From: Greg KH <gregkh@linuxfoundation.org>
To: Ertza Warraich <ertza.afzal@gmail.com>
Cc: balbi@kernel.org, sorganov@gmail.com, mirq-linux@rere.qmqm.pl,
fabrice.gasnier@st.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org, kt0755@gmail.com,
dave.jing.tian@gmail.com
Subject: Re: memory leak in gs_start_io
Date: Wed, 2 Dec 2020 06:42:19 +0100 [thread overview]
Message-ID: <X8cpO9caQCX6XGU9@kroah.com> (raw)
In-Reply-To: <CAD+hOzs6To=P7z=fYNLDHW-9ZksnykJW2cAWCCVhUGne5C21iA@mail.gmail.com>
On Tue, Dec 01, 2020 at 11:45:20PM -0500, Ertza Warraich wrote:
> We report a memory leak bug (in linux-5.8.13) found by FuzzUSB (a modified
> version of syzkaller).
>
> The bug report is as follows:
> ==================================================================
> BUG: memory leak
> unreferenced object 0xffff888069c12000 (size 128):
> comm "c4_fuzz", pid 2628, jiffies 4294945547 (age 774.450s)
> hex dump (first 32 bytes):
> b8 80 48 65 80 88 ff ff 00 7c f9 5b 80 88 ff ff ..He.....|.[....
> 00 7c af 64 80 88 ff ff 00 02 00 00 00 00 00 00 .|.d............
> backtrace:
> [<000000008f105b01>] kmemleak_alloc_recursive include/linux/kmemleak.h:43
> [inline]
> [<000000008f105b01>] slab_post_alloc_hook mm/slab.h:588 [inline]
> [<000000008f105b01>] slab_alloc_node mm/slub.c:2824 [inline]
> [<000000008f105b01>] slab_alloc mm/slub.c:2832 [inline]
> [<000000008f105b01>] kmem_cache_alloc_trace+0xfe/0x330 mm/slub.c:2849
> [<0000000081072efc>] kmalloc include/linux/slab.h:555 [inline]
> [<0000000081072efc>] kzalloc include/linux/slab.h:669 [inline]
> [<0000000081072efc>] dummy_alloc_request+0xa0/0x190
> drivers/usb/gadget/udc/dummy_hcd.c:663
> [<00000000b14438ed>] usb_ep_alloc_request+0x65/0x2c0
> drivers/usb/gadget/udc/core.c:178
> [<000000006b6ab221>] gs_alloc_req+0x28/0xd0
> drivers/usb/gadget/function/u_serial.c:166
> [<00000000999f9b54>] gs_alloc_requests+0x207/0x2f0
> drivers/usb/gadget/function/u_serial.c:517
> [<00000000eae934b0>] gs_start_io+0x134/0x2a0
> drivers/usb/gadget/function/u_serial.c:555
> [<00000000eec10774>] gs_open+0x323/0x440
> drivers/usb/gadget/function/u_serial.c:640
> [<00000000c27493c6>] tty_open+0x23c/0x870 drivers/tty/tty_io.c:2048
> [<0000000001954030>] chrdev_open+0x1e9/0x5b0 fs/char_dev.c:414
> [<000000002321ec1f>] do_dentry_open+0x434/0xf40 fs/open.c:828
> [<000000000de9bc50>] vfs_open+0x9a/0xc0 fs/open.c:942
> [<00000000b1e25f2d>] do_open fs/namei.c:3243 [inline]
> [<00000000b1e25f2d>] path_openat+0x1658/0x2570 fs/namei.c:3360
> [<00000000b7cea3b5>] do_filp_open+0x15e/0x210 fs/namei.c:3387
> [<00000000793cea2f>] do_sys_openat2+0x2e0/0x570 fs/open.c:1179
> [<0000000067f289f1>] do_sys_open+0x88/0xc0 fs/open.c:1195
> [<00000000937c31df>] ksys_open include/linux/syscalls.h:1388 [inline]
> [<00000000937c31df>] __do_sys_open fs/open.c:1201 [inline]
> [<00000000937c31df>] __se_sys_open fs/open.c:1199 [inline]
> [<00000000937c31df>] __x64_sys_open+0x79/0xb0 fs/open.c:1199
> ==================================================================
Nice, care to make up a fix for this now that you have a reproducer?
thanks,
greg k-h
parent reply other threads:[~2020-12-02 5:43 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <CAD+hOzs6To=P7z=fYNLDHW-9ZksnykJW2cAWCCVhUGne5C21iA@mail.gmail.com>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=X8cpO9caQCX6XGU9@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=balbi@kernel.org \
--cc=dave.jing.tian@gmail.com \
--cc=ertza.afzal@gmail.com \
--cc=fabrice.gasnier@st.com \
--cc=kt0755@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=mirq-linux@rere.qmqm.pl \
--cc=sorganov@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®