lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 3 Feb 2016 16:31:36 +0100 From: Dmitry Vyukov <dvyukov@...gle.com> To: Paul Bolle <pebolle@...cali.nl>, Karsten Keil <isdn@...ux-pingi.de>, "David S. Miller" <davem@...emloft.net>, gigaset307x-common@...ts.sourceforge.net, netdev <netdev@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org> Cc: syzkaller <syzkaller@...glegroups.com>, Kostya Serebryany <kcc@...gle.com>, Alexander Potapenko <glider@...gle.com>, Sasha Levin <sasha.levin@...cle.com> Subject: gigaset: memory leak in gigaset_initcshw Hello, The following program causes a memory leak of ser_cardstate object allocated in gigaset_initcshw: // autogenerated by syzkaller (http://github.com/google/syzkaller) #include <pthread.h> #include <stdint.h> #include <string.h> #include <sys/syscall.h> #include <unistd.h> int main() { long r[7]; memset(r, -1, sizeof(r)); r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul, 0xfffffffffffffffful, 0x0ul); r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0); *(uint32_t*)0x20002b1e = (uint32_t)0x10; r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0); *(uint32_t*)0x20009000 = (uint32_t)0x7; r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0); return 0; } unreferenced object 0xffff88002b4109d8 (size 2048): comm "a.out", pid 9565, jiffies 4301785161 (age 10.646s) hex dump (first 32 bytes): e0 30 0a 87 ff ff ff ff 00 00 00 00 00 00 00 00 .0.............. 80 af 0d 88 ff ff ff ff 88 08 5e 00 00 88 ff ff ..........^..... backtrace: [< inline >] kzalloc include/linux/slab.h:607 [<ffffffff84bfbeab>] gigaset_initcshw+0x4b/0x2b0 drivers/isdn/gigaset/ser-gigaset.c:394 [<ffffffff84bb1e22>] gigaset_initcs+0xf82/0x1660 drivers/isdn/gigaset/common.c:748 [<ffffffff84bfb65b>] gigaset_tty_open+0x9b/0x460 drivers/isdn/gigaset/ser-gigaset.c:516 [<ffffffff82f9a648>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82f9ac32>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2656 [<ffffffff82f8390e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2911 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff817fa9ec>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff817fb89f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff8665ebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 On commit 34229b277480f46c1e9a19f027f30b074512e68b.
Powered by blists - more mailing lists