linux-kernel - memory leak in udf_process

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <0000000000004c1f4d05afcff2f4@google.com>
Date:   Mon, 21 Sep 2020 03:02:21 -0700
From:   syzbot <syzbot+128f4dd6e796c98b3760@...kaller.appspotmail.com>
To:     jack@...e.com, linux-kernel@...r.kernel.org,
        syzkaller-bugs@...glegroups.com
Subject: memory leak in udf_process_sequence

Hello,

syzbot found the following issue on:

HEAD commit:    325d0eab Merge branch 'akpm' (patches from Andrew)
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13ec44d3900000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a1f3c5052e8097e9
dashboard link: https://syzkaller.appspot.com/bug?extid=128f4dd6e796c98b3760
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=101a0e9b900000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17ae18d3900000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+128f4dd6e796c98b3760@...kaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88811a1d0a00 (size 512):
  comm "syz-executor299", pid 6519, jiffies 4294943224 (age 15.090s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000009ea2686e>] kmalloc include/linux/slab.h:554 [inline]
    [<000000009ea2686e>] kmalloc_array include/linux/slab.h:593 [inline]
    [<000000009ea2686e>] kcalloc include/linux/slab.h:605 [inline]
    [<000000009ea2686e>] udf_process_sequence+0x7e/0x1080 fs/udf/super.c:1676
    [<00000000d9f60715>] udf_load_sequence fs/udf/super.c:1795 [inline]
    [<00000000d9f60715>] udf_check_anchor_block+0xdc/0x1a0 fs/udf/super.c:1835
    [<0000000067395456>] udf_scan_anchors+0x9e/0x240 fs/udf/super.c:1868
    [<00000000966a1b37>] udf_find_anchor fs/udf/super.c:1925 [inline]
    [<00000000966a1b37>] udf_load_vrs+0x1be/0x3b0 fs/udf/super.c:1990
    [<0000000004bba192>] udf_fill_super+0x286/0x7a5 fs/udf/super.c:2183
    [<00000000d48efb9b>] mount_bdev+0x1d3/0x210 fs/super.c:1417
    [<00000000280e173c>] legacy_get_tree+0x26/0x70 fs/fs_context.c:592
    [<0000000059fde270>] vfs_get_tree+0x28/0xe0 fs/super.c:1547
    [<00000000904c79e7>] do_new_mount fs/namespace.c:2875 [inline]
    [<00000000904c79e7>] path_mount+0x90e/0xda0 fs/namespace.c:3192
    [<000000008e0f8bcd>] do_mount fs/namespace.c:3205 [inline]
    [<000000008e0f8bcd>] __do_sys_mount fs/namespace.c:3413 [inline]
    [<000000008e0f8bcd>] __se_sys_mount fs/namespace.c:3390 [inline]
    [<000000008e0f8bcd>] __x64_sys_mount+0x140/0x190 fs/namespace.c:3390
    [<00000000e981acac>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000006322386a>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches