linux-kernel - Re: tty: memory leak in tty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 4 Apr 2016 12:37:09 -0700
From:	Peter Hurley <peter@...leysoftware.com>
To:	Dmitry Vyukov <dvyukov@...gle.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:	Jiri Slaby <jslaby@...e.com>, LKML <linux-kernel@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: tty: memory leak in tty_open

Hi Dmitry,

On 04/04/2016 01:56 AM, Dmitry Vyukov wrote:
> Hello,
> 
> The following program causes a memory leak:

Thanks for the report. This is the same problem fixed in 4.5
There was a merge snafu; Greg has the patch in his queue that
fixes this for 4.6

Regards,
Peter Hurley


> unreferenced object 0xffff8800643c3168 (size 2048):
>   comm "syz-executor", pid 29328, jiffies 4295358628 (age 32.380s)
>   hex dump (first 32 bytes):
>     01 54 00 00 0c 00 00 00 88 27 e1 67 00 88 ff ff  .T.......'.g....
>     88 1f 54 68 00 88 ff ff 40 b1 f0 86 ff ff ff ff  ..Th....@.......
>   backtrace:
>     [<ffffffff86798093>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:915
>     [<     inline     >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
>     [<     inline     >] slab_post_alloc_hook mm/slab.h:406
>     [<     inline     >] slab_alloc_node mm/slub.c:2602
>     [<     inline     >] slab_alloc mm/slub.c:2610
>     [<ffffffff817979a0>] kmem_cache_alloc_trace+0x160/0x3d0 mm/slub.c:2627
>     [<     inline     >] kmalloc include/linux/slab.h:478
>     [<     inline     >] kzalloc include/linux/slab.h:622
>     [<ffffffff8304a748>] alloc_tty_struct+0x98/0x840 drivers/tty/tty_io.c:3156
>     [<ffffffff8304af68>] tty_init_dev+0x78/0x4b0 drivers/tty/tty_io.c:1532
>     [<     inline     >] tty_open_by_driver drivers/tty/tty_io.c:2066
>     [<ffffffff8304c181>] tty_open+0xde1/0x1140 drivers/tty/tty_io.c:2114
>     [<ffffffff81801fca>] chrdev_open+0x22a/0x4c0 fs/char_dev.c:388
>     [<ffffffff817ed6a2>] do_dentry_open+0x6a2/0xcb0 fs/open.c:736
>     [<ffffffff817f0d7b>] vfs_open+0x17b/0x1f0 fs/open.c:853
>     [<     inline     >] do_last fs/namei.c:3238
>     [<ffffffff8182961b>] path_openat+0x51bb/0x5ce0 fs/namei.c:3374
>     [<ffffffff8182d7be>] do_filp_open+0x18e/0x250 fs/namei.c:3409
>     [<ffffffff817f14fc>] do_sys_open+0x1fc/0x420 fs/open.c:1020
>     [<     inline     >] SYSC_open fs/open.c:1038
>     [<ffffffff817f174d>] SyS_open+0x2d/0x40 fs/open.c:1033
> 
> 
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> 
> void* thr(void* arg)
> {
>   syscall(SYS_open, "/dev/console", 0, 0, 0, 0);
>   return 0;
> }
> 
> int main()
> {
>   int i;
>   pthread_t th[4];
> 
>   for (i = 0; i < 4; i++)
>     pthread_create(&th[i], 0, thr, 0);
>   usleep(100);
>   return 0;
> }
> 
> 
> On commit 05cf8077e54b20dddb756eaa26f3aeb5c38dd3cf (Apr 1).
>