[syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    0bb80ecc33a8 Linux 6.6-rc1
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10a8aad8680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=99ce3535087fc27
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=163a9e30680000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14fcd4a0680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce21ae500663/disk-0bb80ecc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d2f34908198/vmlinux-0bb80ecc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9c6f5eecda20/bzImage-0bb80ecc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888101230c00 (size 1024):
  comm "syz-executor201", pid 5036, jiffies 4294942174 (age 8.190s)
  hex dump (first 32 bytes):
    00 78 0f 11 81 88 ff ff 00 00 00 00 00 00 00 00  .x..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
    [<ffffffff827ec407>] kmalloc include/linux/slab.h:599 [inline]
    [<ffffffff827ec407>] kzalloc include/linux/slab.h:720 [inline]
    [<ffffffff827ec407>] gsm_dlci_alloc+0x27/0x1f0 drivers/tty/n_gsm.c:2640
    [<ffffffff827ec5ec>] gsm_activate_mux+0x1c/0x1c0 drivers/tty/n_gsm.c:3129
    [<ffffffff827f310f>] gsm_config_ext drivers/tty/n_gsm.c:3434 [inline]
    [<ffffffff827f310f>] gsmld_ioctl+0x6cf/0x9f0 drivers/tty/n_gsm.c:3798
    [<ffffffff827d7bbb>] tty_ioctl+0x3eb/0xc70 drivers/tty/tty_io.c:2785
    [<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
    [<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
    [<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
    [<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff888104f38000 (size 4096):
  comm "syz-executor201", pid 5036, jiffies 4294942174 (age 8.190s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815742ab>] __do_kmalloc_node mm/slab_common.c:1022 [inline]
    [<ffffffff815742ab>] __kmalloc+0x4b/0x150 mm/slab_common.c:1036
    [<ffffffff824f9f89>] kmalloc_array include/linux/slab.h:636 [inline]
    [<ffffffff824f9f89>] __kfifo_alloc+0x89/0xe0 lib/kfifo.c:43
    [<ffffffff827ec451>] gsm_dlci_alloc+0x71/0x1f0 drivers/tty/n_gsm.c:2645
    [<ffffffff827ec5ec>] gsm_activate_mux+0x1c/0x1c0 drivers/tty/n_gsm.c:3129
    [<ffffffff827f310f>] gsm_config_ext drivers/tty/n_gsm.c:3434 [inline]
    [<ffffffff827f310f>] gsmld_ioctl+0x6cf/0x9f0 drivers/tty/n_gsm.c:3798
    [<ffffffff827d7bbb>] tty_ioctl+0x3eb/0xc70 drivers/tty/tty_io.c:2785
    [<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
    [<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
    [<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
    [<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Fri, Sep 15, 2023 at 07:23:24PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <eadavis@sina.com>
> ---
>  drivers/tty/n_gsm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

This message never made it to lore.kernel.org, so you might need to fix
up your email system so that it doesn't get dropped from there.

Can you do so and resend?

thanks,

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Mon, Sep 18, 2023 at 04:45:26PM +0800, Edward AD wrote:
> On Mon, 18 Sep 2023 10:06:58 +0200, Greg KH wrote:
> > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > requested in gsm_dlci_alloc().
> > >
> > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > Signed-off-by: Edward AD <eadavis@sina.com>
> > > ---
> > >  drivers/tty/n_gsm.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > This message never made it to lore.kernel.org, so you might need to fix
> > up your email system so that it doesn't get dropped from there.
> This matter has been bothering me all along. I don't know why, some of the 
> patch emails I sent can be quickly responded to by "lore. kernel. org" correctly, 
> while others cannot. It wasn't until someone like you replied that I could see the 
> patches I sent.
> > 
> > Can you do so and resend?
> Yes, I can.
> However, it may take a long time as I currently do not know how to set up my email 
> system to avoid such issues from occurring.

Look at the tool `patatt`, it's what we use in `b4` to verify emails are
correct and sent by whom they say they are sent by.

Yours fail the checks by that tool, so try sending yourself an email and
work from there.

good luck!

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Mon, Sep 18, 2023 at 06:48:36PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <eadavis@sina.com>
> ---
>  drivers/tty/n_gsm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)


Still failing to show up on lore.kernel.org, are you sure that your
email infrastructure is correct?

I see this header on this email message:

Authentication-Results: sina.com;
        spf=none smtp.mailfrom=eadavis@sina.com;
        dkim=none header.i=none;
        dmarc=none action=none header.from=eadavis@sina.com

So something really doesn't like your domain's emails :(

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Tue, Sep 19, 2023 at 11:45:25AM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <eadavis@sina.com>
> ---
>  drivers/tty/n_gsm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

<snip>

You sent 5 of these, all identical, all rejected by lore.kernel.org, are
you sure your email servers are not on some spam blacklist somewhere?

greg k-h

[PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
Signed-off-by: Edward AD <twuufnxlz@gmail.com>
---
 drivers/tty/n_gsm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index b3550ff9c494..df9bb87652b0 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3136,8 +3136,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
 		gsm->receive = gsm1_receive;
 
 	ret = gsm_register_devices(gsm_tty_driver, gsm->num);
-	if (ret)
+	if (ret) {
+		gsm_dlci_free(&dlci->port);
 		return ret;
+	}
 
 	gsm->has_devices = true;
 	gsm->dead = false;		/* Tty opens are now permissible */
-- 
2.25.1

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Tue, Sep 19, 2023 at 04:02:08PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <twuufnxlz@gmail.com>

Please use your company name/email address, and then just set a manual
"From:" line as the first line in the changelog as the documentation
asks.  That's how developers work around their broken corporate email
systems (but really, you should go and poke your IT group to fix it.)

thanks,

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > requested in gsm_dlci_alloc().
> >
> > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> 
> Please use your company name/email address, and then just set a manual
> "From:" line as the first line in the changelog as the documentation
> asks.  That's how developers work around their broken corporate email
> systems (but really, you should go and poke your IT group to fix it.)
This repair was completed in my personal time. Additionally, there may be a 
possibility of the company's email being thrown away by 'lore.kernel.org'. 
If you are not very strict with this, I will continue to use my private email.

I will only keep one line starting with 'From:' in the patch.

Thanks,
edward

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Tue, Sep 19, 2023 at 05:22:26PM +0800, Edward AD wrote:
> On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > requested in gsm_dlci_alloc().
> > >
> > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> > 
> > Please use your company name/email address, and then just set a manual
> > "From:" line as the first line in the changelog as the documentation
> > asks.  That's how developers work around their broken corporate email
> > systems (but really, you should go and poke your IT group to fix it.)
> This repair was completed in my personal time. Additionally, there may be a 
> possibility of the company's email being thrown away by 'lore.kernel.org'. 
> If you are not very strict with this, I will continue to use my private email.

As you previously submitted this under your company name/address, we
have to be strict for obvious reasons, sorry.

> I will only keep one line starting with 'From:' in the patch.

I don't understand what you mean by this.

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

On Tue, 19 Sep 2023 11:31:57 +0200 Greg KH wrote:
> > On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > > requested in gsm_dlci_alloc().
> > > >
> > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> > >
> > > Please use your company name/email address, and then just set a manual
> > > "From:" line as the first line in the changelog as the documentation
> > > asks.  That's how developers work around their broken corporate email
> > > systems (but really, you should go and poke your IT group to fix it.)
> > This repair was completed in my personal time. Additionally, there may be a
> > possibility of the company's email being thrown away by 'lore.kernel.org'.
> > If you are not very strict with this, I will continue to use my private email.
> 
> As you previously submitted this under your company name/address, we
> have to be strict for obvious reasons, sorry.
The two email addresses I used before these are all my personal emails.
> 
> > I will only keep one line starting with 'From:' in the patch.
> 
> I don't understand what you mean by this.
Just set a manual "From:" line as the first line in the changelog as the 
documentation asks.

Thanks,
edward

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

On Tue, 19 Sep 2023 11:31:57 +0200 Greg KH wrote:
> > On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > > requested in gsm_dlci_alloc().
> > > >
> > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> > >
> > > Please use your company name/email address, and then just set a manual
> > > "From:" line as the first line in the changelog as the documentation
> > > asks.  That's how developers work around their broken corporate email
> > > systems (but really, you should go and poke your IT group to fix it.)
> > This repair was completed in my personal time. Additionally, there may be a
> > possibility of the company's email being thrown away by 'lore.kernel.org'.
> > If you are not very strict with this, I will continue to use my private email.
> 
> As you previously submitted this under your company name/address, we
> have to be strict for obvious reasons, sorry.
Before sending this email, according to your reply, I sent a new patch via email eadavis@sina.com.
But we can't see that email in lore.kernel.org
> 
> > I will only keep one line starting with 'From:' in the patch.
> 
> I don't understand what you mean by this.
Just set a manual "From:" line as the first line in the changelog as the 
documentation asks.

Thanks,
edward