linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: syzbot <syzbot+bdebcbf44250d75bdd82@syzkaller.appspotmail.com>,
	syzkaller-bugs@googlegroups.com, gregkh@linuxfoundation.org,
	linux-kernel@vger.kernel.org
Subject: Re: memory leak in pty_common_install
Date: Fri, 2 Aug 2019 08:23:25 +0200	[thread overview]
Message-ID: <9ad9f8ee-4674-9665-1de5-001268d922bf@suse.cz> (raw)
In-Reply-To: <0000000000002cd2b1058ee760fe@google.com>

On 30. 07. 19, 17:08, syzbot wrote:
> Hello,
> 
> syzbot found the following crash on:
> 
> HEAD commit:    6789f873 Merge tag 'pm-5.3-rc2' of
> git://git.kernel.org/pu..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1696897c600000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=339b6a6b3640d115
> dashboard link:
> https://syzkaller.appspot.com/bug?extid=bdebcbf44250d75bdd82
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=153d7544600000
> 
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+bdebcbf44250d75bdd82@syzkaller.appspotmail.com
> 
> BUG: memory leak
> unreferenced object 0xffff88810d84d400 (size 512):
>   comm "syz-executor.5", pid 7522, jiffies 4294954305 (age 14.260s)
>   hex dump (first 32 bytes):
>     50 d4 84 0d 81 88 ff ff e0 ff ff ff 0f 00 00 00  P...............
>     10 d4 84 0d 81 88 ff ff 10 d4 84 0d 81 88 ff ff  ................
>   backtrace:
>     [<000000003d61da44>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
>     [<000000003d61da44>] slab_post_alloc_hook mm/slab.h:522 [inline]
>     [<000000003d61da44>] slab_alloc mm/slab.c:3319 [inline]
>     [<000000003d61da44>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
>     [<00000000a6239e0a>] kmalloc include/linux/slab.h:552 [inline]
>     [<00000000a6239e0a>] pty_common_install+0x4e/0x2b0
> drivers/tty/pty.c:391

So this is tty_port for o_tty.

...

> BUG: memory leak
> unreferenced object 0xffff88810e639800 (size 1024):
>   comm "syz-executor.5", pid 7522, jiffies 4294954305 (age 14.260s)
>   hex dump (first 32 bytes):
>     01 54 00 00 01 00 00 00 00 00 00 00 00 00 00 00  .T..............
>     00 83 fa 19 82 88 ff ff a0 7f 9b 83 ff ff ff ff  ................
>   backtrace:
>     [<000000003d61da44>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
>     [<000000003d61da44>] slab_post_alloc_hook mm/slab.h:522 [inline]
>     [<000000003d61da44>] slab_alloc mm/slab.c:3319 [inline]
>     [<000000003d61da44>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548
>     [<000000001cfffc30>] kmalloc include/linux/slab.h:552 [inline]
>     [<000000001cfffc30>] kzalloc include/linux/slab.h:748 [inline]
>     [<000000001cfffc30>] alloc_tty_struct+0x3f/0x290
> drivers/tty/tty_io.c:2981
>     [<000000001946a70c>] pty_common_install+0xac/0x2b0
> drivers/tty/pty.c:399

And this is o_tty proper. So we leak whole o_tty under some
circumstances... Trying to reproduce.

BTW the reproducer says:
ioctl$TCSETS(r0, 0x40045431, ...)

But 0x40045431 is TIOCSPTLCK, not TCSETS.

thanks,
-- 
js
suse labs

  reply	other threads:[~2019-08-02  6:23 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-30 15:08 memory leak in pty_common_install syzbot
2019-08-02  6:23 ` Jiri Slaby [this message]
2019-08-03 14:22   ` Jiri Slaby
2022-06-30  6:09 ` [syzbot] " syzbot
     [not found] <20190804142339.8180-1-hdanton@sina.com>
2019-08-05  9:11 ` Jiri Slaby

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=9ad9f8ee-4674-9665-1de5-001268d922bf@suse.cz \
    --to=jslaby@suse.cz \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+bdebcbf44250d75bdd82@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).