Re: memory leak in edge_startup
From: Dmitry Vyukov <dvyukov@google.com>
Date: 2021-03-02 09:21:38
Also in:
lkml
On Tue, Mar 2, 2021 at 9:43 AM Hillf Danton [off-list ref] wrote:
Mon, 01 Mar 2021 11:29:16 -0800quoted
Hello, syzbot found the following issue on: HEAD commit: 29c395c7 Merge tag 'x86-entry-2021-02-24' of git://git.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=10d694dad00000 kernel config: https://syzkaller.appspot.com/x/.config?x=66b7497b2c5acd67 dashboard link: https://syzkaller.appspot.com/bug?extid=59f777bdcbdd7eea5305 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162940dad00000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1650737ad00000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com BUG: memory leak unreferenced object 0xffff88810dc5a800 (size 2048): comm "kworker/1:3", pid 4818, jiffies 4294960503 (age 15.050s) hex dump (first 32 bytes): 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ............... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000153c6b11>] kmalloc include/linux/slab.h:554 [inline] [<00000000153c6b11>] kzalloc include/linux/slab.h:684 [inline] [<00000000153c6b11>] edge_startup+0x3f/0x11f0 drivers/usb/serial/io_edgeport.c:2833 [<000000007c25fa28>] usb_serial_probe.cold+0x6ab/0xb84 drivers/usb/serial/usb-serial.c:1027 [<0000000050250e6f>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<00000000f10f144c>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<0000000036a9ab90>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<00000000a08d4f3b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846 [<000000009356c1ed>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 [<00000000aa8a21fd>] __device_attach+0x122/0x250 drivers/base/dd.c:914 [<00000000ee865ab7>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 [<000000005ea173b6>] device_add+0x5d5/0xc40 drivers/base/core.c:3242 [<000000003faa2805>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164 [<0000000099ff1454>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<00000000a57fa7c3>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<00000000f10f144c>] really_probe+0x159/0x4a0 drivers/base/dd.c:554 [<0000000036a9ab90>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740 [<00000000a08d4f3b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846Fix mm leak by rolling back in case of error.
I think paskripkin is already fixing this, you can see a patch testing request: https://syzkaller.appspot.com/bug?extid=59f777bdcbdd7eea5305 https://groups.google.com/g/syzkaller-bugs/c/PlE-vZm0YJU/m/gzlYOh63BQAJ
quoted hunk
--- x/drivers/usb/serial/io_edgeport.c +++ y/drivers/usb/serial/io_edgeport.c@@ -3003,6 +3003,7 @@ static int edge_startup(struct usb_seria response = -ENODEV; } +error_rsp: usb_free_urb(edge_serial->interrupt_read_urb); kfree(edge_serial->interrupt_in_buffer);@@ -3018,9 +3019,11 @@ static int edge_startup(struct usb_seria * continue as long as the edgeport is connected */ response = usb_submit_urb(edge_serial->interrupt_read_urb, GFP_KERNEL); - if (response) + if (response) { dev_err(ddev, "%s - Error %d submitting control urb\n", __func__, response); + goto error_rsp; + } } return response; } --You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group. To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20210302084313.1520-1-hdanton%40sina.com.