Re: gigaset: memory leak in gigaset_initcshw

[Paul Bolle]

On do, 2016-02-04 at 11:40 +0100, Dmitry Vyukov wrote:
> Forgot to mention that you need to run it in a parallel loop, sorry.

I see.

> This one should do:
> 
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <stdint.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> #include <sys/types.h>
> #include <sys/wait.h>
> 
> void work()
> {
>   long r[7];
>   memset(r, -1, sizeof(r));
>   r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
>                  0xfffffffffffffffful, 0x0ul);
>   r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0);
>   *(uint32_t*)0x20002b1e = (uint32_t)0x10;
>   r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0);
>   *(uint32_t*)0x20009000 = (uint32_t)0x7;
>   r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0);
> }
> 
> int main() {
>   int running, status;

(gcc complained about "running" being used uninitialized, though a few
mock runs suggest it got initialized to 0 anyhow. I initialized
"running" to 0 explicitly for the real runs.)

>   for (;;) {
>     while (running < 32) {
>       if (fork() == 0) {
>         work();
>         exit(0);
>       }
>       running++;
>     }
>     if (wait(&status) > 0)
>       running--;
>   }
> }

(Note to self: this hammers my laptop with about 2.000 runs per second.
After some time systemd's logging appears to have trouble handling the
output this reproducer generates, so maybe messages end up getting
dropped.)

> While running it, sample/proc/slabinfo with:
> 
> # cat /proc/slabinfo | egrep "^kmalloc-2048"
> 
> It constantly grows.

I don't really know how /proc/slabinfo should be interpreted, sorry. But
the interesting fields appear to be "<active_objs>" and "<num_objs>".
"<num_objs>" seems to be stable here (during the runs of a few minutes
that I dare to inflict on my laptop). "<active_objs>" is more volatile.
But I also saw it going down while the reproducer was running.

What are you seeing here?

Thanks,


Paul Bolle