Linux Kernel DMA Fence Leak Vulnerability in IIO Buffer Management

A memory leak vulnerability has been identified in the Linux kernel's IIO (Industrial I/O) subsystem, specifically within the buffer management component. The issue arises in the function 'iio_buffer_enqueue_dmabuf()', which improperly handles DMA (Direct Memory Access) fences. When this function is called, it allocates a DMA fence structure using 'kmalloc' and initializes its reference count. The function then adds the fence to a reservation object, increasing the reference count again, but fails to release the original reference before returning. This oversight causes a permanent memory leak with each buffer enqueue, as the initial allocation is never freed. The problem is exacerbated when multiple IIO devices are active, leading to a significant accumulation of unreleased memory allocations. This vulnerability has been addressed by modifying the function to properly release the fence reference after it has been added to the reservation object, ensuring that the memory is correctly managed and freed when no longer needed.

Impact

The vulnerability causes a continuous memory leak, with approximately 1875 allocations per second not being released. This unaddressed leak can lead to increased memory usage and potential exhaustion of available resources over time.

Reproduction

The vulnerability can be reproduced by using four IIO read-write devices at a frequency of 240 kHz, with 512 samples per buffer. This setup will generate a substantial number of unreleased memory allocations per second, matching the observed growth of the memory slab.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The specific commit addressing this issue is available in the Linux kernel stable tree.