Re: memory leak in pty_common_install

[Jiri Slaby]

On 30. 07. 19, 17:08, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:ÂÂÂ 6789f873 Merge tag 'pm-5.3-rc2' of
> git://git.kernel.org/pu..
> git tree:ÂÂÂÂÂÂ upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1696897c600000
> kernel config:Â https://syzkaller.appspot.com/x/.config?x=339b6a6b3640d115
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=bdebcbf44250d75bdd82
> compiler:ÂÂÂÂÂÂ gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:ÂÂÂÂÂ https://syzkaller.appspot.com/x/repro.syz?x=153d7544600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+bdebcbf44250d75bdd82@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> BUG: memory leak
> unreferenced object 0xffff88810d84d400 (size 512):
> Â comm "syz-executor.5", pid 7522, jiffies 4294954305 (age 14.260s)
> Â hex dump (first 32 bytes):
> ÂÂÂ 50 d4 84 0d 81 88 ff ff e0 ff ff ff 0f 00 00 00Â P...............
>  10 d4 84 0d 81 88 ff ff 10 d4 84 0d 81 88 ff ff ................
> Â backtrace:
> ÂÂÂ [<000000003d61da44>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
> ÂÂÂ [<000000003d61da44>] slab_post_alloc_hook mm/slab.h:522 [inline]
> ÂÂÂ [<000000003d61da44>] slab_alloc mm/slab.c:3319 [inline]
> ÂÂÂ [<000000003d61da44>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
> ÂÂÂ [<00000000a6239e0a>] kmalloc include/linux/slab.h:552 [inline]
> ÂÂÂ [<00000000a6239e0a>] pty_common_install+0x4e/0x2b0
> drivers/tty/pty.c:391

So this is tty_port for o_tty.

...

> BUG: memory leak
> unreferenced object 0xffff88810e639800 (size 1024):
> Â comm "syz-executor.5", pid 7522, jiffies 4294954305 (age 14.260s)
> Â hex dump (first 32 bytes):
> ÂÂÂ 01 54 00 00 01 00 00 00 00 00 00 00 00 00 00 00Â .T..............
>  00 83 fa 19 82 88 ff ff a0 7f 9b 83 ff ff ff ff ................
> Â backtrace:
> ÂÂÂ [<000000003d61da44>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
> ÂÂÂ [<000000003d61da44>] slab_post_alloc_hook mm/slab.h:522 [inline]
> ÂÂÂ [<000000003d61da44>] slab_alloc mm/slab.c:3319 [inline]
> ÂÂÂ [<000000003d61da44>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
> ÂÂÂ [<000000001cfffc30>] kmalloc include/linux/slab.h:552 [inline]
> ÂÂÂ [<000000001cfffc30>] kzalloc include/linux/slab.h:748 [inline]
> ÂÂÂ [<000000001cfffc30>] alloc_tty_struct+0x3f/0x290
> drivers/tty/tty_io.c:2981
> ÂÂÂ [<000000001946a70c>] pty_common_install+0xac/0x2b0
> drivers/tty/pty.c:399

And this is o_tty proper. So we leak whole o_tty under some
circumstances... Trying to reproduce.

BTW the reproducer says:
ioctl$TCSETS(r0, 0x40045431, ...)

But 0x40045431 is TIOCSPTLCK, not TCSETS.

thanks,
-- 
js
suse labs