linux-kernel - Re: gigaset: memory leak in gigaset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 04 Feb 2016 14:46:44 +0100
From:	Paul Bolle <pebolle@...cali.nl>
To:	Dmitry Vyukov <dvyukov@...gle.com>
Cc:	Karsten Keil <isdn@...ux-pingi.de>,
	"David S. Miller" <davem@...emloft.net>,
	gigaset307x-common@...ts.sourceforge.net,
	netdev <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: gigaset: memory leak in gigaset_initcshw

Hi Dmitry,

On do, 2016-02-04 at 14:15 +0100, Dmitry Vyukov wrote:
> On Thu, Feb 4, 2016 at 2:09 PM, Paul Bolle <pebolle@...cali.nl> wrote:
> > What are you seeing here?
> 
> I see that active_objs is slowly, constantly growing.
> 
> I've attached my config file, please try with it. You mentioned that
> "16 is N_GIGASET_M101, while 7 is N_6PACK", probably one of these ttys
> is not enabled in your config,

Both are. (A 6pack module is loaded when I run the reproducer. I have no
idea what 6pack is good for. ser_gigaset is familiar, to me.)

>  and so the reproducer is not doing
> anything useful.

I actually wonder whether N_6PACK is relevant. Do you also see this
issue with another line discipline in the second TIOCSETD ioctl? 

Maybe it even triggers with two totally different line disciplines in
both calls? A (slightly edited) copy of tty.h is pasted below. It lists
the useful values for the TIOCSETD ioctl.

Would you mind testing a few combinations?

Thanks,


Paul Bolle

/* line disciplines */
#define N_TTY		0
#define N_SLIP		1
#define N_MOUSE		2
#define N_PPP		3
				/* 4 is obsolete */
#define N_AX25		5
#define N_X25		6	/* X.25 async */
#define N_6PACK		7
				/* 8 is obsolete */
#define N_R3964		9	/* Simatic R3964 */
				/* 10 is obsolete */
#define N_IRDA		11	/* Linux IrDa - http://irda.sourceforge.net/ */
				/* 12 is obsolete */
#define N_HDLC		13	/* synchronous HDLC */
#define N_SYNC_PPP	14	/* synchronous PPP */
#define N_HCI		15	/* Bluetooth HCI UART */
#define N_GIGASET_M101	16	/* Siemens Gigaset M101 serial DECT adapter */
#define N_SLCAN		17	/* Serial / USB serial CAN Adaptors */
#define N_PPS		18	/* Pulse per Second */
#define N_V253		19	/* Codec control over voice modem */
#define N_CAIF		20      /* CAIF protocol for talking to modems */
#define N_GSM0710	21	/* GSM 0710 Mux */
#define N_TI_WL		22	/* for TI's WL BT, FM, GPS combo chips */
#define N_TRACESINK	23	/* Trace data routing for MIPI P1149.7 */
#define N_TRACEROUTER	24	/* Trace data routing for MIPI P1149.7 */
#define N_NCI		25	/* NFC NCI UART */