lkml.org 
[lkml]   [2024]   [Mar]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
Subject[Linux Kernel Bug] memory leak in dvb_dvr_do_ioctl
Dear Linux Developers for DVB,

We encountered "memory leak in dvb_dvr_do_ioctl" when testing the
DVB driver with Syzkaller and our generated specifications.

The C reproducer and the config for the kernel are attached.

```
BUG: memory leak
unreferenced object 0xffffc9000ae81000 (size 4096):
comm "syz-executor.0", pid 23888, jiffies 4295016268 (age 8.980s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8541ee5e>] create_object mm/kmemleak.c:761 [inline]
[<ffffffff8541ee5e>] kmemleak_vmalloc+0x2e/0x90 mm/kmemleak.c:1082
[<ffffffff816382f6>] __vmalloc_node_range+0xc76/0xdb0 mm/vmalloc.c:3348
[<ffffffff816386c2>] __vmalloc_node mm/vmalloc.c:3385 [inline]
[<ffffffff816386c2>] vmalloc+0x52/0x60 mm/vmalloc.c:3418
[<ffffffff83db1c8c>] dvb_dvr_set_buffer_size
drivers/media/dvb-core/dmxdev.c:293 [inline]
[<ffffffff83db1c8c>] dvb_dvr_do_ioctl+0x12c/0x2a0
drivers/media/dvb-core/dmxdev.c:1296
[<ffffffff83db1252>] dvb_usercopy+0x82/0x220
drivers/media/dvb-core/dvbdev.c:986
[<ffffffff83db1b11>] dvb_dvr_ioctl+0x31/0x40
drivers/media/dvb-core/dmxdev.c:1333
[<ffffffff8171ca88>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff8171ca88>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff8171ca88>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff8171ca88>] __x64_sys_ioctl+0x108/0x150 fs/ioctl.c:857
[<ffffffff8540b150>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff8540b150>] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
[<ffffffff8560008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
```

The memory leak originates from the allocated memory `newmem = vmalloc(size);`,
as referenced in the code at
[https://elixir.bootlin.com/linux/latest/source/drivers/media/dvb-core/dmxdev.c#L293].
Besides, this memory leak is triggered when enabling
`CONFIG_DVB_MMAP=y`, which will be used when freeing the memory in
`dvb_dvr_release`
(https://elixir.bootlin.com/linux/latest/source/drivers/media/dvb-core/dmxdev.c#L214).

If you have any questions or require more information, please feel
free to contact us.

Reported-by: Chenyuan Yang <chenyuan0y@gmail.com>

Best,
Chenyuan
[unhandled content-type:application/octet-stream][unhandled content-type:application/octet-stream]
\
 
 \ /
  Last update: 2024-05-27 15:34    [W:1.233 / U:0.528 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site