linux-kernel - memory leak in r8712_init_recv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <00000000000092f61e05b6f1215b@google.com>
Date:   Sun, 20 Dec 2020 19:34:10 -0800
From:   syzbot <syzbot+1c46f3771695bccbdb3a@...kaller.appspotmail.com>
To:     Larry.Finger@...inger.net, devel@...verdev.osuosl.org,
        florian.c.schilhabel@...glemail.com, gregkh@...uxfoundation.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: memory leak in r8712_init_recv_priv

Hello,

syzbot found the following issue on:

HEAD commit:    467f8165 Merge tag 'close-range-cloexec-unshare-v5.11' of ..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=142b5745500000
kernel config:  https://syzkaller.appspot.com/x/.config?x=37c889fb8b2761af
dashboard link: https://syzkaller.appspot.com/bug?extid=1c46f3771695bccbdb3a
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1265cb37500000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1763527b500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1c46f3771695bccbdb3a@...kaller.appspotmail.com

executing program
BUG: memory leak
unreferenced object 0xffff88810ecc26c0 (size 192):
  comm "kworker/1:1", pid 35, jiffies 4294942461 (age 18.010s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 d8 26 cc 0e 81 88 ff ff  .........&......
  backtrace:
    [<000000005aecb941>] kmalloc include/linux/slab.h:557 [inline]
    [<000000005aecb941>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007c4331ea>] r8712_os_recvbuf_resource_alloc+0x1b/0x80 drivers/staging/rtl8712/recv_linux.c:46
    [<0000000026fac6b7>] r8712_init_recv_priv+0x96/0x210 drivers/staging/rtl8712/rtl8712_recv.c:54
    [<000000004dbac0de>] _r8712_init_recv_priv+0x134/0x150 drivers/staging/rtl8712/rtl871x_recv.c:78
    [<000000009f37c02e>] r8712_init_drv_sw+0xa0/0x1d0 drivers/staging/rtl8712/os_intfs.c:312
    [<00000000439d06d7>] r871xu_drv_init.cold+0x104/0x7d1 drivers/staging/rtl8712/usb_intf.c:391
    [<00000000a5c43c27>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000106f93f1>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<00000000856556bd>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<00000000789974b2>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000003b6b23b1>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000d916cd73>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<000000000aa7621e>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000c2fd5fd8>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<00000000d7a5749a>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000197a0613>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff88810ecc2600 (size 192):
  comm "kworker/1:1", pid 35, jiffies 4294942461 (age 18.010s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 18 26 cc 0e 81 88 ff ff  .........&......
  backtrace:
    [<000000005aecb941>] kmalloc include/linux/slab.h:557 [inline]
    [<000000005aecb941>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007c4331ea>] r8712_os_recvbuf_resource_alloc+0x1b/0x80 drivers/staging/rtl8712/recv_linux.c:46
    [<0000000026fac6b7>] r8712_init_recv_priv+0x96/0x210 drivers/staging/rtl8712/rtl8712_recv.c:54
    [<000000004dbac0de>] _r8712_init_recv_priv+0x134/0x150 drivers/staging/rtl8712/rtl871x_recv.c:78
    [<000000009f37c02e>] r8712_init_drv_sw+0xa0/0x1d0 drivers/staging/rtl8712/os_intfs.c:312
    [<00000000439d06d7>] r871xu_drv_init.cold+0x104/0x7d1 drivers/staging/rtl8712/usb_intf.c:391
    [<00000000a5c43c27>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000106f93f1>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<00000000856556bd>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<00000000789974b2>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000003b6b23b1>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000d916cd73>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<000000000aa7621e>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000c2fd5fd8>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<00000000d7a5749a>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000197a0613>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff88810ecc2540 (size 192):
  comm "kworker/1:1", pid 35, jiffies 4294942461 (age 18.010s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 58 25 cc 0e 81 88 ff ff  ........X%......
  backtrace:
    [<000000005aecb941>] kmalloc include/linux/slab.h:557 [inline]
    [<000000005aecb941>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007c4331ea>] r8712_os_recvbuf_resource_alloc+0x1b/0x80 drivers/staging/rtl8712/recv_linux.c:46
    [<0000000026fac6b7>] r8712_init_recv_priv+0x96/0x210 drivers/staging/rtl8712/rtl8712_recv.c:54
    [<000000004dbac0de>] _r8712_init_recv_priv+0x134/0x150 drivers/staging/rtl8712/rtl871x_recv.c:78
    [<000000009f37c02e>] r8712_init_drv_sw+0xa0/0x1d0 drivers/staging/rtl8712/os_intfs.c:312
    [<00000000439d06d7>] r871xu_drv_init.cold+0x104/0x7d1 drivers/staging/rtl8712/usb_intf.c:391
    [<00000000a5c43c27>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000106f93f1>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<00000000856556bd>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<00000000789974b2>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000003b6b23b1>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000d916cd73>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<000000000aa7621e>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000c2fd5fd8>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<00000000d7a5749a>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000197a0613>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches