linux-kernel - net: memory leak in lapb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 22 Feb 2016 11:09:29 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	"David S. Miller" <davem@...emloft.net>, linux-x25@...r.kernel.org,
	netdev <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Jiri Slaby <jslaby@...e.com>,
	Peter Hurley <peter@...leysoftware.com>
Cc:	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: net: memory leak in lapb_register

Hello,

The following program causes a memory leak of an object allocated in
lapb_register:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdlib.h>
#include <linux/tty.h>

int main(int argc, char **argv)
{
  int fd, val;

  fd = open("/dev/ptmx", O_RDWR);
  val = N_X25;
  ioctl(fd, TIOCSETD, &val);
  return 0;
}



unreferenced object 0xffff880034b943d8 (size 512):
  comm "softirq", pid 0, jiffies 4294896736 (age 10.460s)
  hex dump (first 32 bytes):
    00 01 00 00 00 00 ad de 00 02 00 00 00 00 ad de  ................
    c0 a3 d3 35 00 88 ff ff 00 00 00 00 00 00 00 00  ...5............
  backtrace:
    [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916
    [<     inline     >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
    [<     inline     >] slab_post_alloc_hook mm/slub.c:1337
    [<     inline     >] slab_alloc_node mm/slub.c:2596
    [<     inline     >] slab_alloc mm/slub.c:2604
    [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621
    [<     inline     >] kzalloc include/linux/slab.h:463
    [<     inline     >] lapb_create_cb net/lapb/lapb_iface.c:121
    [<ffffffff85ca303a>] lapb_register+0xfa/0x590 net/lapb/lapb_iface.c:158
    [<     inline     >] x25_asy_open drivers/net/wan/x25_asy.c:485
    [<ffffffff83fa82d8>] x25_asy_open_tty+0x438/0x760
drivers/net/wan/x25_asy.c:573
    [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
    [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
    [<     inline     >] tiocsetd drivers/tty/tty_io.c:2655
    [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910
    [<     inline     >] vfs_ioctl fs/ioctl.c:43
    [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
    [<     inline     >] SYSC_ioctl fs/ioctl.c:689
    [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
    [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185
    [<ffffffffffffffff>] 0xffffffffffffffff


On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).