Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1756480AbcDDUCf (ORCPT <rfc822;w@1wt.eu>);
	Mon, 4 Apr 2016 16:02:35 -0400
Received: from mail-lf0-f49.google.com ([209.85.215.49]:36776 "EHLO
	mail-lf0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1756100AbcDDUCe (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Mon, 4 Apr 2016 16:02:34 -0400
MIME-Version: 1.0
In-Reply-To: <5702C265.9070107@hurleysoftware.com>
References: <CACT4Y+bGsDkhmyjdYxxAKhE6D7_Oo9sq4FU7+BsbLaLqF5+sqA@mail.gmail.com>
 <5702C265.9070107@hurleysoftware.com>
From: Dmitry Vyukov <dvyukov@google.com>
Date: Mon, 4 Apr 2016 22:02:12 +0200
Message-ID: <CACT4Y+baWgnzN2HfvdHfB_6psgtcv+3WnTxeXxxeceYm5wbU+A@mail.gmail.com>
Subject: Re: tty: memory leak in tty_open
To: Peter Hurley <peter@hurleysoftware.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Jiri Slaby <jslaby@suse.com>, LKML <linux-kernel@vger.kernel.org>,
        syzkaller <syzkaller@googlegroups.com>,
        Kostya Serebryany <kcc@google.com>,
        Alexander Potapenko <glider@google.com>,
        Sasha Levin <sasha.levin@oracle.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2619
Lines: 71

On Mon, Apr 4, 2016 at 9:37 PM, Peter Hurley <peter@hurleysoftware.com> wrote:
> Hi Dmitry,
>
> On 04/04/2016 01:56 AM, Dmitry Vyukov wrote:
>> Hello,
>>
>> The following program causes a memory leak:
>
> Thanks for the report. This is the same problem fixed in 4.5
> There was a merge snafu; Greg has the patch in his queue that
> fixes this for 4.6


Thanks! Then I will wait for merge.


>> unreferenced object 0xffff8800643c3168 (size 2048):
>>   comm "syz-executor", pid 29328, jiffies 4295358628 (age 32.380s)
>>   hex dump (first 32 bytes):
>>     01 54 00 00 0c 00 00 00 88 27 e1 67 00 88 ff ff  .T.......'.g....
>>     88 1f 54 68 00 88 ff ff 40 b1 f0 86 ff ff ff ff  ..Th....@.......
>>   backtrace:
>>     [<ffffffff86798093>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:915
>>     [<     inline     >] kmemleak_alloc_recursive include/linux/kmemleak.h:47
>>     [<     inline     >] slab_post_alloc_hook mm/slab.h:406
>>     [<     inline     >] slab_alloc_node mm/slub.c:2602
>>     [<     inline     >] slab_alloc mm/slub.c:2610
>>     [<ffffffff817979a0>] kmem_cache_alloc_trace+0x160/0x3d0 mm/slub.c:2627
>>     [<     inline     >] kmalloc include/linux/slab.h:478
>>     [<     inline     >] kzalloc include/linux/slab.h:622
>>     [<ffffffff8304a748>] alloc_tty_struct+0x98/0x840 drivers/tty/tty_io.c:3156
>>     [<ffffffff8304af68>] tty_init_dev+0x78/0x4b0 drivers/tty/tty_io.c:1532
>>     [<     inline     >] tty_open_by_driver drivers/tty/tty_io.c:2066
>>     [<ffffffff8304c181>] tty_open+0xde1/0x1140 drivers/tty/tty_io.c:2114
>>     [<ffffffff81801fca>] chrdev_open+0x22a/0x4c0 fs/char_dev.c:388
>>     [<ffffffff817ed6a2>] do_dentry_open+0x6a2/0xcb0 fs/open.c:736
>>     [<ffffffff817f0d7b>] vfs_open+0x17b/0x1f0 fs/open.c:853
>>     [<     inline     >] do_last fs/namei.c:3238
>>     [<ffffffff8182961b>] path_openat+0x51bb/0x5ce0 fs/namei.c:3374
>>     [<ffffffff8182d7be>] do_filp_open+0x18e/0x250 fs/namei.c:3409
>>     [<ffffffff817f14fc>] do_sys_open+0x1fc/0x420 fs/open.c:1020
>>     [<     inline     >] SYSC_open fs/open.c:1038
>>     [<ffffffff817f174d>] SyS_open+0x2d/0x40 fs/open.c:1033
>>
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <pthread.h>
>> #include <sys/syscall.h>
>> #include <unistd.h>
>>
>> void* thr(void* arg)
>> {
>>   syscall(SYS_open, "/dev/console", 0, 0, 0, 0);
>>   return 0;
>> }
>>
>> int main()
>> {
>>   int i;
>>   pthread_t th[4];
>>
>>   for (i = 0; i < 4; i++)
>>     pthread_create(&th[i], 0, thr, 0);
>>   usleep(100);
>>   return 0;
>> }
>>
>>
>> On commit 05cf8077e54b20dddb756eaa26f3aeb5c38dd3cf (Apr 1).
>>
>