From: syzbot <syzbot+8caaaec4e7a55d75e243@syzkaller.appspotmail.com>
To: gregkh@linuxfoundation.org, heikki.krogerus@linux.intel.com,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
noralf@tronnes.org, stern@rowland.harvard.edu,
syzkaller-bugs@googlegroups.com, tzimmermann@suse.de
Subject: [syzbot] memory leak in hub_event (3)
Date: Fri, 11 Feb 2022 12:17:26 -0800 [thread overview]
Message-ID: <0000000000005cacef05d7c3c10d@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: dfd42facf1e4 Linux 5.17-rc3
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14b4ef7c700000
kernel config: https://syzkaller.appspot.com/x/.config?x=48b71604a367da6e
dashboard link: https://syzkaller.appspot.com/bug?extid=8caaaec4e7a55d75e243
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1396902c700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1466e662700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8caaaec4e7a55d75e243@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810d49e800 (size 2048):
comm "kworker/1:1", pid 25, jiffies 4294954629 (age 16.460s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<ffffffff82c87a62>] kmalloc include/linux/slab.h:581 [inline]
[<ffffffff82c87a62>] kzalloc include/linux/slab.h:715 [inline]
[<ffffffff82c87a62>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<ffffffff82c91a47>] hub_port_connect drivers/usb/core/hub.c:5260 [inline]
[<ffffffff82c91a47>] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
[<ffffffff82c91a47>] port_event drivers/usb/core/hub.c:5660 [inline]
[<ffffffff82c91a47>] hub_event+0x1097/0x21a0 drivers/usb/core/hub.c:5742
[<ffffffff8126c3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
[<ffffffff8126ccd9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
[<ffffffff81276765>] kthread+0x125/0x160 kernel/kthread.c:377
[<ffffffff810022ff>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
BUG: memory leak
unreferenced object 0xffff88810f5bd660 (size 32):
comm "kworker/1:1", pid 25, jiffies 4294954629 (age 16.460s)
hex dump (first 32 bytes):
31 2d 31 00 00 00 00 00 00 00 00 00 00 00 00 00 1-1.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff822cae8c>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<ffffffff822caf68>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<ffffffff823c074b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<ffffffff826ae353>] dev_set_name+0x63/0x90 drivers/base/core.c:3193
[<ffffffff82c87c20>] usb_alloc_dev+0x1f0/0x450 drivers/usb/core/usb.c:650
[<ffffffff82c91a47>] hub_port_connect drivers/usb/core/hub.c:5260 [inline]
[<ffffffff82c91a47>] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
[<ffffffff82c91a47>] port_event drivers/usb/core/hub.c:5660 [inline]
[<ffffffff82c91a47>] hub_event+0x1097/0x21a0 drivers/usb/core/hub.c:5742
[<ffffffff8126c3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
[<ffffffff8126ccd9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
[<ffffffff81276765>] kthread+0x125/0x160 kernel/kthread.c:377
[<ffffffff810022ff>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
BUG: memory leak
unreferenced object 0xffff888109944200 (size 256):
comm "kworker/1:1", pid 25, jiffies 4294954683 (age 15.920s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 42 94 09 81 88 ff ff .........B......
08 42 94 09 81 88 ff ff f0 e3 6a 82 ff ff ff ff .B........j.....
backtrace:
[<ffffffff826b3d9b>] kmalloc include/linux/slab.h:581 [inline]
[<ffffffff826b3d9b>] kzalloc include/linux/slab.h:715 [inline]
[<ffffffff826b3d9b>] device_private_init drivers/base/core.c:3249 [inline]
[<ffffffff826b3d9b>] device_add+0x89b/0xdf0 drivers/base/core.c:3299
[<ffffffff8439de0c>] usb_new_device.cold+0x10f/0x58e drivers/usb/core/hub.c:2566
[<ffffffff82c91d14>] hub_port_connect drivers/usb/core/hub.c:5358 [inline]
[<ffffffff82c91d14>] hub_port_connect_change drivers/usb/core/hub.c:5502 [inline]
[<ffffffff82c91d14>] port_event drivers/usb/core/hub.c:5660 [inline]
[<ffffffff82c91d14>] hub_event+0x1364/0x21a0 drivers/usb/core/hub.c:5742
[<ffffffff8126c3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
[<ffffffff8126ccd9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
[<ffffffff81276765>] kthread+0x125/0x160 kernel/kthread.c:377
[<ffffffff810022ff>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
next reply other threads:[~2022-02-11 20:17 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-11 20:17 syzbot [this message]
2022-02-11 21:23 ` [syzbot] memory leak in hub_event (3) Alan Stern
2022-02-11 21:36 ` syzbot
2022-02-12 1:50 ` [PATCH] HID: elo: Fix refcount leak in elo_probe() Alan Stern
2022-02-14 7:34 ` Dongliang Mu
2022-02-14 14:41 ` Alan Stern
2022-02-17 8:04 ` Dan Carpenter
2022-02-17 8:19 ` Dan Carpenter
2022-02-17 13:21 ` Jiri Kosina
2022-02-17 15:25 ` Alan Stern
2022-02-25 9:15 ` Greg KH
2022-02-25 14:38 ` [PATCH] USB: core: Update kerneldoc for usb_get_dev() and usb_get_intf() Alan Stern
2022-03-12 9:39 ` [PATCH] HID: elo: Fix refcount leak in elo_probe() Dongliang Mu
2022-03-12 14:59 ` Alan Stern
2022-02-17 7:54 ` Dan Carpenter
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000005cacef05d7c3c10d@google.com \
--to=syzbot+8caaaec4e7a55d75e243@syzkaller.appspotmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=noralf@tronnes.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.