Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1326785

Re: gigaset: memory leak in gigaset_initcshw

Show all headers | View raw

On do, 2016-02-04 at 11:40 +0100, Dmitry Vyukov wrote:
> Forgot to mention that you need to run it in a parallel loop, sorry.

I see.

> This one should do:
> 
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <stdint.h>
> #include <stdlib.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> #include <sys/types.h>
> #include <sys/wait.h>
> 
> void work()
> {
>   long r[7];
>   memset(r, -1, sizeof(r));
>   r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul,
>                  0xfffffffffffffffful, 0x0ul);
>   r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0);
>   *(uint32_t*)0x20002b1e = (uint32_t)0x10;
>   r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0);
>   *(uint32_t*)0x20009000 = (uint32_t)0x7;
>   r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0);
> }
> 
> int main() {
>   int running, status;

(gcc complained about "running" being used uninitialized, though a few
mock runs suggest it got initialized to 0 anyhow. I initialized
"running" to 0 explicitly for the real runs.)

>   for (;;) {
>     while (running < 32) {
>       if (fork() == 0) {
>         work();
>         exit(0);
>       }
>       running++;
>     }
>     if (wait(&status) > 0)
>       running--;
>   }
> }

(Note to self: this hammers my laptop with about 2.000 runs per second.
After some time systemd's logging appears to have trouble handling the
output this reproducer generates, so maybe messages end up getting
dropped.)

> While running it, sample/proc/slabinfo with:
> 
> # cat /proc/slabinfo | egrep "^kmalloc-2048"
> 
> It constantly grows.

I don't really know how /proc/slabinfo should be interpreted, sorry. But
the interesting fields appear to be "<active_objs>" and "<num_objs>".
"<num_objs>" seems to be stable here (during the runs of a few minutes
that I dare to inflict on my laptop). "<active_objs>" is more volatile.
But I also saw it going down while the reproducer was running.

What are you seeing here?

Thanks,


Paul Bolle

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

gigaset: memory leak in gigaset_initcshw Dmitry Vyukov <dvyukov@google.com> - 2016-02-03 16:40 +0100
  Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-03 17:20 +0100
    Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-03 20:20 +0100
      Re: gigaset: memory leak in gigaset_initcshw Dmitry Vyukov <dvyukov@google.com> - 2016-02-04 11:50 +0100
        Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-04 14:20 +0100
          Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-04 15:00 +0100
            Re: gigaset: memory leak in gigaset_initcshw Dmitry Vyukov <dvyukov@google.com> - 2016-02-04 16:00 +0100
              Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-04 16:10 +0100
                Re: gigaset: memory leak in gigaset_initcshw Dmitry Vyukov <dvyukov@google.com> - 2016-02-05 14:40 +0100
                Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-05 17:10 +0100
                Re: gigaset: memory leak in gigaset_initcshw Paul Bolle <pebolle@tiscali.nl> - 2016-02-05 19:40 +0100
                Re: gigaset: memory leak in gigaset_initcshw Dmitry Vyukov <dvyukov@google.com> - 2016-02-05 22:30 +0100

csiph-web