memory leak in hub_event

50 views
Skip to first unread message

syzbot

unread,
Nov 20, 2020, 10:15:21 AM11/20/20
to ba...@kernel.org, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
Hello,

syzbot found the following issue on:

HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+44e643...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88810d5ff800 (size 2048):
comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<00000000f0428224>] kmalloc include/linux/slab.h:552 [inline]
[<00000000f0428224>] kzalloc include/linux/slab.h:664 [inline]
[<00000000f0428224>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888112544c40 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949188 (age 14.280s)
hex dump (first 32 bytes):
31 2d 31 00 00 00 00 00 00 00 00 00 00 00 00 00 1-1.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d0f4aa93>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<000000005866b3ad>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<00000000b590b008>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000d251a578>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<0000000075b37c03>] usb_alloc_dev+0x1ee/0x450 drivers/usb/core/usb.c:650
[<000000001802b3dd>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000001802b3dd>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000001802b3dd>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000001802b3dd>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888112544ce0 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949231 (age 13.850s)
hex dump (first 32 bytes):
00 4d 54 12 81 88 ff ff 00 00 00 00 00 00 00 00 .MT.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000005516ca37>] kmalloc include/linux/slab.h:557 [inline]
[<000000005516ca37>] kzalloc include/linux/slab.h:664 [inline]
[<000000005516ca37>] usb_get_configuration+0xce/0x1dd0 drivers/usb/core/config.c:887
[<000000009ab33a39>] usb_enumerate_device drivers/usb/core/hub.c:2387 [inline]
[<000000009ab33a39>] usb_new_device+0x1a9/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888112544bc0 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949247 (age 13.690s)
hex dump (first 32 bytes):
73 79 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 syz.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b344f779>] kmalloc include/linux/slab.h:557 [inline]
[<00000000b344f779>] usb_cache_string+0x8a/0xf0 drivers/usb/core/message.c:1025
[<0000000074577e65>] usb_enumerate_device drivers/usb/core/hub.c:2397 [inline]
[<0000000074577e65>] usb_new_device+0x98/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888112544cc0 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949251 (age 13.650s)
hex dump (first 32 bytes):
73 79 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 syz.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b344f779>] kmalloc include/linux/slab.h:557 [inline]
[<00000000b344f779>] usb_cache_string+0x8a/0xf0 drivers/usb/core/message.c:1025
[<000000003d5bd90b>] usb_enumerate_device drivers/usb/core/hub.c:2398 [inline]
[<000000003d5bd90b>] usb_new_device+0xae/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888112544d40 (size 32):
comm "kworker/1:0", pid 17, jiffies 4294949255 (age 13.610s)
hex dump (first 32 bytes):
73 79 7a 00 00 00 00 00 00 00 00 00 00 00 00 00 syz.............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000b344f779>] kmalloc include/linux/slab.h:557 [inline]
[<00000000b344f779>] usb_cache_string+0x8a/0xf0 drivers/usb/core/message.c:1025
[<000000007392d5f6>] usb_enumerate_device drivers/usb/core/hub.c:2400 [inline]
[<000000007392d5f6>] usb_new_device+0xc4/0x2e0 drivers/usb/core/hub.c:2523
[<0000000069b10350>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<0000000069b10350>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000069b10350>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000069b10350>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<0000000092d3650d>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000d4629ab0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<000000003c358b45>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000003689dbb0>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Alan Stern

unread,
Nov 20, 2020, 11:56:11 AM11/20/20
to syzbot, ba...@kernel.org, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
This looks like a reference is being taken but not released. Hard to
tell where it's happening, though. Let's try to narrow it down.

Alan Stern

#syz test: upstream 4d02da97

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
}

gspca_dev->v4l2_dev.release = gspca_release;
+ ret = -EIO;
+ goto out;
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;

syzbot

unread,
Nov 20, 2020, 11:56:13 AM11/20/20
to Alan Stern, ba...@kernel.org, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
"upstream" does not look like a valid git repo address.

Alan Stern

unread,
Nov 20, 2020, 12:00:57 PM11/20/20
to Andrey Konovalov, ba...@kernel.org, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, syzkall...@googlegroups.com
On Fri, Nov 20, 2020 at 08:56:11AM -0800, syzbot wrote:
> > On Fri, Nov 20, 2020 at 07:15:20AM -0800, syzbot wrote:
> >> Hello,
> >>
> >> syzbot found the following issue on:
> >>
> >> HEAD commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
> >> git tree: upstream
> >> console output: https://syzkaller.appspot.com/x/log.txt?x=13a7d2b6500000
> >> kernel config: https://syzkaller.appspot.com/x/.config?x=c5353ac514ca5a43
> >> dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
> >> compiler: gcc (GCC) 10.1.0-syz 20200507
> >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14925089500000
> >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16810051500000

> > #syz test: upstream 4d02da97
>
> "upstream" does not look like a valid git repo address.

Okay, Andrey. If "upstream" is not accepted as a valid git repo
address, why does syzkaller list it on the "git tree:" line? It seems
to me that syzkaller should be willing to accept as input anything it
produces as output.

And what repo should I put here?

Alan Stern

Andrey Konovalov

unread,
Nov 23, 2020, 1:29:22 PM11/23/20
to Alan Stern, syzbot, Felipe Balbi, Greg Kroah-Hartman, LKML, USB list, syzkaller-bugs
Hi Alan,

Yeah, this is confusing, sorry. I've filed
https://github.com/google/syzkaller/issues/2265 for this.

Here "upstream" stands for the mainline tree, so something like this
should work:

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
4d02da97

Thanks!
gspca.patch

syzbot

unread,
Nov 23, 2020, 1:44:07 PM11/23/20
to andre...@google.com, ba...@kernel.org, gre...@linuxfoundation.org, linux-...@vger.kernel.org, linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
BUG: memory leak
unreferenced object 0xffff888117824d00 (size 256):
comm "syz-executor.6", pid 8896, jiffies 4294943994 (age 432.900s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 ad 17 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881182a6700 (size 256):
comm "syz-executor.2", pid 8885, jiffies 4294943999 (age 432.850s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 b7 16 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118395100 (size 256):
comm "syz-executor.4", pid 8892, jiffies 4294944000 (age 432.840s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 8b 17 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881116e0f00 (size 256):
comm "syz-executor.7", pid 8894, jiffies 4294944002 (age 432.820s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 b9 17 81 88 ff ff ................
backtrace:
[<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
[<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
[<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<00000000fafe7caa>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000c3d26710>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000001d81d993>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<0000000058b54b80>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000cd2a2042>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000f7907f96>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000050cbc28c>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000050cbc28c>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000050cbc28c>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000ade5a609>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000003424d3b0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory


Tested on:

commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=134bda0d500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=10d4463e500000

Alan Stern

unread,
Nov 23, 2020, 2:32:32 PM11/23/20
to syzbot, linu...@vger.kernel.org, syzkall...@googlegroups.com
[CC list trimmed. I assume most people don't care about the boring
debugging details.]

On Mon, Nov 23, 2020 at 10:44:06AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in rxrpc_lookup_local
>
> write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
> write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
> BUG: memory leak
> unreferenced object 0xffff888117824d00 (size 256):
> comm "syz-executor.6", pid 8896, jiffies 4294943994 (age 432.900s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 0a 00 00 00 00 00 ad 17 81 88 ff ff ................
> backtrace:
> [<0000000069b066ee>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000069b066ee>] kzalloc include/linux/slab.h:664 [inline]
> [<0000000069b066ee>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
> [<0000000069b066ee>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
> [<0000000085db7132>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
> [<00000000a2a77c59>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
> [<0000000086f4a248>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126

I don't know what all this rxrpc or afs stuff is about, but it doesn't
seem to have anything to do with gspca. So it's a good bet that the
patch bailed out before the unreleased reference was acquired.

Let's try another spot. Binary search should find the right place
quickly enough.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,8 @@ int gspca_dev_probe2(struct usb_interfac
}

gspca_dev->v4l2_dev.release = gspca_release;
+// ret = -EIO;
+// goto out;
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;
@@ -1530,6 +1532,7 @@ int gspca_dev_probe2(struct usb_interfac
if (ret < 0)
goto out;
ret = sd_desc->init(gspca_dev);
+ ret = -EIO;
if (ret < 0)
goto out;
if (sd_desc->init_controls)

syzbot

unread,
Nov 23, 2020, 2:42:12 PM11/23/20
to linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in usb_set_configuration

BUG: memory leak
unreferenced object 0xffff888125a13400 (size 1024):
comm "kworker/0:3", pid 8164, jiffies 4294944436 (age 13.610s)
hex dump (first 32 bytes):
08 c7 84 25 81 88 ff ff 08 c7 84 25 81 88 ff ff ...%.......%....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000042c26fbc>] kmalloc include/linux/slab.h:552 [inline]
[<0000000042c26fbc>] kzalloc include/linux/slab.h:664 [inline]
[<0000000042c26fbc>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
[<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000061119d56>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000009f962ea9>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<000000001459c72b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<000000000532b098>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000910da3ce>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<0000000072e90711>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<000000005cbbd88c>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<00000000e7bc8059>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000d9415aa4>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000d9415aa4>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000d9415aa4>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000d9415aa4>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000004f0d05ee>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000a8771f1e>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000b8ee2caf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000e31b0818>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff88812592c340 (size 32):
comm "kworker/0:3", pid 8164, jiffies 4294944436 (age 13.610s)
hex dump (first 32 bytes):
33 2d 31 3a 30 2e 30 00 00 00 00 00 00 00 00 00 3-1:0.0.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000045f13983>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<0000000044941061>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<00000000c19829d3>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000b2f7d014>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<0000000071eb3ed0>] usb_set_configuration+0x6be/0xb90 drivers/usb/core/message.c:2094
[<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000061119d56>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000009f962ea9>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<000000001459c72b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<000000000532b098>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000910da3ce>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<0000000072e90711>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<000000005cbbd88c>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<00000000e7bc8059>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000d9415aa4>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000d9415aa4>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000d9415aa4>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000d9415aa4>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590

BUG: memory leak
unreferenced object 0xffff888125a0b300 (size 256):
comm "kworker/0:3", pid 8164, jiffies 4294944441 (age 13.560s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 b3 a0 25 81 88 ff ff ...........%....
08 b3 a0 25 81 88 ff ff f0 8b 58 82 ff ff ff ff ...%......X.....
backtrace:
[<000000009575797b>] kmalloc include/linux/slab.h:552 [inline]
[<000000009575797b>] kzalloc include/linux/slab.h:664 [inline]
[<000000009575797b>] device_private_init drivers/base/core.c:2778 [inline]
[<000000009575797b>] device_add+0x7e8/0xc30 drivers/base/core.c:2828
[<000000009e05d7ea>] usb_set_configuration+0x9de/0xb90 drivers/usb/core/message.c:2159
[<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000061119d56>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000009f962ea9>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<000000001459c72b>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<000000000532b098>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000910da3ce>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<0000000072e90711>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<000000005cbbd88c>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<00000000e7bc8059>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000d9415aa4>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000d9415aa4>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000d9415aa4>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000d9415aa4>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000004f0d05ee>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000a8771f1e>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000b8ee2caf>] kthread+0x178/0x1b0 kernel/kthread.c:292

BUG: memory leak
unreferenced object 0xffff888125b55800 (size 2048):
comm "kworker/0:1", pid 7, jiffies 4294944569 (age 12.280s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<00000000dad779b6>] kmalloc include/linux/slab.h:552 [inline]
[<00000000dad779b6>] kzalloc include/linux/slab.h:664 [inline]
[<00000000dad779b6>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<000000006a07019b>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000006a07019b>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000006a07019b>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000006a07019b>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<000000004f0d05ee>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000a8771f1e>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000b8ee2caf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000e31b0818>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296



Tested on:

commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=12436fde500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=1197fc2d500000

Alan Stern

unread,
Nov 23, 2020, 2:53:09 PM11/23/20
to syzbot, linu...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, Nov 23, 2020 at 11:42:11AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in usb_set_configuration
>
> BUG: memory leak
> unreferenced object 0xffff888125a13400 (size 1024):
> comm "kworker/0:3", pid 8164, jiffies 4294944436 (age 13.610s)
> hex dump (first 32 bytes):
> 08 c7 84 25 81 88 ff ff 08 c7 84 25 81 88 ff ff ...%.......%....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<0000000042c26fbc>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000042c26fbc>] kzalloc include/linux/slab.h:664 [inline]
> [<0000000042c26fbc>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
> [<00000000df7c22fc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> [<00000000dbc03c2e>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293

Okay, that looks like the original bug report, so this spot was bad.
Here's another try, about halfway between the first two.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,6 +1489,7 @@ int gspca_dev_probe2(struct usb_interfac
}

gspca_dev->v4l2_dev.release = gspca_release;
+// Good
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
if (ret)
goto out;
@@ -1518,6 +1519,7 @@ int gspca_dev_probe2(struct usb_interfac
q->min_buffers_needed = 2;
q->lock = &gspca_dev->usb_lock;
ret = vb2_queue_init(q);
+ ret = -EIO;
if (ret)
goto out;
gspca_dev->vdev.queue = q;
@@ -1530,6 +1532,7 @@ int gspca_dev_probe2(struct usb_interfac
if (ret < 0)
goto out;
ret = sd_desc->init(gspca_dev);
+// Bad

syzbot

unread,
Nov 23, 2020, 3:01:09 PM11/23/20
to linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in usb_set_configuration

BUG: memory leak
unreferenced object 0xffff88812695d400 (size 1024):
comm "kworker/1:2", pid 3876, jiffies 4294944657 (age 14.950s)
hex dump (first 32 bytes):
c8 ee 8d 26 81 88 ff ff c8 ee 8d 26 81 88 ff ff ...&.......&....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e23bdd53>] kmalloc include/linux/slab.h:552 [inline]
[<00000000e23bdd53>] kzalloc include/linux/slab.h:664 [inline]
[<00000000e23bdd53>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
[<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000084544ac0>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<00000000b1ca23bf>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<0000000071b8d8fa>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000b1c25910>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000104c17ae>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<00000000b93cff33>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<0000000098ed347d>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000008afe4d3b>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<000000000db8d2bb>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<000000000db8d2bb>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000000db8d2bb>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000000db8d2bb>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<00000000d321de91>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<0000000038230b58>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000a1e60acf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000d5e1cdc3>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff8881269b6560 (size 32):
comm "kworker/1:2", pid 3876, jiffies 4294944657 (age 14.950s)
hex dump (first 32 bytes):
36 2d 31 3a 30 2e 30 00 00 00 00 00 00 00 00 00 6-1:0.0.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000e5418e58>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<00000000a3c51b27>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<000000002234e01b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000f280c658>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<000000008b5b3978>] usb_set_configuration+0x6be/0xb90 drivers/usb/core/message.c:2094
[<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000084544ac0>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<00000000b1ca23bf>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<0000000071b8d8fa>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000b1c25910>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000104c17ae>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<00000000b93cff33>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<0000000098ed347d>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000008afe4d3b>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<000000000db8d2bb>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<000000000db8d2bb>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000000db8d2bb>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000000db8d2bb>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590

BUG: memory leak
unreferenced object 0xffff8881263eff00 (size 256):
comm "kworker/1:2", pid 3876, jiffies 4294944661 (age 14.910s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 ff 3e 26 81 88 ff ff ..........>&....
08 ff 3e 26 81 88 ff ff f0 8b 58 82 ff ff ff ff ..>&......X.....
backtrace:
[<000000001dc8ab7b>] kmalloc include/linux/slab.h:552 [inline]
[<000000001dc8ab7b>] kzalloc include/linux/slab.h:664 [inline]
[<000000001dc8ab7b>] device_private_init drivers/base/core.c:2778 [inline]
[<000000001dc8ab7b>] device_add+0x7e8/0xc30 drivers/base/core.c:2828
[<00000000268b1f35>] usb_set_configuration+0x9de/0xb90 drivers/usb/core/message.c:2159
[<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000084544ac0>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<00000000b1ca23bf>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<0000000071b8d8fa>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000b1c25910>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000104c17ae>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<00000000b93cff33>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<0000000098ed347d>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000008afe4d3b>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<000000000db8d2bb>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<000000000db8d2bb>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000000db8d2bb>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000000db8d2bb>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<00000000d321de91>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<0000000038230b58>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000a1e60acf>] kthread+0x178/0x1b0 kernel/kthread.c:292

BUG: memory leak
unreferenced object 0xffff888126ad1800 (size 2048):
comm "kworker/0:3", pid 4909, jiffies 4294944664 (age 14.880s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<0000000083df40a5>] kmalloc include/linux/slab.h:552 [inline]
[<0000000083df40a5>] kzalloc include/linux/slab.h:664 [inline]
[<0000000083df40a5>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<000000006a2b040a>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<000000006a2b040a>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<000000006a2b040a>] port_event drivers/usb/core/hub.c:5508 [inline]
[<000000006a2b040a>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<00000000d321de91>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<0000000038230b58>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000a1e60acf>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<00000000d5e1cdc3>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296



Tested on:

commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=110c7521500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=10a8b8f1500000

Alan Stern

unread,
Nov 23, 2020, 3:38:55 PM11/23/20
to syzbot, linu...@vger.kernel.org, syzkall...@googlegroups.com
On Mon, Nov 23, 2020 at 12:01:08PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in usb_set_configuration
>
> BUG: memory leak
> unreferenced object 0xffff88812695d400 (size 1024):
> comm "kworker/1:2", pid 3876, jiffies 4294944657 (age 14.950s)
> hex dump (first 32 bytes):
> c8 ee 8d 26 81 88 ff ff c8 ee 8d 26 81 88 ff ff ...&.......&....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<00000000e23bdd53>] kmalloc include/linux/slab.h:552 [inline]
> [<00000000e23bdd53>] kzalloc include/linux/slab.h:664 [inline]
> [<00000000e23bdd53>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
> [<0000000075483a2c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> [<00000000e7052b0c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293

Also bad. That doesn't leave many possibilities.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1489,7 +1489,9 @@ int gspca_dev_probe2(struct usb_interfac
}

gspca_dev->v4l2_dev.release = gspca_release;
+// Good
ret = v4l2_device_register(&intf->dev, &gspca_dev->v4l2_dev);
+ ret = -EIO;
if (ret)
goto out;
gspca_dev->present = true;
@@ -1518,6 +1520,7 @@ int gspca_dev_probe2(struct usb_interfac
q->min_buffers_needed = 2;
q->lock = &gspca_dev->usb_lock;
ret = vb2_queue_init(q);
+// Bad

syzbot

unread,
Nov 23, 2020, 3:48:09 PM11/23/20
to linu...@vger.kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in usb_set_configuration

BUG: memory leak
unreferenced object 0xffff8881268a1800 (size 1024):
comm "kworker/0:2", pid 3644, jiffies 4294944749 (age 12.820s)
hex dump (first 32 bytes):
48 f3 6a 26 81 88 ff ff 48 f3 6a 26 81 88 ff ff H.j&....H.j&....
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000089bfe22c>] kmalloc include/linux/slab.h:552 [inline]
[<0000000089bfe22c>] kzalloc include/linux/slab.h:664 [inline]
[<0000000089bfe22c>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
[<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000063ae4f8e>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000000b2cba9e>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<00000000401d8f88>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000071f219f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<0000000050610cd8>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<000000003a745e13>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000755052c8>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000005e2739cd>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000f1911f9c>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000f1911f9c>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000f1911f9c>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000f1911f9c>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000000f3eae83>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000aaee64a0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000c7b69663>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<0000000083b3bd6e>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff8881267cbb00 (size 32):
comm "kworker/0:2", pid 3644, jiffies 4294944749 (age 12.820s)
hex dump (first 32 bytes):
32 2d 31 3a 30 2e 30 00 00 00 00 00 00 00 00 00 2-1:0.0.........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000cdbe26df>] kvasprintf+0x6c/0xf0 lib/kasprintf.c:25
[<00000000f93de34f>] kvasprintf_const+0x58/0x110 lib/kasprintf.c:49
[<00000000701cf1fc>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<00000000d2130373>] dev_set_name+0x63/0x90 drivers/base/core.c:2722
[<000000008249ed0f>] usb_set_configuration+0x6be/0xb90 drivers/usb/core/message.c:2094
[<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000063ae4f8e>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000000b2cba9e>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<00000000401d8f88>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000071f219f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<0000000050610cd8>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<000000003a745e13>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000755052c8>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000005e2739cd>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000f1911f9c>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000f1911f9c>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000f1911f9c>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000f1911f9c>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590

BUG: memory leak
unreferenced object 0xffff888126840f00 (size 256):
comm "kworker/0:2", pid 3644, jiffies 4294944753 (age 12.780s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 0f 84 26 81 88 ff ff ...........&....
08 0f 84 26 81 88 ff ff f0 8b 58 82 ff ff ff ff ...&......X.....
backtrace:
[<00000000d74f9968>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d74f9968>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d74f9968>] device_private_init drivers/base/core.c:2778 [inline]
[<00000000d74f9968>] device_add+0x7e8/0xc30 drivers/base/core.c:2828
[<000000001ecf5486>] usb_set_configuration+0x9de/0xb90 drivers/usb/core/message.c:2159
[<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<0000000063ae4f8e>] really_probe+0x159/0x480 drivers/base/dd.c:554
[<000000000b2cba9e>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
[<00000000401d8f88>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
[<00000000071f219f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<0000000050610cd8>] __device_attach+0x122/0x250 drivers/base/dd.c:912
[<000000003a745e13>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000755052c8>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
[<000000005e2739cd>] usb_new_device.cold+0x166/0x578 drivers/usb/core/hub.c:2554
[<00000000f1911f9c>] hub_port_connect drivers/usb/core/hub.c:5222 [inline]
[<00000000f1911f9c>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<00000000f1911f9c>] port_event drivers/usb/core/hub.c:5508 [inline]
[<00000000f1911f9c>] hub_event+0x144a/0x20d0 drivers/usb/core/hub.c:5590
[<000000000f3eae83>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000aaee64a0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000c7b69663>] kthread+0x178/0x1b0 kernel/kthread.c:292

BUG: memory leak
unreferenced object 0xffff888125cc4800 (size 2048):
comm "kworker/0:0", pid 5, jiffies 4294944827 (age 12.040s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<000000004b6bc568>] kmalloc include/linux/slab.h:552 [inline]
[<000000004b6bc568>] kzalloc include/linux/slab.h:664 [inline]
[<000000004b6bc568>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<0000000098e340b1>] hub_port_connect drivers/usb/core/hub.c:5128 [inline]
[<0000000098e340b1>] hub_port_connect_change drivers/usb/core/hub.c:5362 [inline]
[<0000000098e340b1>] port_event drivers/usb/core/hub.c:5508 [inline]
[<0000000098e340b1>] hub_event+0x118d/0x20d0 drivers/usb/core/hub.c:5590
[<000000000f3eae83>] process_one_work+0x27d/0x590 kernel/workqueue.c:2272
[<00000000aaee64a0>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2418
[<00000000c7b69663>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<0000000083b3bd6e>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296



Tested on:

commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=115d7eb9500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=10236fde500000

Alan Stern

unread,
Nov 23, 2020, 4:53:47 PM11/23/20
to syzbot, Mauro Carvalho Chehab, Hans Verkuil, linu...@vger.kernel.org, linux...@vger.kernel.org, syzkall...@googlegroups.com
Quick summary: syzbot found a memory leak in the gspca driver,
apparently caused by a reference being taken but not released in a
probe failure pathway.

On Mon, Nov 23, 2020 at 12:48:08PM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in usb_set_configuration
>
> BUG: memory leak
> unreferenced object 0xffff8881268a1800 (size 1024):
> comm "kworker/0:2", pid 3644, jiffies 4294944749 (age 12.820s)
> hex dump (first 32 bytes):
> 48 f3 6a 26 81 88 ff ff 48 f3 6a 26 81 88 ff ff H.j&....H.j&....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<0000000089bfe22c>] kmalloc include/linux/slab.h:552 [inline]
> [<0000000089bfe22c>] kzalloc include/linux/slab.h:664 [inline]
> [<0000000089bfe22c>] usb_set_configuration+0x18c/0xb90 drivers/usb/core/message.c:1987
> [<00000000207f81de>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
> [<000000007aa490e0>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293

Okay, this does seem to pinpoint the problem. gspca_dev_probe2() calls
v4l2_device_register() at the start, but doesn't call
v4l2_device_disconnect() upon failure.

I'm not at all familiar with the design of the v4l2 subsystem. Mauro or
Hans: Is this the right solution?

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_disconnect(&gspca_dev->v4l2_dev);
kfree(gspca_dev->usb_buf);
kfree(gspca_dev);
return ret;

syzbot

unread,
Nov 23, 2020, 5:09:06 PM11/23/20
to hver...@xs4all.nl, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local

BUG: memory leak
unreferenced object 0xffff888117ab9900 (size 256):
comm "syz-executor.0", pid 8883, jiffies 4294943811 (age 433.620s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 80 cb 17 81 88 ff ff ................
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888117d40d00 (size 256):
comm "syz-executor.1", pid 8884, jiffies 4294943812 (age 433.610s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 ac 17 81 88 ff ff ................
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118236900 (size 256):
comm "syz-executor.2", pid 8894, jiffies 4294943830 (age 433.430s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 00 34 18 81 88 ff ff ..........4.....
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881170d5400 (size 256):
comm "syz-executor.3", pid 8888, jiffies 4294943833 (age 433.400s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 35 18 81 88 ff ff .........@5.....
backtrace:
[<000000009003383a>] kmalloc include/linux/slab.h:552 [inline]
[<000000009003383a>] kzalloc include/linux/slab.h:664 [inline]
[<000000009003383a>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<000000009003383a>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000609410d3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000661f73ad>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e3eb5768>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<000000002c6bf109>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000009ce0aa62>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<00000000db8c8dc2>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<00000000b04b70a8>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<000000005dc01eb8>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<00000000422ec6bd>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<0000000042f77bee>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<0000000042f77bee>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<0000000042f77bee>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<00000000e58e69f9>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000000a67195e>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory


Tested on:

commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=123a6611500000
kernel config: https://syzkaller.appspot.com/x/.config?x=b29e92cdfa2687df
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=11c4e969500000

Alan Stern

unread,
Nov 23, 2020, 5:24:30 PM11/23/20
to syzbot, hver...@xs4all.nl, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, syzkall...@googlegroups.com
Okay, that confirms it. This is a completely different memory leak, as
can be seen by comparing the stack trace with the previous one. The
problem with the gspca driver is gone.

Mauro/Hans, what should I do with the patch?

Alan Stern

Hans Verkuil

unread,
Nov 24, 2020, 6:38:50 AM11/24/20
to Alan Stern, syzbot, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, syzkall...@googlegroups.com
Just post it to linux-media and I'll pick it up as gspca maintainer.

Regards,

Hans

Alan Stern

unread,
Nov 24, 2020, 11:00:28 AM11/24/20
to Hans Verkuil, syzbot, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, syzkall...@googlegroups.com
The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface). But the
failure pathway neglects to call v4l2_device_disconnect(), the routine
responsible for dropping this reference. Consequently the memory for
the USB interface and its device never gets released.

This patch adds the missing function call.

Signed-off-by: Alan Stern <st...@rowland.harvard.edu>
Reported-and-tested-by: syzbot+44e643...@syzkaller.appspotmail.com
CC: <sta...@vger.kernel.org>

---

This doesn't fully fix syzbot's test case, because the test goes on and
encounters another memory leak in a different driver.


[as1949]


drivers/media/usb/gspca/gspca.c | 1 +
1 file changed, 1 insertion(+)

Hans Verkuil

unread,
Dec 2, 2020, 3:58:09 AM12/2/20
to Alan Stern, syzbot, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, syzkall...@googlegroups.com
Close, but no cigar. This should call v4l2_device_unregister(), the
counterpart of video_device_register. This unregister function also
calls v4l2_device_disconnect, but the code makes a lot more sense if
the v4l2_device_register is matched with the v4l2_device_unregister.

Regards,

Hans

Alan Stern

unread,
Dec 2, 2020, 11:22:02 AM12/2/20
to syzbot, hver...@xs4all.nl, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, syzkall...@googlegroups.com
> commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
> git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

Hans says to call v4l2_device_unregister rather than
v4l2_device_disconnect. Let's make sure that works.

Alan Stern

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 4d02da97

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_unregister(&gspca_dev->v4l2_dev);

syzbot

unread,
Dec 2, 2020, 11:37:11 AM12/2/20
to hver...@xs4all.nl, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, st...@rowland.harvard.edu, syzkall...@googlegroups.com
Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local

BUG: memory leak
unreferenced object 0xffff88810ae30400 (size 256):
comm "syz-executor.2", pid 8878, jiffies 4294943959 (age 433.730s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 75 17 81 88 ff ff .........@u.....
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888117639d00 (size 256):
comm "syz-executor.0", pid 8872, jiffies 4294943961 (age 433.710s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 7a 17 81 88 ff ff .........@z.....
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888117a9cb00 (size 256):
comm "syz-executor.7", pid 8882, jiffies 4294943964 (age 433.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 80 8b 17 81 88 ff ff ................
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810c9b9700 (size 256):
comm "syz-executor.5", pid 8881, jiffies 4294943965 (age 433.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 b4 0c 81 88 ff ff ................
backtrace:
[<00000000d78976b4>] kmalloc include/linux/slab.h:552 [inline]
[<00000000d78976b4>] kzalloc include/linux/slab.h:664 [inline]
[<00000000d78976b4>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<00000000d78976b4>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<000000000f4771f3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a1ca3956>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<000000000b4e3083>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000057174e11>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<000000001ef2d4d2>] setup_net+0xdb/0x2d0 net/core/net_namespace.c:342
[<000000000c0943a9>] copy_net_ns+0x14b/0x320 net/core/net_namespace.c:483
[<000000000134587c>] create_new_namespaces+0x199/0x4e0 kernel/nsproxy.c:110
[<00000000ab7ab634>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:231
[<000000000a7b8a55>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2949
[<000000007378cba1>] __do_sys_unshare kernel/fork.c:3017 [inline]
[<000000007378cba1>] __se_sys_unshare kernel/fork.c:3015 [inline]
[<000000007378cba1>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3015
[<000000002e47b3c4>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000daddea42>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



Tested on:

commit: 4d02da97 Merge tag 'net-5.10-rc5' of git://git.kernel.org/..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=16754c55500000
kernel config: https://syzkaller.appspot.com/x/.config?x=9e70f46496e4daad
dashboard link: https://syzkaller.appspot.com/bug?extid=44e64397bd81d5e84cba
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=12ca5c73500000

Alan Stern

unread,
Dec 2, 2020, 12:20:06 PM12/2/20
to Hans Verkuil, syzbot, linux...@vger.kernel.org, linu...@vger.kernel.org, mch...@kernel.org, syzkall...@googlegroups.com
The gspca driver leaks memory when a probe fails. gspca_dev_probe2()
calls v4l2_device_register(), which takes a reference to the
underlying device node (in this case, a USB interface). But the
failure pathway neglects to call v4l2_device_unregister(), the routine
responsible for dropping this reference. Consequently the memory for
the USB interface and its device never gets released.

This patch adds the missing function call.

Signed-off-by: Alan Stern <st...@rowland.harvard.edu>
Reported-and-tested-by: syzbot+44e643...@syzkaller.appspotmail.com
CC: <sta...@vger.kernel.org>

---

v2: Replace v4l2_device_disconnect() call with v4l2_device_unregister().


[as1949b]


drivers/media/usb/gspca/gspca.c | 1 +
1 file changed, 1 insertion(+)

Index: usb-devel/drivers/media/usb/gspca/gspca.c
===================================================================
--- usb-devel.orig/drivers/media/usb/gspca/gspca.c
+++ usb-devel/drivers/media/usb/gspca/gspca.c
@@ -1575,6 +1575,7 @@ out:
input_unregister_device(gspca_dev->input_dev);
#endif
v4l2_ctrl_handler_free(gspca_dev->vdev.ctrl_handler);
+ v4l2_device_unregister(&gspca_dev->v4l2_dev);
Reply all
Reply to author
Forward
0 new messages