex dump (first 16 bytes):
00 20 79 01 81 88 ff ff 00 00 00 00 00 00 00 00 . y.............
backtrace:
[<00000000fba736c4>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<00000000fba736c4>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<00000000fba736c4>] slab_alloc_node mm/slub.c:3478 [inline]
[<00000000fba736c4>] __kmem_cache_alloc_node+0x1ee/0x250 mm/slub.c:3517
[<00000000f8fcb419>] kmalloc_trace+0x22/0xc0 mm/slab_common.c:1098
[<00000000afc910b4>] kmalloc include/linux/slab.h:600 [inline]
[<00000000afc910b4>] kzalloc include/linux/slab.h:721 [inline]
[<00000000afc910b4>] posix_clock_open+0xd3/0x250 kernel/time/posix-clock.c:126
[<00000000b1a43627>] chrdev_open+0x24b/0x6a0 fs/char_dev.c:414
[<00000000364febd5>] do_dentry_open+0x630/0x1580 fs/open.c:948
[<00000000ac62c8f4>] do_open fs/namei.c:3622 [inline]
[<00000000ac62c8f4>] path_openat+0x13f1/0x1c30 fs/namei.c:3779
[<0000000087bfc1bc>] do_filp_open+0x1c5/0x410 fs/namei.c:3809
[<0000000044db899a>] do_sys_openat2+0x139/0x190 fs/open.c:1437
[<00000000ee967f42>] do_sys_open fs/open.c:1452 [inline]
[<00000000ee967f42>] __do_sys_openat fs/open.c:1468 [inline]
[<00000000ee967f42>] __se_sys_openat fs/open.c:1463 [inline]
[<00000000ee967f42>] __x64_sys_openat+0x13d/0x1f0 fs/open.c:1463
[<000000004fad64b5>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
[<000000004fad64b5>] do_syscall_64+0x3e/0xf0 arch/x86/entry/common.c:83
[<00000000c2701c13>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

Reported-by: Liujingfeng <liujingfeng@xxxxxxxxxxx>
Signed-off-by: Zqiang <qiang.zhang1211@xxxxxxxxx>
---
kernel/time/posix-clock.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index 9de66bbbb3d1..68990dd66956 100644
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -137,6 +137,9 @@ static int posix_clock_open(struct inode *inode, struct file *fp)

if (!err) {
get_device(clk->dev);
+ } else {
+ kfree(pccontext);
+ fp->private_data = NULL;
}
out:
up_read(&clk->rwsem);
--
2.17.1