Re: gigaset: memory leak in gigaset_initcshw

[Paul Bolle]

On wo, 2016-02-03 at 16:31 +0100, Dmitry Vyukov wrote:
> The following program causes a memory leak of ser_cardstate object
> allocated in gigaset_initcshw:
> 
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <stdint.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> 
> int main()
> {
>   long r[7];
>   memset(r, -1, sizeof(r));
>   r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
>                  0xfffffffffffffffful, 0x0ul);
>   r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0);
>   *(uint32_t*)0x20002b1e = (uint32_t)0x10;
>   r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0);
>   *(uint32_t*)0x20009000 = (uint32_t)0x7;
>   r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0);

strace translated this for me to
	mmap(0x20000000, 65536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
	open("/dev/ptmx", O_RDWR|O_LARGEFILE)   = 3
	ioctl(3, TIOCSETD, [16])                = 0
	ioctl(3, TIOCSETD, [7])                 = 0

Where 16 is N_GIGASET_M101, while 7 is N_6PACK.

>   return 0;
> }
> 
> unreferenced object 0xffff88002b4109d8 (size 2048):
>   comm "a.out", pid 9565, jiffies 4301785161 (age 10.646s)
>   hex dump (first 32 bytes):
>     e0 30 0a 87 ff ff ff ff 00 00 00 00 00 00 00 00  .0..............
>     80 af 0d 88 ff ff ff ff 88 08 5e 00 00 88 ff ff  ..........^.....
>   backtrace:
>     [<     inline     >] kzalloc include/linux/slab.h:607
>     [<ffffffff84bfbeab>] gigaset_initcshw+0x4b/0x2b0
> drivers/isdn/gigaset/ser-gigaset.c:394
>     [<ffffffff84bb1e22>] gigaset_initcs+0xf82/0x1660
> drivers/isdn/gigaset/common.c:748
>     [<ffffffff84bfb65b>] gigaset_tty_open+0x9b/0x460
> drivers/isdn/gigaset/ser-gigaset.c:516
>     [<ffffffff82f9a648>] tty_ldisc_open.isra.2+0x78/0xd0
> drivers/tty/tty_ldisc.c:454
>     [<ffffffff82f9ac32>] tty_set_ldisc+0x292/0x8a0
> drivers/tty/tty_ldisc.c:561
>     [<     inline     >] tiocsetd drivers/tty/tty_io.c:2656
>     [<ffffffff82f8390e>] tty_ioctl+0xb2e/0x2160
> drivers/tty/tty_io.c:2911
>     [<     inline     >] vfs_ioctl fs/ioctl.c:43
>     [<ffffffff817fa9ec>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>     [<     inline     >] SYSC_ioctl fs/ioctl.c:689
>     [<ffffffff817fb89f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>     [<ffffffff8665ebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185

The above should provide me with enough information to figure out what's
going on here.

> On commit 34229b277480f46c1e9a19f027f30b074512e68b.

That's "Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net",
of two days ago.

Thanks for the report,


Paul Bolle