[syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    0bb80ecc33a8 Linux 6.6-rc1
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10a8aad8680000
kernel config:  https://syzkaller.appspot.com/x/.config?x=99ce3535087fc27
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=163a9e30680000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14fcd4a0680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce21ae500663/disk-0bb80ecc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d2f34908198/vmlinux-0bb80ecc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9c6f5eecda20/bzImage-0bb80ecc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888101230c00 (size 1024):
  comm "syz-executor201", pid 5036, jiffies 4294942174 (age 8.190s)
  hex dump (first 32 bytes):
    00 78 0f 11 81 88 ff ff 00 00 00 00 00 00 00 00  .x..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
    [<ffffffff827ec407>] kmalloc include/linux/slab.h:599 [inline]
    [<ffffffff827ec407>] kzalloc include/linux/slab.h:720 [inline]
    [<ffffffff827ec407>] gsm_dlci_alloc+0x27/0x1f0 drivers/tty/n_gsm.c:2640
    [<ffffffff827ec5ec>] gsm_activate_mux+0x1c/0x1c0 drivers/tty/n_gsm.c:3129
    [<ffffffff827f310f>] gsm_config_ext drivers/tty/n_gsm.c:3434 [inline]
    [<ffffffff827f310f>] gsmld_ioctl+0x6cf/0x9f0 drivers/tty/n_gsm.c:3798
    [<ffffffff827d7bbb>] tty_ioctl+0x3eb/0xc70 drivers/tty/tty_io.c:2785
    [<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
    [<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
    [<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
    [<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff888104f38000 (size 4096):
  comm "syz-executor201", pid 5036, jiffies 4294942174 (age 8.190s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815742ab>] __do_kmalloc_node mm/slab_common.c:1022 [inline]
    [<ffffffff815742ab>] __kmalloc+0x4b/0x150 mm/slab_common.c:1036
    [<ffffffff824f9f89>] kmalloc_array include/linux/slab.h:636 [inline]
    [<ffffffff824f9f89>] __kfifo_alloc+0x89/0xe0 lib/kfifo.c:43
    [<ffffffff827ec451>] gsm_dlci_alloc+0x71/0x1f0 drivers/tty/n_gsm.c:2645
    [<ffffffff827ec5ec>] gsm_activate_mux+0x1c/0x1c0 drivers/tty/n_gsm.c:3129
    [<ffffffff827f310f>] gsm_config_ext drivers/tty/n_gsm.c:3434 [inline]
    [<ffffffff827f310f>] gsmld_ioctl+0x6cf/0x9f0 drivers/tty/n_gsm.c:3798
    [<ffffffff827d7bbb>] tty_ioctl+0x3eb/0xc70 drivers/tty/tty_io.c:2785
    [<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
    [<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
    [<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
    [<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
    [<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Fri, Sep 15, 2023 at 07:23:24PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <eadavis@sina.com>
> ---
>  drivers/tty/n_gsm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

This message never made it to lore.kernel.org, so you might need to fix
up your email system so that it doesn't get dropped from there.

Can you do so and resend?

thanks,

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Mon, Sep 18, 2023 at 04:45:26PM +0800, Edward AD wrote:
> On Mon, 18 Sep 2023 10:06:58 +0200, Greg KH wrote:
> > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > requested in gsm_dlci_alloc().
> > >
> > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > Signed-off-by: Edward AD <eadavis@sina.com>
> > > ---
> > >  drivers/tty/n_gsm.c | 4 +++-
> > >  1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > This message never made it to lore.kernel.org, so you might need to fix
> > up your email system so that it doesn't get dropped from there.
> This matter has been bothering me all along. I don't know why, some of the 
> patch emails I sent can be quickly responded to by "lore. kernel. org" correctly, 
> while others cannot. It wasn't until someone like you replied that I could see the 
> patches I sent.
> > 
> > Can you do so and resend?
> Yes, I can.
> However, it may take a long time as I currently do not know how to set up my email 
> system to avoid such issues from occurring.

Look at the tool `patatt`, it's what we use in `b4` to verify emails are
correct and sent by whom they say they are sent by.

Yours fail the checks by that tool, so try sending yourself an email and
work from there.

good luck!

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Mon, Sep 18, 2023 at 06:48:36PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <eadavis@sina.com>
> ---
>  drivers/tty/n_gsm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)


Still failing to show up on lore.kernel.org, are you sure that your
email infrastructure is correct?

I see this header on this email message:

Authentication-Results: sina.com;
        spf=none smtp.mailfrom=eadavis@sina.com;
        dkim=none header.i=none;
        dmarc=none action=none header.from=eadavis@sina.com

So something really doesn't like your domain's emails :(

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Tue, Sep 19, 2023 at 11:45:25AM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <eadavis@sina.com>
> ---
>  drivers/tty/n_gsm.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)

<snip>

You sent 5 of these, all identical, all rejected by lore.kernel.org, are
you sure your email servers are not on some spam blacklist somewhere?

greg k-h

[PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
Signed-off-by: Edward AD <twuufnxlz@gmail.com>
---
 drivers/tty/n_gsm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index b3550ff9c494..df9bb87652b0 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3136,8 +3136,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
 		gsm->receive = gsm1_receive;
 
 	ret = gsm_register_devices(gsm_tty_driver, gsm->num);
-	if (ret)
+	if (ret) {
+		gsm_dlci_free(&dlci->port);
 		return ret;
+	}
 
 	gsm->has_devices = true;
 	gsm->dead = false;		/* Tty opens are now permissible */
-- 
2.25.1

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Tue, Sep 19, 2023 at 04:02:08PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
> 
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <twuufnxlz@gmail.com>

Please use your company name/email address, and then just set a manual
"From:" line as the first line in the changelog as the documentation
asks.  That's how developers work around their broken corporate email
systems (but really, you should go and poke your IT group to fix it.)

thanks,

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > requested in gsm_dlci_alloc().
> >
> > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> 
> Please use your company name/email address, and then just set a manual
> "From:" line as the first line in the changelog as the documentation
> asks.  That's how developers work around their broken corporate email
> systems (but really, you should go and poke your IT group to fix it.)
This repair was completed in my personal time. Additionally, there may be a 
possibility of the company's email being thrown away by 'lore.kernel.org'. 
If you are not very strict with this, I will continue to use my private email.

I will only keep one line starting with 'From:' in the patch.

Thanks,
edward

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Greg KH]

On Tue, Sep 19, 2023 at 05:22:26PM +0800, Edward AD wrote:
> On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > requested in gsm_dlci_alloc().
> > >
> > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> > 
> > Please use your company name/email address, and then just set a manual
> > "From:" line as the first line in the changelog as the documentation
> > asks.  That's how developers work around their broken corporate email
> > systems (but really, you should go and poke your IT group to fix it.)
> This repair was completed in my personal time. Additionally, there may be a 
> possibility of the company's email being thrown away by 'lore.kernel.org'. 
> If you are not very strict with this, I will continue to use my private email.

As you previously submitted this under your company name/address, we
have to be strict for obvious reasons, sorry.

> I will only keep one line starting with 'From:' in the patch.

I don't understand what you mean by this.

greg k-h

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

On Tue, 19 Sep 2023 11:31:57 +0200 Greg KH wrote:
> > On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > > requested in gsm_dlci_alloc().
> > > >
> > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> > >
> > > Please use your company name/email address, and then just set a manual
> > > "From:" line as the first line in the changelog as the documentation
> > > asks.  That's how developers work around their broken corporate email
> > > systems (but really, you should go and poke your IT group to fix it.)
> > This repair was completed in my personal time. Additionally, there may be a
> > possibility of the company's email being thrown away by 'lore.kernel.org'.
> > If you are not very strict with this, I will continue to use my private email.
> 
> As you previously submitted this under your company name/address, we
> have to be strict for obvious reasons, sorry.
The two email addresses I used before these are all my personal emails.
> 
> > I will only keep one line starting with 'From:' in the patch.
> 
> I don't understand what you mean by this.
Just set a manual "From:" line as the first line in the changelog as the 
documentation asks.

Thanks,
edward

Re: [PATCH] tty: fix memory leak in gsm_activate_mux

[Edward AD]

On Tue, 19 Sep 2023 11:31:57 +0200 Greg KH wrote:
> > On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > > requested in gsm_dlci_alloc().
> > > >
> > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > > Reported-and-tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
> > > > Signed-off-by: Edward AD <twuufnxlz@gmail.com>
> > >
> > > Please use your company name/email address, and then just set a manual
> > > "From:" line as the first line in the changelog as the documentation
> > > asks.  That's how developers work around their broken corporate email
> > > systems (but really, you should go and poke your IT group to fix it.)
> > This repair was completed in my personal time. Additionally, there may be a
> > possibility of the company's email being thrown away by 'lore.kernel.org'.
> > If you are not very strict with this, I will continue to use my private email.
> 
> As you previously submitted this under your company name/address, we
> have to be strict for obvious reasons, sorry.
Before sending this email, according to your reply, I sent a new patch via email eadavis@sina.com.
But we can't see that email in lore.kernel.org
> 
> > I will only keep one line starting with 'From:' in the patch.
> 
> I don't understand what you mean by this.
Just set a manual "From:" line as the first line in the changelog as the 
documentation asks.

Thanks,
edward

Forwarded: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda
Author: dmantipov@yandex.ru

#syz test 
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 
8cdeaa50eae8dad34885515f62559ee83e7e8dda

Forwarded: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda
Author: dmantipov@yandex.ru

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda

[PATCH] tty: n_gsm: fix memory leak in gsm_activate_mux

[Minu Jin]

I found a memory leak in gsm_activate_mux() from the syzbot dashboard.
I have analyzed the root cause and created a fix.
Please test the following patch.

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tty-next

---
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index c13e050de83b..de3d30eac86e 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2645,7 +2645,12 @@ static int gsm_dlci_config(struct gsm_dlci *dlci, struct gsm_dlci_config *dc, in

 static struct gsm_dlci *gsm_dlci_alloc(struct gsm_mux *gsm, int addr)
 {
-       struct gsm_dlci *dlci = kzalloc_obj(struct gsm_dlci, GFP_ATOMIC);
+       struct gsm_dlci *dlci;
+
+       if (gsm->dlci[addr])
+               return gsm->dlci[addr];
+
+       dlci = kzalloc_obj(struct gsm_dlci, GFP_ATOMIC);
        if (dlci == NULL)
                return NULL;
        spin_lock_init(&dlci->lock);
@@ -3196,8 +3201,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
                gsm->receive = gsm1_receive;

        ret = gsm_register_devices(gsm_tty_driver, gsm->num);
-       if (ret)
+       if (ret) {
+               gsm_dlci_free(&dlci->port);
                return ret;
+       }

        gsm->has_devices = true;
        gsm->dead = false;              /* Tty opens are now permissible */

Re: [syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
Tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com

Tested on:

commit:         6596a02b Merge tag 'drm-next-2026-04-22' of https://gi..
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tty-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17b574ce580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=943968b43250a7da
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1117ac36580000

Note: testing is done by a robot and is best-effort only.

Re: [syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in gsm_activate_mux

BUG: memory leak
unreferenced object 0xffff8881035efc00 (size 1024):
  comm "syz-executor.0", pid 5304, jiffies 4294943119
  hex dump (first 32 bytes):
    00 0c 9c 08 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc c142557c):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4625 [inline]
    slab_alloc_node mm/slub.c:4945 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5511
    _kmalloc_noprof include/linux/slab.h:969 [inline]
    _kzalloc_noprof include/linux/slab.h:1290 [inline]
    gsm_dlci_alloc+0x29/0x1b0 drivers/tty/n_gsm.c:2648
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x5f/0x580 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

BUG: memory leak
unreferenced object 0xffff888109829c00 (size 1024):
  comm "syz-executor.0", pid 5396, jiffies 4294943679
  hex dump (first 32 bytes):
    00 ec 2f 03 81 88 ff ff 00 00 00 00 00 00 00 00  ../.............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 2f81146e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4625 [inline]
    slab_alloc_node mm/slub.c:4945 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5511
    _kmalloc_noprof include/linux/slab.h:969 [inline]
    _kzalloc_noprof include/linux/slab.h:1290 [inline]
    gsm_dlci_alloc+0x29/0x1b0 drivers/tty/n_gsm.c:2648
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0x5f/0x580 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x76/0x7e



Tested on:

commit:         8cdeaa50 Linux 7.2-rc2
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16c82b39580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=83d5b4d9fb5a5039
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

Note: no patches were applied.

Re: [syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
Tested-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com

Tested on:

commit:         8cdeaa50 Linux 7.2-rc2
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=11783832580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=83d5b4d9fb5a5039
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch:          https://syzkaller.appspot.com/x/patch.diff?x=16e13546580000

Note: testing is done by a robot and is best-effort only.