linux-kernel - Memory leaks in Bluetooth and btusb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 31 Mar 2023 21:15:35 -0500
From:   Larry Finger <Larry.Finger@...inger.net>
To:     Marcel Holtmann <marcel@...tmann.org>,
        Johan Hedberg <johan.hedberg@...il.com>,
        Luiz Augusto von Dentz <luiz.dentz@...il.com>
Cc:     Linux Bluetooth mailing list <linux-bluetooth@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Memory leaks in Bluetooth and btusb

Hi,

I am running kernel 6.3.0-rc4-00041-g45a74775bbcd, and noticed the following 
memory leaks:

unreferenced object 0xffff9c8157f32800 (size 640):
   comm "softirq", pid 0, jiffies 4303340208 (age 1378.908s)
   hex dump (first 32 bytes):
     6c 69 62 75 64 65 76 00 0e 0c 02 01 10 00 08 6b  libudev........k
     ab 08 5d 00 5c 70 00 00 05 77 c5 e5 b1 02 47 65  ..].\p...w....Ge
   backtrace:
     [<ffffffff90103df9>] kmalloc_reserve+0x89/0xf0
     [<ffffffff90105a43>] __alloc_skb+0x83/0x190
     [<ffffffffc11111d1>] btusb_recv_intr+0x131/0x190 [btusb]
     [<ffffffffc11112ca>] btusb_intr_complete+0x9a/0x150 [btusb]
     [<ffffffffc0325321>] __usb_hcd_giveback_urb+0x91/0x110 [usbcore]
     [<ffffffffc03254f4>] usb_giveback_urb_bh+0x94/0x110 [usbcore]
     [<ffffffff8f8a66e8>] tasklet_action_common.isra.0+0xb8/0x130
     [<ffffffff90302721>] __do_softirq+0xc1/0x298
unreferenced object 0xffff9c811cb9e800 (size 224):
   comm "kworker/u9:1", pid 15177, jiffies 4303340208 (age 1378.908s)
   hex dump (first 32 bytes):
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
   backtrace:
     [<ffffffff90108da5>] skb_clone+0x55/0xd0
     [<ffffffffc126978f>] hci_event_packet+0xcf/0x550 [bluetooth]
     [<ffffffffc124e9e6>] hci_rx_work+0x2a6/0x570 [bluetooth]
     [<ffffffff8f8bfdf1>] process_one_work+0x201/0x410
     [<ffffffff8f8c004a>] worker_thread+0x4a/0x3b0
     [<ffffffff8f8c8587>] kthread+0xd7/0x100
     [<ffffffff8f802dbf>] ret_from_fork+0x1f/0x30

The Bluetooth device in question is from Realtek, and is part of a Realtek 
RTW8822BU wifi/BT combination device.

Thanks,

Larry