Re: gigaset: memory leak in gigaset_initcshw

[Dmitry Vyukov]

On Thu, Feb 4, 2016 at 2:09 PM, Paul Bolle <pebolle@xxxxxxxxxx> wrote:
> On do, 2016-02-04 at 11:40 +0100, Dmitry Vyukov wrote:
>> Forgot to mention that you need to run it in a parallel loop, sorry.
>
> I see.
>
>> This one should do:
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <pthread.h>
>> #include <stdint.h>
>> #include <stdlib.h>
>> #include <string.h>
>> #include <sys/syscall.h>
>> #include <unistd.h>
>> #include <sys/types.h>
>> #include <sys/wait.h>
>>
>> void work()
>> {
>>   long r[7];
>>   memset(r, -1, sizeof(r));
>>   r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
>>                  0xfffffffffffffffful, 0x0ul);
>>   r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0);
>>   *(uint32_t*)0x20002b1e = (uint32_t)0x10;
>>   r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0);
>>   *(uint32_t*)0x20009000 = (uint32_t)0x7;
>>   r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0);
>> }
>>
>> int main() {
>>   int running, status;
>
> (gcc complained about "running" being used uninitialized, though a few
> mock runs suggest it got initialized to 0 anyhow. I initialized
> "running" to 0 explicitly for the real runs.)
>
>>   for (;;) {
>>     while (running < 32) {
>>       if (fork() == 0) {
>>         work();
>>         exit(0);
>>       }
>>       running++;
>>     }
>>     if (wait(&status) > 0)
>>       running--;
>>   }
>> }
>
> (Note to self: this hammers my laptop with about 2.000 runs per second.
> After some time systemd's logging appears to have trouble handling the
> output this reproducer generates, so maybe messages end up getting
> dropped.)
>
>> While running it, sample/proc/slabinfo with:
>>
>> # cat /proc/slabinfo | egrep "^kmalloc-2048"
>>
>> It constantly grows.
>
> I don't really know how /proc/slabinfo should be interpreted, sorry. But
> the interesting fields appear to be "<active_objs>" and "<num_objs>".
> "<num_objs>" seems to be stable here (during the runs of a few minutes
> that I dare to inflict on my laptop). "<active_objs>" is more volatile.
> But I also saw it going down while the reproducer was running.
>
> What are you seeing here?

I see that active_objs is slowly, constantly growing.

I've attached my config file, please try with it. You mentioned that
"16 is N_GIGASET_M101, while 7 is N_6PACK", probably one of these ttys
is not enabled in your config, and so the reproducer is not doing
anything useful.

Attachment: .config
Description: Binary data