CVE-2024-50231

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iio: gts-helper: Fix memory leaks in iio_gts_build_avail_scale_table()<br /> <br /> modprobe iio-test-gts and rmmod it, then the following memory leak<br /> occurs:<br /> <br /> unreferenced object 0xffffff80c810be00 (size 64):<br /> comm "kunit_try_catch", pid 1654, jiffies 4294913981<br /> hex dump (first 32 bytes):<br /> 02 00 00 00 08 00 00 00 20 00 00 00 40 00 00 00 ........ ...@...<br /> 80 00 00 00 00 02 00 00 00 04 00 00 00 08 00 00 ................<br /> backtrace (crc a63d875e):<br /> [] kmemleak_alloc+0x34/0x40<br /> [] __kmalloc_noprof+0x2bc/0x3c0<br /> [] devm_iio_init_iio_gts+0x4b4/0x16f4<br /> [] 0xffffffdf052a62e0<br /> [] 0xffffffdf052a6488<br /> [] kunit_try_run_case+0x13c/0x3ac<br /> [] kunit_generic_run_threadfn_adapter+0x80/0xec<br /> [] kthread+0x2e8/0x374<br /> [] ret_from_fork+0x10/0x20<br /> unreferenced object 0xffffff80cbfe9e70 (size 16):<br /> comm "kunit_try_catch", pid 1658, jiffies 4294914015<br /> hex dump (first 16 bytes):<br /> 10 00 00 00 40 00 00 00 80 00 00 00 00 00 00 00 ....@...........<br /> backtrace (crc 857f0cb4):<br /> [] kmemleak_alloc+0x34/0x40<br /> [] __kmalloc_noprof+0x2bc/0x3c0<br /> [] devm_iio_init_iio_gts+0x4b4/0x16f4<br /> [] 0xffffffdf052a62e0<br /> [] 0xffffffdf052a6864<br /> [] kunit_try_run_case+0x13c/0x3ac<br /> [] kunit_generic_run_threadfn_adapter+0x80/0xec<br /> [] kthread+0x2e8/0x374<br /> [] ret_from_fork+0x10/0x20<br /> ......<br /> <br /> It includes 5*5 times "size 64" memory leaks, which correspond to 5 times<br /> test_init_iio_gain_scale() calls with gts_test_gains size 10 (10*size(int))<br /> and gts_test_itimes size 5. It also includes 5*1 times "size 16"<br /> memory leak, which correspond to one time __test_init_iio_gain_scale()<br /> call with gts_test_gains_gain_low size 3 (3*size(int)) and gts_test_itimes<br /> size 5.<br /> <br /> The reason is that the per_time_gains[i] is not freed which is allocated in<br /> the "gts-&gt;num_itime" for loop in iio_gts_build_avail_scale_table().