memory leak in gadget_bind

Status: fixed on 2020/11/20 14:54
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+0a4ec40b66726854dd11@syzkaller.appspotmail.com
Fix commit: 129aa9734559 usb: raw-gadget: fix memory leak in gadget_setup
First crash: 2105d, last: 2086d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
memory leak in gadget_bind 1 (2) 2020/11/11 01:55

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810e0ba800 (size 32):
  comm "syz-executor224", pid 8494, jiffies 4294941793 (age 14.440s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000004808c71f>] kmalloc include/linux/slab.h:552 [inline]
    [<000000004808c71f>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
    [<000000004808c71f>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
    [<000000004808c71f>] gadget_bind+0x223/0x340 drivers/usb/gadget/legacy/raw_gadget.c:303
    [<00000000a4dde2c8>] udc_bind_to_driver+0x62/0x150 drivers/usb/gadget/udc/core.c:1413
    [<00000000620b42ba>] usb_gadget_probe_driver+0x1c7/0x230 drivers/usb/gadget/udc/core.c:1476
    [<00000000e1b1ad48>] raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:512 [inline]
    [<00000000e1b1ad48>] raw_ioctl+0x5da/0xf30 drivers/usb/gadget/legacy/raw_gadget.c:1210
    [<00000000a5af891e>] vfs_ioctl fs/ioctl.c:48 [inline]
    [<00000000a5af891e>] __do_sys_ioctl fs/ioctl.c:753 [inline]
    [<00000000a5af891e>] __se_sys_ioctl fs/ioctl.c:739 [inline]
    [<00000000a5af891e>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:739
    [<0000000041b2b46c>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<0000000064ab8c43>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810fd30a40 (size 32):
  comm "softirq", pid 0, jiffies 4294941824 (age 14.130s)
  hex dump (first 32 bytes):
    02 00 00 00 08 00 00 00 80 06 00 01 00 00 40 00  ..............@.
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000defb7b40>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000defb7b40>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
    [<00000000defb7b40>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
    [<00000000defb7b40>] gadget_setup+0xf6/0x220 drivers/usb/gadget/legacy/raw_gadget.c:343
    [<0000000093aae462>] dummy_timer+0xb9f/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1899
    [<0000000096d7267e>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1410
    [<00000000cd2dac36>] expire_timers kernel/time/timer.c:1455 [inline]
    [<00000000cd2dac36>] __run_timers.part.0+0x319/0x400 kernel/time/timer.c:1747
    [<00000000d6ccb8aa>] __run_timers kernel/time/timer.c:1728 [inline]
    [<00000000d6ccb8aa>] run_timer_softirq+0x3d/0x80 kernel/time/timer.c:1760
    [<0000000069897a11>] __do_softirq+0xcc/0x2c2 kernel/softirq.c:298
    [<00000000a13af998>] asm_call_irq_on_stack+0xf/0x20
    [<000000008bd6342b>] __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
    [<000000008bd6342b>] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
    [<000000008bd6342b>] do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
    [<000000009a4a7463>] invoke_softirq kernel/softirq.c:393 [inline]
    [<000000009a4a7463>] __irq_exit_rcu kernel/softirq.c:423 [inline]
    [<000000009a4a7463>] irq_exit_rcu+0x91/0xc0 kernel/softirq.c:435
    [<0000000032f1604f>] sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1091
    [<00000000c9629ae8>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
    [<00000000fdd481e0>] native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
    [<00000000fdd481e0>] arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
    [<00000000fdd481e0>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
    [<00000000fdd481e0>] acpi_idle_do_entry+0xc3/0xd0 drivers/acpi/processor_idle.c:517
    [<00000000ffb5fe69>] acpi_idle_enter+0x128/0x1f0 drivers/acpi/processor_idle.c:648
    [<00000000b2f1b69d>] cpuidle_enter_state+0xc9/0x650 drivers/cpuidle/cpuidle.c:237
    [<000000003fb4e3ce>] cpuidle_enter+0x29/0x40 drivers/cpuidle/cpuidle.c:351
    [<0000000024aa6606>] call_cpuidle kernel/sched/idle.c:132 [inline]
    [<0000000024aa6606>] cpuidle_idle_call kernel/sched/idle.c:213 [inline]
    [<0000000024aa6606>] do_idle+0x1c8/0x250 kernel/sched/idle.c:273

BUG: memory leak
unreferenced object 0xffff88810d59bd20 (size 32):
  comm "softirq", pid 0, jiffies 4294941848 (age 13.890s)
  hex dump (first 32 bytes):
    02 00 00 00 08 00 00 00 80 06 00 01 00 00 12 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000defb7b40>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000defb7b40>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
    [<00000000defb7b40>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
    [<00000000defb7b40>] gadget_setup+0xf6/0x220 drivers/usb/gadget/legacy/raw_gadget.c:343
    [<0000000093aae462>] dummy_timer+0xb9f/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1899
    [<0000000096d7267e>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1410
    [<00000000cd2dac36>] expire_timers kernel/time/timer.c:1455 [inline]
    [<00000000cd2dac36>] __run_timers.part.0+0x319/0x400 kernel/time/timer.c:1747
    [<00000000d6ccb8aa>] __run_timers kernel/time/timer.c:1728 [inline]
    [<00000000d6ccb8aa>] run_timer_softirq+0x3d/0x80 kernel/time/timer.c:1760
    [<0000000069897a11>] __do_softirq+0xcc/0x2c2 kernel/softirq.c:298
    [<00000000a13af998>] asm_call_irq_on_stack+0xf/0x20
    [<000000008bd6342b>] __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
    [<000000008bd6342b>] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
    [<000000008bd6342b>] do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
    [<000000009a4a7463>] invoke_softirq kernel/softirq.c:393 [inline]
    [<000000009a4a7463>] __irq_exit_rcu kernel/softirq.c:423 [inline]
    [<000000009a4a7463>] irq_exit_rcu+0x91/0xc0 kernel/softirq.c:435
    [<0000000032f1604f>] sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1091
    [<00000000c9629ae8>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
    [<00000000fdd481e0>] native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
    [<00000000fdd481e0>] arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
    [<00000000fdd481e0>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
    [<00000000fdd481e0>] acpi_idle_do_entry+0xc3/0xd0 drivers/acpi/processor_idle.c:517
    [<00000000ffb5fe69>] acpi_idle_enter+0x128/0x1f0 drivers/acpi/processor_idle.c:648
    [<00000000b2f1b69d>] cpuidle_enter_state+0xc9/0x650 drivers/cpuidle/cpuidle.c:237
    [<000000003fb4e3ce>] cpuidle_enter+0x29/0x40 drivers/cpuidle/cpuidle.c:351
    [<0000000024aa6606>] call_cpuidle kernel/sched/idle.c:132 [inline]
    [<0000000024aa6606>] cpuidle_idle_call kernel/sched/idle.c:213 [inline]
    [<0000000024aa6606>] do_idle+0x1c8/0x250 kernel/sched/idle.c:273

BUG: memory leak
unreferenced object 0xffff88810ba57b40 (size 32):
  comm "syz-executor224", pid 8508, jiffies 4294942411 (age 8.260s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000004808c71f>] kmalloc include/linux/slab.h:552 [inline]
    [<000000004808c71f>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
    [<000000004808c71f>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
    [<000000004808c71f>] gadget_bind+0x223/0x340 drivers/usb/gadget/legacy/raw_gadget.c:303
    [<00000000a4dde2c8>] udc_bind_to_driver+0x62/0x150 drivers/usb/gadget/udc/core.c:1413
    [<00000000620b42ba>] usb_gadget_probe_driver+0x1c7/0x230 drivers/usb/gadget/udc/core.c:1476
    [<00000000e1b1ad48>] raw_ioctl_run drivers/usb/gadget/legacy/raw_gadget.c:512 [inline]
    [<00000000e1b1ad48>] raw_ioctl+0x5da/0xf30 drivers/usb/gadget/legacy/raw_gadget.c:1210
    [<00000000a5af891e>] vfs_ioctl fs/ioctl.c:48 [inline]
    [<00000000a5af891e>] __do_sys_ioctl fs/ioctl.c:753 [inline]
    [<00000000a5af891e>] __se_sys_ioctl fs/ioctl.c:739 [inline]
    [<00000000a5af891e>] __x64_sys_ioctl+0xfc/0x140 fs/ioctl.c:739
    [<0000000041b2b46c>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<0000000064ab8c43>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Crashes (62):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/11/09 08:10 upstream 9dbc1c03eeb5 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/09 04:36 upstream 9dbc1c03eeb5 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/08 22:41 upstream 9dbc1c03eeb5 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/08 21:36 upstream 9dbc1c03eeb5 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/08 05:48 upstream 4429f14aeea9 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/08 04:16 upstream 4429f14aeea9 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 19:27 upstream 659caaf65dc9 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 17:13 upstream 659caaf65dc9 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 16:56 upstream 659caaf65dc9 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 16:38 upstream 659caaf65dc9 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 07:04 upstream bf3e76289cd2 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 06:26 upstream bf3e76289cd2 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 05:11 upstream bf3e76289cd2 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 04:51 upstream bf3e76289cd2 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/07 02:39 upstream bf3e76289cd2 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/06 00:13 upstream 521b619acdc8 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/05 23:09 upstream 521b619acdc8 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/05 04:41 upstream 4ef8451b3326 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/05 03:26 upstream 4ef8451b3326 64069d48 .config console log report syz C ci-upstream-gce-leak
2020/11/04 14:07 upstream 4ef8451b3326 cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/04 00:46 upstream b7cbaf59f62f cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/04 00:25 upstream b7cbaf59f62f cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/03 20:29 upstream b7cbaf59f62f cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/03 19:37 upstream b7cbaf59f62f cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/03 19:37 upstream b7cbaf59f62f cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/03 07:57 upstream 495023e4e49e cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/03 03:26 upstream 495023e4e49e cba33199 .config console log report syz C ci-upstream-gce-leak
2020/11/02 10:39 upstream 3cea11cd5e3b 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/11/02 10:08 upstream 3cea11cd5e3b 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/11/02 09:51 upstream 3cea11cd5e3b 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/11/02 06:58 upstream 3cea11cd5e3b 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/11/02 02:51 upstream 3cea11cd5e3b 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/10/31 23:43 upstream bb3540be73ca 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/10/31 17:13 upstream 5fc6b075e165 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/10/31 14:46 upstream 5fc6b075e165 8bc4594f .config console log report syz C ci-upstream-gce-leak
2020/10/31 03:44 upstream 5fc6b075e165 18e33098 .config console log report syz C ci-upstream-gce-leak
2020/10/30 23:02 upstream 07e088730245 a6e3ac3b .config console log report syz C ci-upstream-gce-leak
2020/10/30 13:57 upstream 07e088730245 a6e3ac3b .config console log report syz C ci-upstream-gce-leak
2020/10/30 05:56 upstream 23859ae44402 a0c7169a .config console log report syz C ci-upstream-gce-leak
2020/10/29 23:03 upstream 23859ae44402 a0c7169a .config console log report syz C ci-upstream-gce-leak
2020/10/29 22:52 upstream 23859ae44402 a0c7169a .config console log report syz C ci-upstream-gce-leak
2020/10/29 19:40 upstream 23859ae44402 a0c7169a .config console log report syz C ci-upstream-gce-leak
2020/10/29 02:09 upstream ed8780e3f2ec f24824d3 .config console log report syz C ci-upstream-gce-leak
2020/10/28 21:42 upstream ed8780e3f2ec f24824d3 .config console log report syz C ci-upstream-gce-leak
2020/10/28 15:30 upstream ed8780e3f2ec 96e03c1c .config console log report syz C ci-upstream-gce-leak
2020/10/28 00:06 upstream 8c2ab803e565 96e03c1c .config console log report syz C ci-upstream-gce-leak
2020/10/27 12:26 upstream 4525c8781ec0 94942294 .config console log report syz C ci-upstream-gce-leak
2020/10/27 12:19 upstream 4525c8781ec0 94942294 .config console log report syz C ci-upstream-gce-leak
2020/10/27 05:36 upstream 41ba50b0572e 8b3eaf58 .config console log report syz C ci-upstream-gce-leak
2020/10/26 23:40 upstream 41ba50b0572e 8b3eaf58 .config console log report syz C ci-upstream-gce-leak
2020/10/26 23:07 upstream 41ba50b0572e 8b3eaf58 .config console log report syz C ci-upstream-gce-leak
2020/10/26 20:55 upstream 3650b228f83a a7aac492 .config console log report syz C ci-upstream-gce-leak
2020/10/25 07:36 upstream d76913908102 a1839e81 .config console log report syz C ci-upstream-gce-leak
2020/10/24 14:10 upstream f11901ed723d a1839e81 .config console log report syz C ci-upstream-gce-leak
2020/10/24 13:28 upstream f11901ed723d a1839e81 .config console log report syz C ci-upstream-gce-leak
2020/10/24 11:16 upstream f11901ed723d 2bb6666c .config console log report syz C ci-upstream-gce-leak
2020/10/23 13:20 upstream f9893351acae 4e740c00 .config console log report syz C ci-upstream-gce-leak
2020/10/22 22:23 upstream 96485e446260 4e740c00 .config console log report syz C ci-upstream-gce-leak
2020/10/22 11:07 upstream f804b3159482 be6b1582 .config console log report syz C ci-upstream-gce-leak
2020/10/22 03:23 upstream f804b3159482 be6b1582 .config console log report syz C ci-upstream-gce-leak
2020/10/21 13:39 upstream c4d6fe731176 99c64d5c .config console log report syz C ci-upstream-gce-leak
2020/10/21 13:28 upstream c4d6fe731176 99c64d5c .config console log report syz C ci-upstream-gce-leak
* Struck through repros no longer work on HEAD.