Messages in this thread | | | From | Dmitry Vyukov <> | Date | Mon, 4 Apr 2016 10:56:18 +0200 | Subject | tty: memory leak in tty_open |
| |
Hello,
The following program causes a memory leak:
unreferenced object 0xffff8800643c3168 (size 2048): comm "syz-executor", pid 29328, jiffies 4295358628 (age 32.380s) hex dump (first 32 bytes): 01 54 00 00 0c 00 00 00 88 27 e1 67 00 88 ff ff .T.......'.g.... 88 1f 54 68 00 88 ff ff 40 b1 f0 86 ff ff ff ff ..Th....@....... backtrace: [<ffffffff86798093>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:915 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slab.h:406 [< inline >] slab_alloc_node mm/slub.c:2602 [< inline >] slab_alloc mm/slub.c:2610 [<ffffffff817979a0>] kmem_cache_alloc_trace+0x160/0x3d0 mm/slub.c:2627 [< inline >] kmalloc include/linux/slab.h:478 [< inline >] kzalloc include/linux/slab.h:622 [<ffffffff8304a748>] alloc_tty_struct+0x98/0x840 drivers/tty/tty_io.c:3156 [<ffffffff8304af68>] tty_init_dev+0x78/0x4b0 drivers/tty/tty_io.c:1532 [< inline >] tty_open_by_driver drivers/tty/tty_io.c:2066 [<ffffffff8304c181>] tty_open+0xde1/0x1140 drivers/tty/tty_io.c:2114 [<ffffffff81801fca>] chrdev_open+0x22a/0x4c0 fs/char_dev.c:388 [<ffffffff817ed6a2>] do_dentry_open+0x6a2/0xcb0 fs/open.c:736 [<ffffffff817f0d7b>] vfs_open+0x17b/0x1f0 fs/open.c:853 [< inline >] do_last fs/namei.c:3238 [<ffffffff8182961b>] path_openat+0x51bb/0x5ce0 fs/namei.c:3374 [<ffffffff8182d7be>] do_filp_open+0x18e/0x250 fs/namei.c:3409 [<ffffffff817f14fc>] do_sys_open+0x1fc/0x420 fs/open.c:1020 [< inline >] SYSC_open fs/open.c:1038 [<ffffffff817f174d>] SyS_open+0x2d/0x40 fs/open.c:1033
// autogenerated by syzkaller (http://github.com/google/syzkaller) #include <pthread.h> #include <sys/syscall.h> #include <unistd.h>
void* thr(void* arg) { syscall(SYS_open, "/dev/console", 0, 0, 0, 0); return 0; }
int main() { int i; pthread_t th[4];
for (i = 0; i < 4; i++) pthread_create(&th[i], 0, thr, 0); usleep(100); return 0; }
On commit 05cf8077e54b20dddb756eaa26f3aeb5c38dd3cf (Apr 1).
| |