netdev.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* gigaset: memory leak in gigaset_initcshw
@ 2016-02-03 15:31 Dmitry Vyukov
  2016-02-03 16:16 ` Paul Bolle
  0 siblings, 1 reply; 15+ messages in thread
From: Dmitry Vyukov @ 2016-02-03 15:31 UTC (permalink / raw)
  To: Paul Bolle, Karsten Keil, David S. Miller, gigaset307x-common,
	netdev, LKML
  Cc: syzkaller, Kostya Serebryany, Alexander Potapenko, Sasha Levin

Hello,

The following program causes a memory leak of ser_cardstate object
allocated in gigaset_initcshw:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <pthread.h>
#include <stdint.h>
#include <string.h>
#include <sys/syscall.h>
#include <unistd.h>

int main()
{
  long r[7];
  memset(r, -1, sizeof(r));
  r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
                 0xfffffffffffffffful, 0x0ul);
  r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0);
  *(uint32_t*)0x20002b1e = (uint32_t)0x10;
  r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0);
  *(uint32_t*)0x20009000 = (uint32_t)0x7;
  r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0);
  return 0;
}

unreferenced object 0xffff88002b4109d8 (size 2048):
  comm "a.out", pid 9565, jiffies 4301785161 (age 10.646s)
  hex dump (first 32 bytes):
    e0 30 0a 87 ff ff ff ff 00 00 00 00 00 00 00 00  .0..............
    80 af 0d 88 ff ff ff ff 88 08 5e 00 00 88 ff ff  ..........^.....
  backtrace:
    [<     inline     >] kzalloc include/linux/slab.h:607
    [<ffffffff84bfbeab>] gigaset_initcshw+0x4b/0x2b0
drivers/isdn/gigaset/ser-gigaset.c:394
    [<ffffffff84bb1e22>] gigaset_initcs+0xf82/0x1660
drivers/isdn/gigaset/common.c:748
    [<ffffffff84bfb65b>] gigaset_tty_open+0x9b/0x460
drivers/isdn/gigaset/ser-gigaset.c:516
    [<ffffffff82f9a648>] tty_ldisc_open.isra.2+0x78/0xd0
drivers/tty/tty_ldisc.c:454
    [<ffffffff82f9ac32>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561
    [<     inline     >] tiocsetd drivers/tty/tty_io.c:2656
    [<ffffffff82f8390e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2911
    [<     inline     >] vfs_ioctl fs/ioctl.c:43
    [<ffffffff817fa9ec>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674
    [<     inline     >] SYSC_ioctl fs/ioctl.c:689
    [<ffffffff817fb89f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680
    [<ffffffff8665ebb6>] entry_SYSCALL_64_fastpath+0x16/0x7a
arch/x86/entry/entry_64.S:185

On commit 34229b277480f46c1e9a19f027f30b074512e68b.

^ permalink raw reply	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2016-02-11 22:54 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-02-03 15:31 gigaset: memory leak in gigaset_initcshw Dmitry Vyukov
2016-02-03 16:16 ` Paul Bolle
2016-02-03 19:11   ` Paul Bolle
2016-02-04 10:40     ` Dmitry Vyukov
2016-02-04 13:09       ` Paul Bolle
2016-02-04 13:15         ` Dmitry Vyukov
2016-02-04 13:46           ` Paul Bolle
2016-02-04 14:54             ` Dmitry Vyukov
2016-02-04 15:06               ` Paul Bolle
2016-02-05 13:28                 ` Dmitry Vyukov
2016-02-05 16:06                   ` Paul Bolle
2016-02-05 18:36                     ` Paul Bolle
2016-02-05 21:25                       ` Dmitry Vyukov
2016-02-11 22:34                         ` Paul Bolle
2016-02-11 22:54                     ` Paul Bolle

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).