netdev - Re: gigaset: memory leak in gigaset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1454591389.14366.49.camel@tiscali.nl>
Date:	Thu, 04 Feb 2016 14:09:49 +0100
From:	Paul Bolle <pebolle@...cali.nl>
To:	Dmitry Vyukov <dvyukov@...gle.com>
Cc:	Karsten Keil <isdn@...ux-pingi.de>,
	"David S. Miller" <davem@...emloft.net>,
	gigaset307x-common@...ts.sourceforge.net,
	netdev <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>
Subject: Re: gigaset: memory leak in gigaset_initcshw

On do, 2016-02-04 at 11:40 +0100, Dmitry Vyukov wrote:
> Forgot to mention that you need to run it in a parallel loop, sorry.

I see.

> This one should do:
> 
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <stdint.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> #include <sys/types.h>
> #include <sys/wait.h>
> 
> void work()
> {
>   long r[7];
>   memset(r, -1, sizeof(r));
>   r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
>                  0xfffffffffffffffful, 0x0ul);
>   r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0);
>   *(uint32_t*)0x20002b1e = (uint32_t)0x10;
>   r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0);
>   *(uint32_t*)0x20009000 = (uint32_t)0x7;
>   r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0);
> }
> 
> int main() {
>   int running, status;

(gcc complained about "running" being used uninitialized, though a few
mock runs suggest it got initialized to 0 anyhow. I initialized
"running" to 0 explicitly for the real runs.)

>   for (;;) {
>     while (running < 32) {
>       if (fork() == 0) {
>         work();
>         exit(0);
>       }
>       running++;
>     }
>     if (wait(&status) > 0)
>       running--;
>   }
> }

(Note to self: this hammers my laptop with about 2.000 runs per second.
After some time systemd's logging appears to have trouble handling the
output this reproducer generates, so maybe messages end up getting
dropped.)

> While running it, sample/proc/slabinfo with:
> 
> # cat /proc/slabinfo | egrep "^kmalloc-2048"
> 
> It constantly grows.

I don't really know how /proc/slabinfo should be interpreted, sorry. But
the interesting fields appear to be "<active_objs>" and "<num_objs>".
"<num_objs>" seems to be stable here (during the runs of a few minutes
that I dare to inflict on my laptop). "<active_objs>" is more volatile.
But I also saw it going down while the reproducer was running.

What are you seeing here?

Thanks,


Paul Bolle