From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S2992588AbcB0VUZ (ORCPT <rfc822;w@1wt.eu>);
	Sat, 27 Feb 2016 16:20:25 -0500
Received: from lb1-smtp-cloud3.xs4all.net ([194.109.24.22]:39297 "EHLO
	lb1-smtp-cloud3.xs4all.net" rhost-flags-OK-OK-OK-OK)
	by vger.kernel.org with ESMTP id S1755826AbcB0VUY (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Sat, 27 Feb 2016 16:20:24 -0500
Message-ID: <1456608019.2651.20.camel@tiscali.nl>
Subject: Re: tty: memory leak in tty_register_driver
From: Paul Bolle <pebolle@tiscali.nl>
To: Dmitry Vyukov <dvyukov@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Jiri Slaby <jslaby@suse.com>, LKML <linux-kernel@vger.kernel.org>,
        Peter Hurley <peter@hurleysoftware.com>,
        One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>,
        J Freyensee <james_p_freyensee@linux.intel.com>,
        Alexander Potapenko <glider@google.com>,
        Kostya Serebryany <kcc@google.com>,
        Sasha Levin <sasha.levin@oracle.com>,
        syzkaller <syzkaller@googlegroups.com>
Date: Sat, 27 Feb 2016 22:20:19 +0100
In-Reply-To: <CACT4Y+a-MEdAj4Dr7tqD6EEuD4KsrhOqyk+-m+Uq9+aao9rmfg@mail.gmail.com>
References: <CACT4Y+bZticikTpnc0djxRBLCWhj=2DqQk=KRf5zDvrLdHzEbQ@mail.gmail.com>
	 <1455835549.2379.31.camel@tiscali.nl>
	 <CACT4Y+a-MEdAj4Dr7tqD6EEuD4KsrhOqyk+-m+Uq9+aao9rmfg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.16.5 (3.16.5-3.fc22) 
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

(I was AFK this week. So my reply is a bit late.)

On ma, 2016-02-22 at 10:53 +0100, Dmitry Vyukov wrote:
> On Thu, Feb 18, 2016 at 11:45 PM, Paul Bolle <pebolle@tiscali.nl>
> > Fascinating issue. Makes zero sense to me. sysfs_init? Anyhow, since
> > the
> > people actually familiar with this code have stayed silent until
> > now, I
> > have some obvious questions:
> > - does this only trigger with line discipline N_GSM0710?
> > - is this a new issue or do older trees also trigger it (in other
> >   words: have you tried bisecting this)?
> 
> I can say that it does not happen with 1, 2, 3, 4 and 7.

Side note: 4 (N_STRIP) is unused. As are 8 (N_MASC), 10
(N_PROFIBUS_FDL), and 12 (N_SMSBLOCK). So you could as well skip these
for syzkaller's tests.

> So there are
> chances that it is N_GSM0710-specific. 5 and 6 trigger lots of leaks,
> but they are different. I did not try to bisect it.

I've looked into this the previous week (because your reproducer
resembled the code that triggered the recent N_GIGASET_M101 leak). I was
unable to reproduce the issue myself. And, as far as I can remember now,
N_GSM0710's open() operation is rather non-trivial. So I soon gave up on
hoping to find a leak or any other obvious issue by, well, reviewing the
code involved. Sorry about that.

Thanks,


Paul Bolle