[syzbot] [serial?] memory leak in gsm_activate_mux

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0bb80ecc33a8 Linux 6.6-rc1
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10a8aad8680000
kernel config: https://syzkaller.appspot.com/x/.config?x=99ce3535087fc27
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=163a9e30680000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14fcd4a0680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ce21ae500663/disk-0bb80ecc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d2f34908198/vmlinux-0bb80ecc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9c6f5eecda20/bzImage-0bb80ecc.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b5d1f4...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888101230c00 (size 1024):
comm "syz-executor201", pid 5036, jiffies 4294942174 (age 8.190s)
hex dump (first 32 bytes):
00 78 0f 11 81 88 ff ff 00 00 00 00 00 00 00 00 .x..............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81573b75>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1114
[<ffffffff827ec407>] kmalloc include/linux/slab.h:599 [inline]
[<ffffffff827ec407>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff827ec407>] gsm_dlci_alloc+0x27/0x1f0 drivers/tty/n_gsm.c:2640
[<ffffffff827ec5ec>] gsm_activate_mux+0x1c/0x1c0 drivers/tty/n_gsm.c:3129
[<ffffffff827f310f>] gsm_config_ext drivers/tty/n_gsm.c:3434 [inline]
[<ffffffff827f310f>] gsmld_ioctl+0x6cf/0x9f0 drivers/tty/n_gsm.c:3798
[<ffffffff827d7bbb>] tty_ioctl+0x3eb/0xc70 drivers/tty/tty_io.c:2785
[<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
[<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff888104f38000 (size 4096):
comm "syz-executor201", pid 5036, jiffies 4294942174 (age 8.190s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff815742ab>] __do_kmalloc_node mm/slab_common.c:1022 [inline]
[<ffffffff815742ab>] __kmalloc+0x4b/0x150 mm/slab_common.c:1036
[<ffffffff824f9f89>] kmalloc_array include/linux/slab.h:636 [inline]
[<ffffffff824f9f89>] __kfifo_alloc+0x89/0xe0 lib/kfifo.c:43
[<ffffffff827ec451>] gsm_dlci_alloc+0x71/0x1f0 drivers/tty/n_gsm.c:2645
[<ffffffff827ec5ec>] gsm_activate_mux+0x1c/0x1c0 drivers/tty/n_gsm.c:3129
[<ffffffff827f310f>] gsm_config_ext drivers/tty/n_gsm.c:3434 [inline]
[<ffffffff827f310f>] gsmld_ioctl+0x6cf/0x9f0 drivers/tty/n_gsm.c:3798
[<ffffffff827d7bbb>] tty_ioctl+0x3eb/0xc70 drivers/tty/tty_io.c:2785
[<ffffffff816b25f2>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff816b25f2>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff816b25f2>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff816b25f2>] __x64_sys_ioctl+0xf2/0x140 fs/ioctl.c:857
[<ffffffff84b30008>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84b30008>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[Edward AD]

please test memory leak in gsm

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f97e18a3f2fb

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index b3550ff9c494..a6e2f36e09ff 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3136,8 +3136,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
gsm->receive = gsm1_receive;

ret = gsm_register_devices(gsm_tty_driver, gsm->num);
- if (ret)
+ if (ret) {
+ gsm_dlci_free(dlci->port);
return ret;
+ }

gsm->has_devices = true;
gsm->dead = false; /* Tty opens are now permissible */

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

drivers/tty/n_gsm.c:3114:35: error: incompatible type for argument 1 of 'gsm_dlci_free'


Tested on:

commit: f97e18a3 Merge tag 'gpio-updates-for-v6.6' of git://gi..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=99ce3535087fc27
dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=1601b628680000

[Edward AD]

please test memory leak in gsm

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f97e18a3f2fb

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index b3550ff9c494..a6e2f36e09ff 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3136,8 +3136,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
gsm->receive = gsm1_receive;

ret = gsm_register_devices(gsm_tty_driver, gsm->num);
- if (ret)
+ if (ret) {

+ gsm_dlci_free(&dlci->port);

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com

Tested on:

commit: f97e18a3 Merge tag 'gpio-updates-for-v6.6' of git://gi..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

console output: https://syzkaller.appspot.com/x/log.txt?x=127fd272680000
kernel config: https://syzkaller.appspot.com/x/.config?x=7df84e6e0481ff61

dashboard link: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=140308b0680000

Note: testing is done by a robot and is best-effort only.

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index b3550ff9c494..df9bb87652b0 100644

--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3136,8 +3136,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
gsm->receive = gsm1_receive;

ret = gsm_register_devices(gsm_tty_driver, gsm->num);
- if (ret)
+ if (ret) {
+ gsm_dlci_free(&dlci->port);
return ret;
+ }

gsm->has_devices = true;
gsm->dead = false; /* Tty opens are now permissible */

--
2.25.1

[Greg KH]

On Fri, Sep 15, 2023 at 07:23:24PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
>
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <ead...@sina.com>
> ---
> drivers/tty/n_gsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

This message never made it to lore.kernel.org, so you might need to fix
up your email system so that it doesn't get dropped from there.

Can you do so and resend?

thanks,

greg k-h

[Edward AD]

On Mon, 18 Sep 2023 10:06:58 +0200, Greg KH wrote:
> > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > requested in gsm_dlci_alloc().
> >
> > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> > Signed-off-by: Edward AD <ead...@sina.com>
> > ---
> > drivers/tty/n_gsm.c | 4 +++-
> > 1 file changed, 3 insertions(+), 1 deletion(-)
>
> This message never made it to lore.kernel.org, so you might need to fix
> up your email system so that it doesn't get dropped from there.

This matter has been bothering me all along. I don't know why, some of the
patch emails I sent can be quickly responded to by "lore. kernel. org" correctly,
while others cannot. It wasn't until someone like you replied that I could see the
patches I sent.

>
> Can you do so and resend?

Yes, I can.
However, it may take a long time as I currently do not know how to set up my email
system to avoid such issues from occurring.
>
> thanks,
>
> greg k-h

Thanks,
edward ad

[Greg KH]

Look at the tool `patatt`, it's what we use in `b4` to verify emails are
correct and sent by whom they say they are sent by.

Yours fail the checks by that tool, so try sending yourself an email and
work from there.

good luck!

greg k-h

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Greg KH]

On Mon, Sep 18, 2023 at 06:48:36PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
>
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <ead...@sina.com>
> ---
> drivers/tty/n_gsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

Still failing to show up on lore.kernel.org, are you sure that your
email infrastructure is correct?

I see this header on this email message:

Authentication-Results: sina.com;
spf=none smtp.mailfrom=ead...@sina.com;
dkim=none header.i=none;
dmarc=none action=none header.from=ead...@sina.com

So something really doesn't like your domain's emails :(

greg k-h

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
Signed-off-by: Edward AD <ead...@sina.com>
---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Greg KH]

On Tue, Sep 19, 2023 at 11:45:25AM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
>
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> Signed-off-by: Edward AD <ead...@sina.com>
> ---
> drivers/tty/n_gsm.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)

<snip>

You sent 5 of these, all identical, all rejected by lore.kernel.org, are
you sure your email servers are not on some spam blacklist somewhere?

greg k-h

[Greg KH]

On Tue, Sep 19, 2023 at 04:02:08PM +0800, Edward AD wrote:
> When the call to gsm_register_devices() fails, we need to reclaim the memory
> requested in gsm_dlci_alloc().
>
> Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com

> Signed-off-by: Edward AD <twuu...@gmail.com>

Please use your company name/email address, and then just set a manual
"From:" line as the first line in the changelog as the documentation
asks. That's how developers work around their broken corporate email
systems (but really, you should go and poke your IT group to fix it.)

thanks,

greg k-h

[Greg KH]

On Tue, Sep 19, 2023 at 05:22:26PM +0800, Edward AD wrote:

> On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > requested in gsm_dlci_alloc().
> > >
> > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> > > Signed-off-by: Edward AD <twuu...@gmail.com>
> >
> > Please use your company name/email address, and then just set a manual
> > "From:" line as the first line in the changelog as the documentation
> > asks. That's how developers work around their broken corporate email
> > systems (but really, you should go and poke your IT group to fix it.)

> This repair was completed in my personal time. Additionally, there may be a
> possibility of the company's email being thrown away by 'lore.kernel.org'.
> If you are not very strict with this, I will continue to use my private email.

As you previously submitted this under your company name/address, we
have to be strict for obvious reasons, sorry.

> I will only keep one line starting with 'From:' in the patch.

I don't understand what you mean by this.

greg k-h

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com

Signed-off-by: Edward AD <twuu...@gmail.com>

---
drivers/tty/n_gsm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

[Edward AD]

On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > requested in gsm_dlci_alloc().
> >
> > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> > Signed-off-by: Edward AD <twuu...@gmail.com>
>
> Please use your company name/email address, and then just set a manual
> "From:" line as the first line in the changelog as the documentation
> asks. That's how developers work around their broken corporate email
> systems (but really, you should go and poke your IT group to fix it.)

This repair was completed in my personal time. Additionally, there may be a
possibility of the company's email being thrown away by 'lore.kernel.org'.
If you are not very strict with this, I will continue to use my private email.

I will only keep one line starting with 'From:' in the patch.

Thanks,
edward

[Edward AD]

On Tue, 19 Sep 2023 11:31:57 +0200 Greg KH wrote:
> > On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > > requested in gsm_dlci_alloc().
> > > >
> > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > > Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> > > > Signed-off-by: Edward AD <twuu...@gmail.com>
> > >
> > > Please use your company name/email address, and then just set a manual
> > > "From:" line as the first line in the changelog as the documentation
> > > asks. That's how developers work around their broken corporate email
> > > systems (but really, you should go and poke your IT group to fix it.)
> > This repair was completed in my personal time. Additionally, there may be a
> > possibility of the company's email being thrown away by 'lore.kernel.org'.
> > If you are not very strict with this, I will continue to use my private email.
>
> As you previously submitted this under your company name/address, we
> have to be strict for obvious reasons, sorry.

The two email addresses I used before these are all my personal emails.

>
> > I will only keep one line starting with 'From:' in the patch.
>
> I don't understand what you mean by this.

Just set a manual "From:" line as the first line in the changelog as the
documentation asks.

Thanks,
edward

[Edward AD]

When the call to gsm_register_devices() fails, we need to reclaim the memory
requested in gsm_dlci_alloc().

Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com

Signed-off-by: Edward AD <ead...@sina.com>

[Edward AD]

On Tue, 19 Sep 2023 11:31:57 +0200 Greg KH wrote:
> > On Tue, 19 Sep 2023 10:29:08 +0200 Greg KH wrote:
> > > > When the call to gsm_register_devices() fails, we need to reclaim the memory
> > > > requested in gsm_dlci_alloc().
> > > >
> > > > Fixes: 01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
> > > > Reported-and-tested-by: syzbot+b5d1f4...@syzkaller.appspotmail.com
> > > > Signed-off-by: Edward AD <twuu...@gmail.com>
> > >
> > > Please use your company name/email address, and then just set a manual
> > > "From:" line as the first line in the changelog as the documentation
> > > asks. That's how developers work around their broken corporate email
> > > systems (but really, you should go and poke your IT group to fix it.)
> > This repair was completed in my personal time. Additionally, there may be a
> > possibility of the company's email being thrown away by 'lore.kernel.org'.
> > If you are not very strict with this, I will continue to use my private email.
>
> As you previously submitted this under your company name/address, we
> have to be strict for obvious reasons, sorry.

Before sending this email, according to your reply, I sent a new patch via email ead...@sina.com.
But we can't see that email in lore.kernel.org

>
> > I will only keep one line starting with 'From:' in the patch.
>
> I don't understand what you mean by this.

Just set a manual "From:" line as the first line in the changelog as the
documentation asks.

Thanks,
edward