linux-kernel - tty: tty_struct memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 3 Feb 2016 17:10:31 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: tty: tty_struct memory leak

Hello,

The following program causes tty_struct memory leak:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

int main()
{
  alarm(1);
  syscall(SYS_open, "/dev/ircomm7", 0x12d401ul, 0, 0, 0);
  return 0;
}


unreferenced object 0xffff88002d3c5898 (size 2048):
  comm "a.out", pid 5831, jiffies 4303981829 (age 9.451s)
  hex dump (first 32 bytes):
    01 54 00 00 1c 00 00 00 98 58 14 63 00 88 ff ff  .T.......X.c....
    18 ec 12 63 00 88 ff ff c0 45 34 87 ff ff ff ff  ...c.....E4.....
  backtrace:
    [<     inline     >] kzalloc include/linux/slab.h:607
    [<ffffffff82f871c8>] alloc_tty_struct+0x98/0x820 drivers/tty/tty_io.c:3133
    [<ffffffff82f879c8>] tty_init_dev+0x78/0x4b0 drivers/tty/tty_io.c:1523
    [<ffffffff82f88abd>] tty_open+0xcbd/0x1070 drivers/tty/tty_io.c:2082
    [<ffffffff817c864a>] chrdev_open+0x22a/0x4c0 fs/char_dev.c:388
    [<ffffffff817b3e72>] do_dentry_open+0x6a2/0xcb0 fs/open.c:736
    [<ffffffff817b754b>] vfs_open+0x17b/0x1f0 fs/open.c:853
    [<     inline     >] do_last fs/namei.c:3254
    [<ffffffff817ead19>] path_openat+0xde9/0x5e30 fs/namei.c:3386
    [<ffffffff817f359e>] do_filp_open+0x18e/0x250 fs/namei.c:3421
    [<ffffffff817b7ccc>] do_sys_open+0x1fc/0x420 fs/open.c:1022
    [<     inline     >] SYSC_open fs/open.c:1040
    [<ffffffff817b7f1d>] SyS_open+0x2d/0x40 fs/open.c:1035
    [<ffffffff8665ebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185


# ls -l /dev/ircomm7
crw-rw---T 1 root dialout 161, 7 Feb  3 16:03 /dev/ircomm7


On commit 34229b277480f46c1e9a19f027f30b074512e68b