net: memory leak in mkiss_open

From: Dmitry Vyukov
Date: Mon Feb 22 2016 - 05:05:39 EST

Next message: Sekhar Nori: "Re: [PATCH 3/5] ARM: davinci: dm365: Add dma_slave_map to edma"
Previous message: Srinivas Kandagatla: "Re: [PATCH] usb: chipidea: Configure DMA properties and ops from DT"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

The following program causes memory leak of 6 objects allocated in mkiss_open:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdlib.h>
#include <linux/tty.h>

int main(int argc, char **argv)
{
int fd, val;

fd = open("/dev/ptmx", O_RDWR);
val = N_AX25;
ioctl(fd, TIOCSETD, &val);
return 0;
}

unreferenced object 0xffff8800628991d8 (size 4096):
comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 61 78 30 00 00 00 00 00 ........ax0.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
[< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
[< inline >] slab_post_alloc_hook mm/slub.c:1337
[< inline >] slab_alloc_node mm/slub.c:2596
[< inline >] slab_alloc mm/slub.c:2604
[<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
[< inline >] kmalloc include/linux/slab.h:468
[<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
[<ffffffff85551442>] alloc_netdev_mqs+0x82/0xd20 net/core/dev.c:7387
[<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707
[<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
[<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
[< inline >] tiocsetd drivers/tty/tty_io.c:2655
[<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
[< inline >] SYSC_ioctl fs/ioctl.c:689
[<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
[<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff8800652b1aa0 (size 96):
comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
hex dump (first 32 bytes):
b8 94 89 62 00 88 ff ff b8 94 89 62 00 88 ff ff ...b.......b....
98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@..........
backtrace:
[<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
[< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
[< inline >] slab_post_alloc_hook mm/slub.c:1337
[< inline >] slab_alloc_node mm/slub.c:2596
[< inline >] slab_alloc mm/slub.c:2604
[<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
[< inline >] kmalloc include/linux/slab.h:463
[<ffffffff8557a4e2>] __hw_addr_create_ex+0x62/0x240
net/core/dev_addr_lists.c:34
[<ffffffff8557a7bc>] __hw_addr_add_ex+0xfc/0x270
net/core/dev_addr_lists.c:80
[< inline >] __hw_addr_add net/core/dev_addr_lists.c:88
[<ffffffff8557ac35>] dev_addr_init+0x105/0x1c0 net/core/dev_addr_lists.c:371
[<ffffffff855514f0>] alloc_netdev_mqs+0x130/0xd20 net/core/dev.c:7400
[<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707
[<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
[<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
[< inline >] tiocsetd drivers/tty/tty_io.c:2655
[<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
[< inline >] SYSC_ioctl fs/ioctl.c:689
[<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
[<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff8800620b6a48 (size 512):
comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
hex dump (first 32 bytes):
e0 91 89 62 00 88 ff ff 40 20 68 88 ff ff ff ff ...b....@ h.....
40 20 68 88 ff ff ff ff 00 00 00 00 00 00 00 00 @ h.............
backtrace:
[<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
[< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
[< inline >] slab_post_alloc_hook mm/slub.c:1337
[< inline >] slab_alloc_node mm/slub.c:2596
[< inline >] slab_alloc mm/slub.c:2604
[<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
[< inline >] kmalloc include/linux/slab.h:468
[<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
[< inline >] netif_alloc_netdev_queues net/core/dev.c:6870
[<ffffffff85551a4c>] alloc_netdev_mqs+0x68c/0xd20 net/core/dev.c:7430
[<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707
[<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
[<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
[< inline >] tiocsetd drivers/tty/tty_io.c:2655
[<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
[< inline >] SYSC_ioctl fs/ioctl.c:689
[<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
[<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff88006544ce10 (size 128):
comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
[< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
[< inline >] slab_post_alloc_hook mm/slub.c:1337
[< inline >] slab_alloc_node mm/slub.c:2596
[< inline >] slab_alloc mm/slub.c:2604
[<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
[< inline >] kmalloc include/linux/slab.h:468
[<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
[< inline >] netif_alloc_rx_queues net/core/dev.c:6828
[<ffffffff85551bcc>] alloc_netdev_mqs+0x80c/0xd20 net/core/dev.c:7436
[<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707
[<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
[<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
[< inline >] tiocsetd drivers/tty/tty_io.c:2655
[<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
[< inline >] SYSC_ioctl fs/ioctl.c:689
[<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
[<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
[<ffffffffffffffff>] 0xffffffffffffffff
unreferenced object 0xffff880062a09860 (size 8):
comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s)
hex dump (first 8 bytes):
61 78 30 00 00 88 ff ff ax0.....
backtrace:
[<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
[< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
[< inline >] slab_post_alloc_hook mm/slub.c:1337
[< inline >] slab_alloc_node mm/slub.c:2596
[< inline >] slab_alloc mm/slub.c:2604
[<ffffffff8176ee99>] __kmalloc_track_caller+0x1b9/0x380 mm/slub.c:4068
[<ffffffff816bbc89>] kstrdup+0x39/0x70 mm/util.c:53
[<ffffffff816bbd06>] kstrdup_const+0x46/0x60 mm/util.c:74
[<ffffffff82c3acce>] kvasprintf_const+0x10e/0x160 lib/kasprintf.c:47
[<ffffffff82c0cb96>] kobject_set_name_vargs+0x56/0x140 lib/kobject.c:265
[<ffffffff835aa0d4>] dev_set_name+0xa4/0xc0 drivers/base/core.c:937
[<ffffffff855c0eb3>] netdev_register_kobject+0xc3/0x3e0
net/core/net-sysfs.c:1531
[<ffffffff85571863>] register_netdevice+0x8f3/0xdb0 net/core/dev.c:6986
[<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098
[<ffffffff83ef3f64>] mkiss_open+0x634/0xc30 drivers/net/hamradio/mkiss.c:735
[<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
[<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
[< inline >] tiocsetd drivers/tty/tty_io.c:2655
[<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
[< inline >] SYSC_ioctl fs/ioctl.c:689
[<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
unreferenced object 0xffff880065785f48 (size 256):
comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff a0 7f cf 89 ff ff ff ff ................
backtrace:
[<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
[< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
[< inline >] slab_post_alloc_hook mm/slub.c:1337
[< inline >] slab_alloc_node mm/slub.c:2596
[< inline >] slab_alloc mm/slub.c:2604
[<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
[< inline >] kzalloc include/linux/slab.h:463
[<ffffffff835ae60d>] device_private_init+0x4d/0x180 drivers/base/core.c:993
[<ffffffff835af5a3>] device_add+0xe63/0x1480 drivers/base/core.c:1037
[<ffffffff855c0f77>] netdev_register_kobject+0x187/0x3e0
net/core/net-sysfs.c:1550
[<ffffffff85571863>] register_netdevice+0x8f3/0xdb0 net/core/dev.c:6986
[<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098
[<ffffffff83ef3f64>] mkiss_open+0x634/0xc30 drivers/net/hamradio/mkiss.c:735
[<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
[<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
[< inline >] tiocsetd drivers/tty/tty_io.c:2655
[<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
[< inline >] vfs_ioctl fs/ioctl.c:43
[<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
[< inline >] SYSC_ioctl fs/ioctl.c:689
[<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
[<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
[<ffffffffffffffff>] 0xffffffffffffffff

On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).

Next message: Sekhar Nori: "Re: [PATCH 3/5] ARM: davinci: dm365: Add dma_slave_map to edma"
Previous message: Srinivas Kandagatla: "Re: [PATCH] usb: chipidea: Configure DMA properties and ops from DT"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]