* memory leak in hub_event
@ 2020-11-20 15:15 syzbot
2020-11-20 16:56 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2020-11-20 15:15 UTC (permalink / raw)
To: balbi, gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810d5ff800 (size 2048):
comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<00000000f0428224>] kmalloc include/linux/slab.h:552 [inline]
[<00000000f0428224>] kzalloc include/linux/slab.h:664 [inline]
[<00000000f0428224>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff888112544c40 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
hex dump (first 32 bytes):
31 2d 31 00 00 00 00 00 00 00 00 00 00 00 00 00 1-1.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d0f4aa93>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<000000005866b3ad>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<00000000b590b008>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000d251a578>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<0000000075b37c03>] usb_alloc_dev+0x1ee/0x450 drivers/usb/core/usb.c:650
[<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff888112544ce0 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949231 (age 13.850s)
hex dump (first 32 bytes):
00 4d 54 12 81 88 ff ff 00 00 00 00 00 00 00 00 .MT.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000005516ca37>] kmalloc include/linux/slab.h:557 [inline]
[<000000005516ca37>] kzalloc include/linux/slab.h:664 [inline]
[<000000005516ca37>] usb_get_configuration+0xce/0x1dd0 drivers/usb/core/config.c:887
[<000000009ab33a39>] usb_enumerate_device drivers/usb/core/hub.c:2387 [inline]
[<000000009ab33a39>] usb_new_device+0x1a9/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff888112544bc0 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949247 (age 13.690s)
hex dump (first 32 bytes):
73 79 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 syz.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b344f779>] kmalloc include/linux/slab.h:557 [inline]
[<00000000b344f779>] usb_cache_string+0x8a/0xf0 drivers/usb/core/message.c:1025
[<0000000074577e65>] usb_enumerate_device drivers/usb/core/hub.c:2397 [inline]
[<0000000074577e65>] usb_new_device+0x98/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff888112544cc0 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949251 (age 13.650s)
hex dump (first 32 bytes):
73 79 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 syz.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b344f779>] kmalloc include/linux/slab.h:557 [inline]
[<00000000b344f779>] usb_cache_string+0x8a/0xf0 drivers/usb/core/message.c:1025
[<000000003d5bd90b>] usb_enumerate_device drivers/usb/core/hub.c:2398 [inline]
[<000000003d5bd90b>] usb_new_device+0xae/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff888112544d40 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949255 (age 13.610s)
hex dump (first 32 bytes):
73 79 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 syz.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b344f779>] kmalloc include/linux/slab.h:557 [inline]
[<00000000b344f779>] usb_cache_string+0x8a/0xf0 drivers/usb/core/message.c:1025
[<000000007392d5f6>] usb_enumerate_device drivers/usb/core/hub.c:2400 [inline]
[<000000007392d5f6>] usb_new_device+0xc4/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-20 15:15 memory leak in hub_event syzbot
@ 2020-11-20 16:56 ` Alan Stern
2020-11-20 16:56 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-20 16:56 UTC (permalink / raw)
To: syzbot; +Cc: balbi, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Nov 20, 2020 at 07:15:20AM -0800, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
> dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
> compiler: gcc (GCC) 10.1.0-syz 20200507
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff88810d5ff800 (size 2048):
> comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
> hex dump (first 32 bytes):
> ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
> 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
> backtrace:
> [<00000000f0428224>] kmalloc include/linux/slab.h:552 [inline]
> [<00000000f0428224>] kzalloc include/linux/slab.h:664 [inline]
> [<00000000f0428224>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
> [<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
> [<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
> [<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
> [<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
> [<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
> [<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
> [<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
> [<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
This looks like a reference is being taken but not released. Hard to
tell where it's happening, though. Let's try to narrow it down.
Alan Stern
#syz test: upstream 4d02da97
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
}
gspca_dev->v4l2_dev.release = gspca_release;
+ ret = -EIO;
+ goto out;
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: Re: memory leak in hub_event
2020-11-20 16:56 ` Alan Stern
@ 2020-11-20 16:56 ` syzbot
2020-11-20 17:00 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2020-11-20 16:56 UTC (permalink / raw)
To: Alan Stern; +Cc: balbi, gregkh, linux-kernel, linux-usb, stern, syzkaller-bugs
> On Fri, Nov 20, 2020 at 07:15:20AM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
>> dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
>> compiler: gcc (GCC) 10.1.0-syz 20200507
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
>>
>> BUG: memory leak
>> unreferenced object 0xffff88810d5ff800 (size 2048):
>> comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
>> hex dump (first 32 bytes):
>> ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
>> 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
>> backtrace:
>> [<00000000f0428224>] kmalloc include/linux/slab.h:552 [inline]
>> [<00000000f0428224>] kzalloc include/linux/slab.h:664 [inline]
>> [<00000000f0428224>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
>> [<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
>> [<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
>> [<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
>> [<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
>> [<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
>> [<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
>> [<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
>> [<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
>
> This looks like a reference is being taken but not released. Hard to
> tell where it's happening, though. Let's try to narrow it down.
>
> Alan Stern
>
> #syz test: upstream 4d02da97
"upstream" does not look like a valid git repo address.
>
> Index: usb-devel/drivers/media/usb/gspca/gspca.c
> ===================================================================
> --- usb-devel.orig/drivers/media/usb/gspca/gspca.c
> +++ usb-devel/drivers/media/usb/gspca/gspca.c
> @@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
> }
>
> gspca_dev->v4l2_dev.release = gspca_release;
> + ret = -EIO;
> + goto out;
> ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
> if (ret)
> goto out;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: Re: memory leak in hub_event
2020-11-20 16:56 ` syzbot
@ 2020-11-20 17:00 ` Alan Stern
2020-11-23 18:29 ` Andrey Konovalov
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-20 17:00 UTC (permalink / raw)
To: Andrey Konovalov; +Cc: balbi, gregkh, linux-kernel, linux-usb, syzkaller-bugs
On Fri, Nov 20, 2020 at 08:56:11AM -0800, syzbot wrote:
> > On Fri, Nov 20, 2020 at 07:15:20AM -0800, syzbot wrote:
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
> >> git tree: upstream
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
> >> kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
> >> compiler: gcc (GCC) 10.1.0-syz 20200507
> >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000
> > #syz test: upstream 4d02da97
>
> "upstream" does not look like a valid git repo address.
Okay, Andrey. If "upstream" is not accepted as a valid git repo
address, why does syzkaller list it on the "git tree:" line? It seems
to me that syzkaller should be willing to accept as input anything it
produces as output.
And what repo should I put here?
Alan Stern
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: Re: memory leak in hub_event
2020-11-20 17:00 ` Alan Stern
@ 2020-11-23 18:29 ` Andrey Konovalov
2020-11-23 18:44 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Andrey Konovalov @ 2020-11-23 18:29 UTC (permalink / raw)
To: Alan Stern, syzbot
Cc: Felipe Balbi, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 1515 bytes --]
On Fri, Nov 20, 2020 at 6:00 PM Alan Stern <stern@rowland.harvard.edu> wrote:
>
> On Fri, Nov 20, 2020 at 08:56:11AM -0800, syzbot wrote:
> > > On Fri, Nov 20, 2020 at 07:15:20AM -0800, syzbot wrote:
> > >> Hello,
> > >>
> > >> syzbot found the following issue on:
> > >>
> > >> HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
> > >> git tree: upstream
> > >> console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
> > >> kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
> > >> dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
> > >> compiler: gcc (GCC) 10.1.0-syz 20200507
> > >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
> > >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000
>
> > > #syz test: upstream 4d02da97
> >
> > "upstream" does not look like a valid git repo address.
>
> Okay, Andrey. If "upstream" is not accepted as a valid git repo
> address, why does syzkaller list it on the "git tree:" line? It seems
> to me that syzkaller should be willing to accept as input anything it
> produces as output.
>
> And what repo should I put here?
Hi Alan,
Yeah, this is confusing, sorry. I've filed
https://github.com/google/syzkaller/issues/2265 for this.
Here "upstream" stands for the mainline tree, so something like this
should work:
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
4d02da97
Thanks!
[-- Attachment #2: gspca.patch --]
[-- Type: application/octet-stream, Size: 445 bytes --]
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
}
gspca_dev->v4l2_dev.release = gspca_release;
+ ret = -EIO;
+ goto out;
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 18:29 ` Andrey Konovalov
@ 2020-11-23 18:44 ` syzbot
2020-11-23 19:32 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2020-11-23 18:44 UTC (permalink / raw)
To: andreyknvl, balbi, gregkh, linux-kernel, linux-usb, stern,
syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
BUG: memory leak
unreferenced object 0xffff888117824d00 (size 256):
comm "syz-executor.6", pid 8896, jiffies 4294943994 (age 432.900s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 ad 17 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff8881182a6700 (size 256):
comm "syz-executor.2", pid 8885, jiffies 4294943999 (age 432.850s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 b7 16 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff888118395100 (size 256):
comm "syz-executor.4", pid 8892, jiffies 4294944000 (age 432.840s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 8b 17 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff8881116e0f00 (size 256):
comm "syz-executor.7", pid 8894, jiffies 4294944002 (age 432.820s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 b9 17 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
Tested on:
commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=134bda0d500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=10d4463e500000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 18:44 ` syzbot
@ 2020-11-23 19:32 ` Alan Stern
2020-11-23 19:42 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-23 19:32 UTC (permalink / raw)
To: syzbot, linux-usb, syzkaller-bugs
[CC list trimmed. I assume most people don't care about the boring
debugging details.]
On Mon, Nov 23, 2020 at 10:44:06AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in rxrpc_lookup_local
>
> write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
> write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
> BUG: memory leak
> unreferenced object 0xffff888117824d00 (size 256):
> comm "syz-executor.6", pid 8896, jiffies 4294943994 (age 432.900s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 0a 00 00 00 00 00 ad 17 81 88 ff ff ................
> backtrace:
> [<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
> [<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
> [<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
> [<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
> [<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
> [<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
I don't know what all this rxrpc or afs stuff is about, but it doesn't
seem to have anything to do with gspca. So it's a good bet that the
patch bailed out before the unreleased reference was acquired.
Let's try another spot. Binary search should find the right place
quickly enough.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
}
gspca_dev->v4l2_dev.release = gspca_release;
+// ret = -EIO;
+// goto out;
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;
@@ -1530,6 +1532,7 @@ int gspca_dev_probe2(struct usb_interfac
if (ret < 0)
goto out;
ret = sd_desc->init(gspca_dev);
+ ret = -EIO;
if (ret < 0)
goto out;
if (sd_desc->init_controls)
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 19:32 ` Alan Stern
@ 2020-11-23 19:42 ` syzbot
2020-11-23 19:53 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2020-11-23 19:42 UTC (permalink / raw)
To: linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in usb_set_configuration
BUG: memory leak
unreferenced object 0xffff888125a13400 (size 1024):
comm "kworker/0:3", pid 8164, jiffies 4294944436 (age 13.610s)
hex dump (first 32 bytes):
08 c7 84 25 81 88 ff ff 08 c7 84 25 81 88 ff ff ...%.......%....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000042c26fbc>] kmalloc include/linux/slab.h:552 [inline]
[<0000000042c26fbc>] kzalloc include/linux/slab.h:664 [inline]
[<0000000042c26fbc>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
[<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000061119d56>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000009f962ea9>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<000000001459c72b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<000000000532b098>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000910da3ce>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<0000000072e90711>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<000000005cbbd88c>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<00000000e7bc8059>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000d9415aa4>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000d9415aa4>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000d9415aa4>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000d9415aa4>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000004f0d05ee>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000a8771f1e>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000b8ee2caf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000e31b0818>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff88812592c340 (size 32):
comm "kworker/0:3", pid 8164, jiffies 4294944436 (age 13.610s)
hex dump (first 32 bytes):
33 2d 31 3a 30 2e 30 00 00 00 00 00 00 00 00 00 3-1:0.0.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000045f13983>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<0000000044941061>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<00000000c19829d3>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000b2f7d014>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<0000000071eb3ed0>] usb_set_configuration+0x6be/0xb90 drivers/usb/core/message.c:2094
[<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000061119d56>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000009f962ea9>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<000000001459c72b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<000000000532b098>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000910da3ce>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<0000000072e90711>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<000000005cbbd88c>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<00000000e7bc8059>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000d9415aa4>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000d9415aa4>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000d9415aa4>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000d9415aa4>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
BUG: memory leak
unreferenced object 0xffff888125a0b300 (size 256):
comm "kworker/0:3", pid 8164, jiffies 4294944441 (age 13.560s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 b3 a0 25 81 88 ff ff ...........%....
08 b3 a0 25 81 88 ff ff f0 8b 58 82 ff ff ff ff ...%......X.....
backtrace:
[<000000009575797b>] kmalloc include/linux/slab.h:552 [inline]
[<000000009575797b>] kzalloc include/linux/slab.h:664 [inline]
[<000000009575797b>] device_private_init drivers/base/core.c:2778 [inline]
[<000000009575797b>] device_add+0x7e8/0xc30 drivers/base/core.c:2828
[<000000009e05d7ea>] usb_set_configuration+0x9de/0xb90 drivers/usb/core/message.c:2159
[<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000061119d56>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000009f962ea9>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<000000001459c72b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<000000000532b098>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000910da3ce>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<0000000072e90711>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<000000005cbbd88c>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<00000000e7bc8059>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000d9415aa4>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000d9415aa4>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000d9415aa4>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000d9415aa4>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000004f0d05ee>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000a8771f1e>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000b8ee2caf>] kthread+0x178/0x1b0 kernel/kthread.c:292
BUG: memory leak
unreferenced object 0xffff888125b55800 (size 2048):
comm "kworker/0:1", pid 7, jiffies 4294944569 (age 12.280s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<00000000dad779b6>] kmalloc include/linux/slab.h:552 [inline]
[<00000000dad779b6>] kzalloc include/linux/slab.h:664 [inline]
[<00000000dad779b6>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<000000006a07019b>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000006a07019b>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000006a07019b>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000006a07019b>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<000000004f0d05ee>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000a8771f1e>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000b8ee2caf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000e31b0818>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Tested on:
commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12436fde500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=1197fc2d500000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 19:42 ` syzbot
@ 2020-11-23 19:53 ` Alan Stern
2020-11-23 20:01 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-23 19:53 UTC (permalink / raw)
To: syzbot; +Cc: linux-usb, syzkaller-bugs
On Mon, Nov 23, 2020 at 11:42:11AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in usb_set_configuration
>
> BUG: memory leak
> unreferenced object 0xffff888125a13400 (size 1024):
> comm "kworker/0:3", pid 8164, jiffies 4294944436 (age 13.610s)
> hex dump (first 32 bytes):
> 08 c7 84 25 81 88 ff ff 08 c7 84 25 81 88 ff ff ...%.......%....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<0000000042c26fbc>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000042c26fbc>] kzalloc include/linux/slab.h:664 [inline]
> [<0000000042c26fbc>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
> [<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> [<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
Okay, that looks like the original bug report, so this spot was bad.
Here's another try, about halfway between the first two.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,7 @@ int gspca_dev_probe2(struct usb_interfac
}
gspca_dev->v4l2_dev.release = gspca_release;
+// Good
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;
@@ -1518,6 +1519,7 @@ int gspca_dev_probe2(struct usb_interfac
q->min_buffers_needed = 2;
q->lock = &gspca_dev->usb_lock;
ret = vb2_queue_init(q);
+ ret = -EIO;
if (ret)
goto out;
gspca_dev->vdev.queue = q;
@@ -1530,6 +1532,7 @@ int gspca_dev_probe2(struct usb_interfac
if (ret < 0)
goto out;
ret = sd_desc->init(gspca_dev);
+// Bad
if (ret < 0)
goto out;
if (sd_desc->init_controls)
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 19:53 ` Alan Stern
@ 2020-11-23 20:01 ` syzbot
2020-11-23 20:38 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2020-11-23 20:01 UTC (permalink / raw)
To: linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in usb_set_configuration
BUG: memory leak
unreferenced object 0xffff88812695d400 (size 1024):
comm "kworker/1:2", pid 3876, jiffies 4294944657 (age 14.950s)
hex dump (first 32 bytes):
c8 ee 8d 26 81 88 ff ff c8 ee 8d 26 81 88 ff ff ...&.......&....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e23bdd53>] kmalloc include/linux/slab.h:552 [inline]
[<00000000e23bdd53>] kzalloc include/linux/slab.h:664 [inline]
[<00000000e23bdd53>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
[<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000084544ac0>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<00000000b1ca23bf>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<0000000071b8d8fa>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000b1c25910>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000104c17ae>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<00000000b93cff33>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<0000000098ed347d>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000008afe4d3b>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<000000000db8d2bb>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<000000000db8d2bb>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000000db8d2bb>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000000db8d2bb>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<00000000d321de91>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<0000000038230b58>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000a1e60acf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000d5e1cdc3>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff8881269b6560 (size 32):
comm "kworker/1:2", pid 3876, jiffies 4294944657 (age 14.950s)
hex dump (first 32 bytes):
36 2d 31 3a 30 2e 30 00 00 00 00 00 00 00 00 00 6-1:0.0.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e5418e58>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<00000000a3c51b27>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<000000002234e01b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000f280c658>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<000000008b5b3978>] usb_set_configuration+0x6be/0xb90 drivers/usb/core/message.c:2094
[<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000084544ac0>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<00000000b1ca23bf>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<0000000071b8d8fa>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000b1c25910>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000104c17ae>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<00000000b93cff33>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<0000000098ed347d>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000008afe4d3b>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<000000000db8d2bb>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<000000000db8d2bb>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000000db8d2bb>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000000db8d2bb>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
BUG: memory leak
unreferenced object 0xffff8881263eff00 (size 256):
comm "kworker/1:2", pid 3876, jiffies 4294944661 (age 14.910s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 ff 3e 26 81 88 ff ff ..........>&....
08 ff 3e 26 81 88 ff ff f0 8b 58 82 ff ff ff ff ..>&......X.....
backtrace:
[<000000001dc8ab7b>] kmalloc include/linux/slab.h:552 [inline]
[<000000001dc8ab7b>] kzalloc include/linux/slab.h:664 [inline]
[<000000001dc8ab7b>] device_private_init drivers/base/core.c:2778 [inline]
[<000000001dc8ab7b>] device_add+0x7e8/0xc30 drivers/base/core.c:2828
[<00000000268b1f35>] usb_set_configuration+0x9de/0xb90 drivers/usb/core/message.c:2159
[<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000084544ac0>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<00000000b1ca23bf>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<0000000071b8d8fa>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000b1c25910>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000104c17ae>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<00000000b93cff33>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<0000000098ed347d>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000008afe4d3b>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<000000000db8d2bb>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<000000000db8d2bb>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000000db8d2bb>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000000db8d2bb>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<00000000d321de91>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<0000000038230b58>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000a1e60acf>] kthread+0x178/0x1b0 kernel/kthread.c:292
BUG: memory leak
unreferenced object 0xffff888126ad1800 (size 2048):
comm "kworker/0:3", pid 4909, jiffies 4294944664 (age 14.880s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<0000000083df40a5>] kmalloc include/linux/slab.h:552 [inline]
[<0000000083df40a5>] kzalloc include/linux/slab.h:664 [inline]
[<0000000083df40a5>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<000000006a2b040a>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000006a2b040a>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000006a2b040a>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000006a2b040a>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<00000000d321de91>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<0000000038230b58>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000a1e60acf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000d5e1cdc3>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Tested on:
commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=110c7521500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=10a8b8f1500000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 20:01 ` syzbot
@ 2020-11-23 20:38 ` Alan Stern
2020-11-23 20:48 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-23 20:38 UTC (permalink / raw)
To: syzbot; +Cc: linux-usb, syzkaller-bugs
On Mon, Nov 23, 2020 at 12:01:08PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in usb_set_configuration
>
> BUG: memory leak
> unreferenced object 0xffff88812695d400 (size 1024):
> comm "kworker/1:2", pid 3876, jiffies 4294944657 (age 14.950s)
> hex dump (first 32 bytes):
> c8 ee 8d 26 81 88 ff ff c8 ee 8d 26 81 88 ff ff ...&.......&....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<00000000e23bdd53>] kmalloc include/linux/slab.h:552 [inline]
> [<00000000e23bdd53>] kzalloc include/linux/slab.h:664 [inline]
> [<00000000e23bdd53>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
> [<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> [<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
Also bad. That doesn't leave many possibilities.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,7 +1489,9 @@ int gspca_dev_probe2(struct usb_interfac
}
gspca_dev->v4l2_dev.release = gspca_release;
+// Good
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
+ ret = -EIO;
if (ret)
goto out;
gspca_dev->present = true;
@@ -1518,6 +1520,7 @@ int gspca_dev_probe2(struct usb_interfac
q->min_buffers_needed = 2;
q->lock = &gspca_dev->usb_lock;
ret = vb2_queue_init(q);
+// Bad
if (ret)
goto out;
gspca_dev->vdev.queue = q;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 20:38 ` Alan Stern
@ 2020-11-23 20:48 ` syzbot
2020-11-23 21:53 ` Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: syzbot @ 2020-11-23 20:48 UTC (permalink / raw)
To: linux-usb, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in usb_set_configuration
BUG: memory leak
unreferenced object 0xffff8881268a1800 (size 1024):
comm "kworker/0:2", pid 3644, jiffies 4294944749 (age 12.820s)
hex dump (first 32 bytes):
48 f3 6a 26 81 88 ff ff 48 f3 6a 26 81 88 ff ff H.j&....H.j&....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000089bfe22c>] kmalloc include/linux/slab.h:552 [inline]
[<0000000089bfe22c>] kzalloc include/linux/slab.h:664 [inline]
[<0000000089bfe22c>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
[<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000063ae4f8e>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000000b2cba9e>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<00000000401d8f88>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000071f219f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<0000000050610cd8>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<000000003a745e13>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000755052c8>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000005e2739cd>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000f1911f9c>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000f1911f9c>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000f1911f9c>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000f1911f9c>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000000f3eae83>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000aaee64a0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000c7b69663>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<0000000083b3bd6e>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
BUG: memory leak
unreferenced object 0xffff8881267cbb00 (size 32):
comm "kworker/0:2", pid 3644, jiffies 4294944749 (age 12.820s)
hex dump (first 32 bytes):
32 2d 31 3a 30 2e 30 00 00 00 00 00 00 00 00 00 2-1:0.0.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000cdbe26df>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<00000000f93de34f>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<00000000701cf1fc>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000d2130373>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<000000008249ed0f>] usb_set_configuration+0x6be/0xb90 drivers/usb/core/message.c:2094
[<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000063ae4f8e>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000000b2cba9e>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<00000000401d8f88>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000071f219f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<0000000050610cd8>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<000000003a745e13>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000755052c8>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000005e2739cd>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000f1911f9c>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000f1911f9c>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000f1911f9c>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000f1911f9c>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
BUG: memory leak
unreferenced object 0xffff888126840f00 (size 256):
comm "kworker/0:2", pid 3644, jiffies 4294944753 (age 12.780s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 0f 84 26 81 88 ff ff ...........&....
08 0f 84 26 81 88 ff ff f0 8b 58 82 ff ff ff ff ...&......X.....
backtrace:
[<00000000d74f9968>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d74f9968>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d74f9968>] device_private_init drivers/base/core.c:2778 [inline]
[<00000000d74f9968>] device_add+0x7e8/0xc30 drivers/base/core.c:2828
[<000000001ecf5486>] usb_set_configuration+0x9de/0xb90 drivers/usb/core/message.c:2159
[<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000063ae4f8e>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000000b2cba9e>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<00000000401d8f88>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000071f219f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<0000000050610cd8>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<000000003a745e13>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000755052c8>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000005e2739cd>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000f1911f9c>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000f1911f9c>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000f1911f9c>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000f1911f9c>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000000f3eae83>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000aaee64a0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000c7b69663>] kthread+0x178/0x1b0 kernel/kthread.c:292
BUG: memory leak
unreferenced object 0xffff888125cc4800 (size 2048):
comm "kworker/0:0", pid 5, jiffies 4294944827 (age 12.040s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<000000004b6bc568>] kmalloc include/linux/slab.h:552 [inline]
[<000000004b6bc568>] kzalloc include/linux/slab.h:664 [inline]
[<000000004b6bc568>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<0000000098e340b1>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<0000000098e340b1>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000098e340b1>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000098e340b1>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<000000000f3eae83>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000aaee64a0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000c7b69663>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<0000000083b3bd6e>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Tested on:
commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=115d7eb9500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=10236fde500000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 20:48 ` syzbot
@ 2020-11-23 21:53 ` Alan Stern
2020-11-23 22:09 ` syzbot
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-23 21:53 UTC (permalink / raw)
To: syzbot, Mauro Carvalho Chehab, Hans Verkuil
Cc: linux-usb, linux-media, syzkaller-bugs
Quick summary: syzbot found a memory leak in the gspca driver,
apparently caused by a reference being taken but not released in a
probe failure pathway.
On Mon, Nov 23, 2020 at 12:48:08PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in usb_set_configuration
>
> BUG: memory leak
> unreferenced object 0xffff8881268a1800 (size 1024):
> comm "kworker/0:2", pid 3644, jiffies 4294944749 (age 12.820s)
> hex dump (first 32 bytes):
> 48 f3 6a 26 81 88 ff ff 48 f3 6a 26 81 88 ff ff H.j&....H.j&....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<0000000089bfe22c>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000089bfe22c>] kzalloc include/linux/slab.h:664 [inline]
> [<0000000089bfe22c>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
> [<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> [<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
Okay, this does seem to pinpoint the problem. gspca_dev_probe2() calls
v4l2_device_register() at the start, but doesn't call
v4l2_device_disconnect() upon failure.
I'm not at all familiar with the design of the v4l2 subsystem. Mauro or
Hans: Is this the right solution?
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_disconnect(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 21:53 ` Alan Stern
@ 2020-11-23 22:09 ` syzbot
2020-11-23 22:24 ` Alan Stern
2020-12-02 16:22 ` memory leak in hub_event Alan Stern
0 siblings, 2 replies; 21+ messages in thread
From: syzbot @ 2020-11-23 22:09 UTC (permalink / raw)
To: hverkuil, linux-media, linux-usb, mchehab, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local
BUG: memory leak
unreferenced object 0xffff888117ab9900 (size 256):
comm "syz-executor.0", pid 8883, jiffies 4294943811 (age 433.620s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 80 cb 17 81 88 ff ff ................
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff888117d40d00 (size 256):
comm "syz-executor.1", pid 8884, jiffies 4294943812 (age 433.610s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 ac 17 81 88 ff ff ................
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff888118236900 (size 256):
comm "syz-executor.2", pid 8894, jiffies 4294943830 (age 433.430s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 34 18 81 88 ff ff ..........4.....
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff8881170d5400 (size 256):
comm "syz-executor.3", pid 8888, jiffies 4294943833 (age 433.400s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 35 18 81 88 ff ff .........@5.....
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
Tested on:
commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=123a6611500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=11c4e969500000
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 22:09 ` syzbot
@ 2020-11-23 22:24 ` Alan Stern
2020-11-24 11:38 ` Hans Verkuil
2020-12-02 16:22 ` memory leak in hub_event Alan Stern
1 sibling, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-23 22:24 UTC (permalink / raw)
To: syzbot; +Cc: hverkuil, linux-media, linux-usb, mchehab, syzkaller-bugs
On Mon, Nov 23, 2020 at 02:09:05PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in rxrpc_lookup_local
>
> BUG: memory leak
> unreferenced object 0xffff888117ab9900 (size 256):
> comm "syz-executor.0", pid 8883, jiffies 4294943811 (age 433.620s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 0a 00 00 00 00 80 cb 17 81 88 ff ff ................
> backtrace:
> [<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
> [<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
> [<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
> [<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
> [<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
> [<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
> [<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
> [<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
> [<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
> [<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
> [<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
> [<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
> [<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
> [<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
> [<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
> [<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
> [<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
> [<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Okay, that confirms it. This is a completely different memory leak, as
can be seen by comparing the stack trace with the previous one. The
problem with the gspca driver is gone.
Mauro/Hans, what should I do with the patch?
Alan Stern
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 22:24 ` Alan Stern
@ 2020-11-24 11:38 ` Hans Verkuil
2020-11-24 16:00 ` [PATCH] media: gspca: Fix memory leak in probe Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: Hans Verkuil @ 2020-11-24 11:38 UTC (permalink / raw)
To: Alan Stern, syzbot; +Cc: linux-media, linux-usb, mchehab, syzkaller-bugs
On 23/11/2020 23:24, Alan Stern wrote:
> On Mon, Nov 23, 2020 at 02:09:05PM -0800, syzbot wrote:
>> Hello,
>>
>> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
>> memory leak in rxrpc_lookup_local
>>
>> BUG: memory leak
>> unreferenced object 0xffff888117ab9900 (size 256):
>> comm "syz-executor.0", pid 8883, jiffies 4294943811 (age 433.620s)
>> hex dump (first 32 bytes):
>> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
>> 00 00 00 00 0a 00 00 00 00 80 cb 17 81 88 ff ff ................
>> backtrace:
>> [<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
>> [<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
>> [<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
>> [<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
>> [<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
>> [<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
>> [<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
>> [<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
>> [<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
>> [<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
>> [<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
>> [<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
>> [<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
>> [<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
>> [<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
>> [<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
>> [<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
>> [<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Okay, that confirms it. This is a completely different memory leak, as
> can be seen by comparing the stack trace with the previous one. The
> problem with the gspca driver is gone.
>
> Mauro/Hans, what should I do with the patch?
Just post it to linux-media and I'll pick it up as gspca maintainer.
Regards,
Hans
^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH] media: gspca: Fix memory leak in probe
2020-11-24 11:38 ` Hans Verkuil
@ 2020-11-24 16:00 ` Alan Stern
2020-12-02 8:58 ` Hans Verkuil
0 siblings, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-11-24 16:00 UTC (permalink / raw)
To: Hans Verkuil; +Cc: syzbot, linux-media, linux-usb, mchehab, syzkaller-bugs
The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface). But the
failure pathway neglects to call v4l2_device_disconnect(), the routine
responsible for dropping this reference. Consequently the memory for
the USB interface and its device never gets released.
This patch adds the missing function call.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
---
This doesn't fully fix syzbot's test case, because the test goes on and
encounters another memory leak in a different driver.
[as1949]
drivers/media/usb/gspca/gspca.c | 1 +
1 file changed, 1 insertion(+)
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_disconnect(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: [PATCH] media: gspca: Fix memory leak in probe
2020-11-24 16:00 ` [PATCH] media: gspca: Fix memory leak in probe Alan Stern
@ 2020-12-02 8:58 ` Hans Verkuil
2020-12-02 17:20 ` [PATCH v2] " Alan Stern
0 siblings, 1 reply; 21+ messages in thread
From: Hans Verkuil @ 2020-12-02 8:58 UTC (permalink / raw)
To: Alan Stern; +Cc: syzbot, linux-media, linux-usb, mchehab, syzkaller-bugs
On 24/11/2020 17:00, Alan Stern wrote:
> The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
> calls v4l2_device_register(), which takes a reference to the
> underlying device node (in this case, a USB interface). But the
> failure pathway neglects to call v4l2_device_disconnect(), the routine
> responsible for dropping this reference. Consequently the memory for
> the USB interface and its device never gets released.
>
> This patch adds the missing function call.
>
> Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
> Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
> CC: <stable@vger.kernel.org>
>
> ---
>
> This doesn't fully fix syzbot's test case, because the test goes on and
> encounters another memory leak in a different driver.
>
>
> [as1949]
>
>
> drivers/media/usb/gspca/gspca.c | 1 +
> 1 file changed, 1 insertion(+)
>
> Index: usb-devel/drivers/media/usb/gspca/gspca.c
> ===================================================================
> --- usb-devel.orig/drivers/media/usb/gspca/gspca.c
> +++ usb-devel/drivers/media/usb/gspca/gspca.c
> @@ -1575,6 +1575,7 @@ out:
> input_unregister_device(gspca_dev->input_dev);
> #endif
> v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
> + v4l2_device_disconnect(&gspca_dev->v4l2_dev);
Close, but no cigar. This should call v4l2_device_unregister(), the
counterpart of video_device_register. This unregister function also
calls v4l2_device_disconnect, but the code makes a lot more sense if
the v4l2_device_register is matched with the v4l2_device_unregister.
Regards,
Hans
> kfree(gspca_dev->usb_buf);
> kfree(gspca_dev);
> return ret;
>
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-11-23 22:09 ` syzbot
2020-11-23 22:24 ` Alan Stern
@ 2020-12-02 16:22 ` Alan Stern
2020-12-02 16:37 ` syzbot
1 sibling, 1 reply; 21+ messages in thread
From: Alan Stern @ 2020-12-02 16:22 UTC (permalink / raw)
To: syzbot; +Cc: hverkuil, linux-media, linux-usb, mchehab, syzkaller-bugs
> commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Hans says to call v4l2_device_unregister rather than
v4l2_device_disconnect. Let's make sure that works.
Alan Stern
#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_unregister(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;
^ permalink raw reply [flat|nested] 21+ messages in thread
* Re: memory leak in hub_event
2020-12-02 16:22 ` memory leak in hub_event Alan Stern
@ 2020-12-02 16:37 ` syzbot
0 siblings, 0 replies; 21+ messages in thread
From: syzbot @ 2020-12-02 16:37 UTC (permalink / raw)
To: hverkuil, linux-media, linux-usb, mchehab, stern, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local
BUG: memory leak
unreferenced object 0xffff88810ae30400 (size 256):
comm "syz-executor.2", pid 8878, jiffies 4294943959 (age 433.730s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 75 17 81 88 ff ff .........@u.....
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff888117639d00 (size 256):
comm "syz-executor.0", pid 8872, jiffies 4294943961 (age 433.710s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 7a 17 81 88 ff ff .........@z.....
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff888117a9cb00 (size 256):
comm "syz-executor.7", pid 8882, jiffies 4294943964 (age 433.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 80 8b 17 81 88 ff ff ................
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff88810c9b9700 (size 256):
comm "syz-executor.5", pid 8881, jiffies 4294943965 (age 433.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 b4 0c 81 88 ff ff ................
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Tested on:
commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16754c55500000
kernel config: https://syzkaller.appspot.com/x/.config?x=9e70f46496e4daad
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=12ca5c73500000
^ permalink raw reply [flat|nested] 21+ messages in thread
* [PATCH v2] media: gspca: Fix memory leak in probe
2020-12-02 8:58 ` Hans Verkuil
@ 2020-12-02 17:20 ` Alan Stern
0 siblings, 0 replies; 21+ messages in thread
From: Alan Stern @ 2020-12-02 17:20 UTC (permalink / raw)
To: Hans Verkuil; +Cc: syzbot, linux-media, linux-usb, mchehab, syzkaller-bugs
The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface). But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference. Consequently the memory for
the USB interface and its device never gets released.
This patch adds the missing function call.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+44e64397bd81d5e84cba@syzkaller.appspotmail.com
CC: <stable@vger.kernel.org>
---
v2: Replace v4l2_device_disconnect() call with v4l2_device_unregister().
[as1949b]
drivers/media/usb/gspca/gspca.c | 1 +
1 file changed, 1 insertion(+)
Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_unregister(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;
^ permalink raw reply [flat|nested] 21+ messages in thread
end of thread, other threads:[~2020-12-02 17:20 UTC | newest]
Thread overview: 21+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-20 15:15 memory leak in hub_event syzbot
2020-11-20 16:56 ` Alan Stern
2020-11-20 16:56 ` syzbot
2020-11-20 17:00 ` Alan Stern
2020-11-23 18:29 ` Andrey Konovalov
2020-11-23 18:44 ` syzbot
2020-11-23 19:32 ` Alan Stern
2020-11-23 19:42 ` syzbot
2020-11-23 19:53 ` Alan Stern
2020-11-23 20:01 ` syzbot
2020-11-23 20:38 ` Alan Stern
2020-11-23 20:48 ` syzbot
2020-11-23 21:53 ` Alan Stern
2020-11-23 22:09 ` syzbot
2020-11-23 22:24 ` Alan Stern
2020-11-24 11:38 ` Hans Verkuil
2020-11-24 16:00 ` [PATCH] media: gspca: Fix memory leak in probe Alan Stern
2020-12-02 8:58 ` Hans Verkuil
2020-12-02 17:20 ` [PATCH v2] " Alan Stern
2020-12-02 16:22 ` memory leak in hub_event Alan Stern
2020-12-02 16:37 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.