CVE-2022-49801: tracing: Fix memory leak in tracing_read_pipe()
In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix memory leak in tracingreadpipe()
kmemleak reports this issue:
unreferenced object 0xffff888105a18900 (size 128): comm "testprogs", pid 18933, jiffies 4336275356 (age 22801.766s) hex dump (first 32 bytes): 25 73 00 90 81 88 ff ff 26 05 00 00 42 01 58 04 %s......&...B.X. 03 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000560143a1>] kmallocnodetrackcaller+0x4a/0x140 [<000000006af00822>] krealloc+0x8d/0xf0 [<00000000c309be6a>] traceiterexpandformat+0x99/0x150 [<000000005a53bdb6>] tracecheckvprintf+0x1e0/0x11d0 [<0000000065629d9d>] traceeventprintf+0xb6/0xf0 [<000000009a690dc7>] tracerawoutputbpftraceprintk+0x89/0xc0 [<00000000d22db172>] printtraceline+0x73c/0x1480 [<00000000cdba76ba>] tracingreadpipe+0x45c/0x9f0 [<0000000015b58459>] vfsread+0x17b/0x7c0 [<000000004aeee8ed>] ksysread+0xed/0x1c0 [<0000000063d3d898>] dosyscall64+0x3b/0x90 [<00000000a06dda7f>] entrySYSCALL64afterhwframe+0x63/0xcd
iter->fmt alloced in tracingreadpipe() -> .. ->traceiterexpandformat(), but not freed, to fix, add free in tracingreleasepipe()
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates local access and low privileges are required. The impact is limited to availability, with no reported confidentiality or integrity impact.
What activity triggers the leak?
The leak occurs on the tracing read-pipe path when the trace iterator format is expanded. The reported stack trace includes output from BPF trace_printk events during tracing_read_pipe().
How can administrators identify that the system is affected?
kmemleak can report an unreferenced 128-byte allocation with a stack trace through trace_iter_expand_format, trace_check_vprintf, print_trace_line, and tracing_read_pipe. The allocation is identified as iter->fmt not being freed when the tracing pipe is released.
What remediation is available?
A patch is available. The fix frees the iter->fmt allocation in tracing_release_pipe().