| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CACT4Y+Y5UiZk_y_WKN14u4tAcNaGQMAV+1tKp-sHocn78qHZwg@mail.gmail.com>
Date: Mon, 22 Feb 2016 11:19:54 +0100
From: Dmitry Vyukov <dvyukov@...gle.com>
To: Andreas Koensgen <ajk@...nets.uni-bremen.de>,
linux-hams@...r.kernel.org, netdev <netdev@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>
Cc: syzkaller <syzkaller@...glegroups.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>
Subject: net: memory leak in N_6PACK driver
Hello,
The following program, if run in a parallel loop, leads to constant
memory growth.
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdlib.h>
#include <linux/tty.h>
int main(int argc, char **argv)
{
int fd, val;
fd = open("/dev/ptmx", O_RDWR);
val = N_6PACK;
ioctl(fd, TIOCSETD, &val);
return 0;
}
kmemleak is silent, but I see that slabinfo numbers constantly grow
while the programs are running. In a minute the machine becomes
completely unusable and kernel starts killing everything due to OOMs:
root@...ukov-z840:~# cat /proc/slabinfo | egrep "^kma"
kmalloc-4096 607 630 4568 7 8 : tunables 0 0
0 : slabdata 90 90 0
kmalloc-1024 794 882 1496 21 8 : tunables 0 0
0 : slabdata 42 42 0
kmalloc-512 1112 1520 984 16 4 : tunables 0 0
0 : slabdata 95 95 0
kmalloc-256 4075 4114 728 22 4 : tunables 0 0
0 : slabdata 187 187 0
kmalloc-64 3008 3060 536 30 4 : tunables 0 0
0 : slabdata 102 102 0
kmalloc-32 2922 2992 504 16 2 : tunables 0 0
0 : slabdata 187 187 0
kmalloc-16 3062 3136 488 16 2 : tunables 0 0
0 : slabdata 196 196 0
kmalloc-8 9664 9775 480 17 2 : tunables 0 0
0 : slabdata 575 575 0
root@...ukov-z840:~# cat /proc/slabinfo | egrep "^kma"
kmalloc-4096 1298 1323 4568 7 8 : tunables 0 0
0 : slabdata 189 189 0
kmalloc-1024 1188 1281 1496 21 8 : tunables 0 0
0 : slabdata 61 61 0
kmalloc-512 3644 3664 984 16 4 : tunables 0 0
0 : slabdata 229 229 0
kmalloc-256 4771 4818 728 22 4 : tunables 0 0
0 : slabdata 219 219 0
kmalloc-64 3697 3720 536 30 4 : tunables 0 0
0 : slabdata 124 124 0
kmalloc-32 6103 6128 504 16 2 : tunables 0 0
0 : slabdata 383 383 0
kmalloc-16 3087 3152 488 16 2 : tunables 0 0
0 : slabdata 197 197 0
kmalloc-8 16777 16813 480 17 2 : tunables 0 0
0 : slabdata 989 989 0
root@...ukov-z840:~# cat /proc/slabinfo | egrep "^kma"
kmalloc-4096 1353 1365 4568 7 8 : tunables 0 0
0 : slabdata 195 195 0
kmalloc-1024 1246 1323 1496 21 8 : tunables 0 0
0 : slabdata 63 63 0
kmalloc-512 4624 4640 984 16 4 : tunables 0 0
0 : slabdata 290 290 0
kmalloc-256 4816 4862 728 22 4 : tunables 0 0
0 : slabdata 221 221 0
kmalloc-64 3755 3810 536 30 4 : tunables 0 0
0 : slabdata 127 127 0
kmalloc-32 6334 6352 504 16 2 : tunables 0 0
0 : slabdata 397 397 0
kmalloc-16 3096 3152 488 16 2 : tunables 0 0
0 : slabdata 197 197 0
kmalloc-8 17286 17306 480 17 2 : tunables 0 0
0 : slabdata 1018 1018 0
root@...ukov-z840:~# cat /proc/slabinfo | egrep "^kma"
kmalloc-4096 2158 2184 4568 7 8 : tunables 0 0
0 : slabdata 312 312 0
kmalloc-1024 1598 1617 1496 21 8 : tunables 0 0
0 : slabdata 77 77 0
kmalloc-512 4017 4224 984 16 4 : tunables 0 0
0 : slabdata 264 264 0
kmalloc-256 5616 5676 728 22 4 : tunables 0 0
0 : slabdata 258 258 0
kmalloc-64 4551 4590 536 30 4 : tunables 0 0
0 : slabdata 153 153 0
kmalloc-32 9854 10032 504 16 2 : tunables 0 0
0 : slabdata 627 627 0
kmalloc-16 3062 3152 488 16 2 : tunables 0 0
0 : slabdata 197 197 0
kmalloc-8 25170 25755 480 17 2 : tunables 0 0
0 : slabdata 1515 1515 0
On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).
Powered by blists - more mailing lists