linux-kernel - Re: tty: tty_struct memory leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 3 Feb 2016 17:26:52 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>,
	LKML <linux-kernel@...r.kernel.org>
Cc:	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: tty: tty_struct memory leak

On Wed, Feb 3, 2016 at 5:10 PM, Dmitry Vyukov <dvyukov@...gle.com> wrote:
> Hello,
>
> The following program causes tty_struct memory leak:
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <stdint.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
>
> int main()
> {
>   alarm(1);
>   syscall(SYS_open, "/dev/ircomm7", 0x12d401ul, 0, 0, 0);
>   return 0;
> }
>
>
> unreferenced object 0xffff88002d3c5898 (size 2048):
>   comm "a.out", pid 5831, jiffies 4303981829 (age 9.451s)
>   hex dump (first 32 bytes):
>     01 54 00 00 1c 00 00 00 98 58 14 63 00 88 ff ff  .T.......X.c....
>     18 ec 12 63 00 88 ff ff c0 45 34 87 ff ff ff ff  ...c.....E4.....
>   backtrace:
>     [<     inline     >] kzalloc include/linux/slab.h:607
>     [<ffffffff82f871c8>] alloc_tty_struct+0x98/0x820 drivers/tty/tty_io.c:3133
>     [<ffffffff82f879c8>] tty_init_dev+0x78/0x4b0 drivers/tty/tty_io.c:1523
>     [<ffffffff82f88abd>] tty_open+0xcbd/0x1070 drivers/tty/tty_io.c:2082
>     [<ffffffff817c864a>] chrdev_open+0x22a/0x4c0 fs/char_dev.c:388
>     [<ffffffff817b3e72>] do_dentry_open+0x6a2/0xcb0 fs/open.c:736
>     [<ffffffff817b754b>] vfs_open+0x17b/0x1f0 fs/open.c:853
>     [<     inline     >] do_last fs/namei.c:3254
>     [<ffffffff817ead19>] path_openat+0xde9/0x5e30 fs/namei.c:3386
>     [<ffffffff817f359e>] do_filp_open+0x18e/0x250 fs/namei.c:3421
>     [<ffffffff817b7ccc>] do_sys_open+0x1fc/0x420 fs/open.c:1022
>     [<     inline     >] SYSC_open fs/open.c:1040
>     [<ffffffff817b7f1d>] SyS_open+0x2d/0x40 fs/open.c:1035
>     [<ffffffff8665ebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
> arch/x86/entry/entry_64.S:185
>
>
> # ls -l /dev/ircomm7
> crw-rw---T 1 root dialout 161, 7 Feb  3 16:03 /dev/ircomm7
>
>
> On commit 34229b277480f46c1e9a19f027f30b074512e68b

+syzkaller mailing list