Re: net: memory leak in mkiss_open

From: Dmitry Vyukov
Date: Thu Feb 25 2016 - 04:48:34 EST

Next message: Jiri Slaby: "Re: [PATCH 3.14 52/70] mm: fix mlock accouting"
Previous message: Juri Lelli: "Re: [PATCH 3/4] Remove dl_new"
In reply to: Cong Wang: "Re: net: memory leak in mkiss_open"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

On Thu, Feb 25, 2016 at 10:34 AM, <kn0wns1c@xxxxxxxxx> wrote:
> hello, can you tell me the kernel number which you fuzz, i test this poc in
> my computer but it does not work.

I've provided kernel version in the original email:
On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).
Attaching my .config to this email as well.

> å 2016å2æ22æææä UTC+8äå6:05:32ïDmitry Vyukovåéï
>>
>> Hello,
>>
>> The following program causes memory leak of 6 objects allocated in
>> mkiss_open:
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <sys/types.h>
>> #include <sys/stat.h>
>> #include <fcntl.h>
>> #include <sys/ioctl.h>
>> #include <stdlib.h>
>> #include <linux/tty.h>
>>
>> int main(int argc, char **argv)
>> {
>> int fd, val;
>>
>> fd = open("/dev/ptmx", O_RDWR);
>> val = N_AX25;
>> ioctl(fd, TIOCSETD, &val);
>> return 0;
>> }
>>
>>
>> unreferenced object 0xffff8800628991d8 (size 4096):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 00 00 00 00 61 78 30 00 00 00 00 00 ........ax0.....
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
>> [< inline >] kmalloc include/linux/slab.h:468
>> [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
>> [<ffffffff85551442>] alloc_netdev_mqs+0x82/0xd20 net/core/dev.c:7387
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff8800652b1aa0 (size 96):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> b8 94 89 62 00 88 ff ff b8 94 89 62 00 88 ff ff ...b.......b....
>> 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@..........
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
>> [< inline >] kmalloc include/linux/slab.h:463
>> [<ffffffff8557a4e2>] __hw_addr_create_ex+0x62/0x240
>> net/core/dev_addr_lists.c:34
>> [<ffffffff8557a7bc>] __hw_addr_add_ex+0xfc/0x270
>> net/core/dev_addr_lists.c:80
>> [< inline >] __hw_addr_add net/core/dev_addr_lists.c:88
>> [<ffffffff8557ac35>] dev_addr_init+0x105/0x1c0
>> net/core/dev_addr_lists.c:371
>> [<ffffffff855514f0>] alloc_netdev_mqs+0x130/0xd20 net/core/dev.c:7400
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff8800620b6a48 (size 512):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> e0 91 89 62 00 88 ff ff 40 20 68 88 ff ff ff ff ...b....@ h.....
>> 40 20 68 88 ff ff ff ff 00 00 00 00 00 00 00 00 @ h.............
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
>> [< inline >] kmalloc include/linux/slab.h:468
>> [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
>> [< inline >] netif_alloc_netdev_queues net/core/dev.c:6870
>> [<ffffffff85551a4c>] alloc_netdev_mqs+0x68c/0xd20 net/core/dev.c:7430
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff88006544ce10 (size 128):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564
>> [< inline >] kmalloc include/linux/slab.h:468
>> [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607
>> [< inline >] netif_alloc_rx_queues net/core/dev.c:6828
>> [<ffffffff85551bcc>] alloc_netdev_mqs+0x80c/0xd20 net/core/dev.c:7436
>> [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30
>> drivers/net/hamradio/mkiss.c:707
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>> unreferenced object 0xffff880062a09860 (size 8):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s)
>> hex dump (first 8 bytes):
>> 61 78 30 00 00 88 ff ff ax0.....
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176ee99>] __kmalloc_track_caller+0x1b9/0x380 mm/slub.c:4068
>> [<ffffffff816bbc89>] kstrdup+0x39/0x70 mm/util.c:53
>> [<ffffffff816bbd06>] kstrdup_const+0x46/0x60 mm/util.c:74
>> [<ffffffff82c3acce>] kvasprintf_const+0x10e/0x160 lib/kasprintf.c:47
>> [<ffffffff82c0cb96>] kobject_set_name_vargs+0x56/0x140
>> lib/kobject.c:265
>> [<ffffffff835aa0d4>] dev_set_name+0xa4/0xc0 drivers/base/core.c:937
>> [<ffffffff855c0eb3>] netdev_register_kobject+0xc3/0x3e0
>> net/core/net-sysfs.c:1531
>> [<ffffffff85571863>] register_netdevice+0x8f3/0xdb0
>> net/core/dev.c:6986
>> [<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098
>> [<ffffffff83ef3f64>] mkiss_open+0x634/0xc30
>> drivers/net/hamradio/mkiss.c:735
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> unreferenced object 0xffff880065785f48 (size 256):
>> comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
>> ff ff ff ff ff ff ff ff a0 7f cf 89 ff ff ff ff ................
>> backtrace:
>> [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
>> [< inline >] kmemleak_alloc_recursive
>> include/linux/kmemleak.h:47
>> [< inline >] slab_post_alloc_hook mm/slub.c:1337
>> [< inline >] slab_alloc_node mm/slub.c:2596
>> [< inline >] slab_alloc mm/slub.c:2604
>> [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
>> [< inline >] kzalloc include/linux/slab.h:463
>> [<ffffffff835ae60d>] device_private_init+0x4d/0x180
>> drivers/base/core.c:993
>> [<ffffffff835af5a3>] device_add+0xe63/0x1480 drivers/base/core.c:1037
>> [<ffffffff855c0f77>] netdev_register_kobject+0x187/0x3e0
>> net/core/net-sysfs.c:1550
>> [<ffffffff85571863>] register_netdevice+0x8f3/0xdb0
>> net/core/dev.c:6986
>> [<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098
>> [<ffffffff83ef3f64>] mkiss_open+0x634/0xc30
>> drivers/net/hamradio/mkiss.c:735
>> [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
>> drivers/tty/tty_ldisc.c:454
>> [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0
>> drivers/tty/tty_ldisc.c:561
>> [< inline >] tiocsetd drivers/tty/tty_io.c:2655
>> [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
>> [< inline >] vfs_ioctl fs/ioctl.c:43
>> [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
>> [< inline >] SYSC_ioctl fs/ioctl.c:689
>> [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
>> [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
>> arch/x86/entry/entry_64.S:185
>> [<ffffffffffffffff>] 0xffffffffffffffff
>>
>>
>> On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).
>
> --
> You received this message because you are subscribed to the Google Groups
> "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to syzkaller+unsubscribe@xxxxxxxxxxxxxxxxx
> For more options, visit https://groups.google.com/d/optout.

Attachment: .config
Description: Binary data

Next message: Jiri Slaby: "Re: [PATCH 3.14 52/70] mm: fix mlock accouting"
Previous message: Juri Lelli: "Re: [PATCH 3/4] Remove dl_new"
In reply to: Cong Wang: "Re: net: memory leak in mkiss_open"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]