Messages in this thread | | | From | Dmitry Vyukov <> | Date | Thu, 4 Feb 2016 14:15:14 +0100 | Subject | Re: gigaset: memory leak in gigaset_initcshw |
| |
On Thu, Feb 4, 2016 at 2:09 PM, Paul Bolle <pebolle@tiscali.nl> wrote: > On do, 2016-02-04 at 11:40 +0100, Dmitry Vyukov wrote: >> Forgot to mention that you need to run it in a parallel loop, sorry. > > I see. > >> This one should do: >> >> // autogenerated by syzkaller (http://github.com/google/syzkaller) >> #include <pthread.h> >> #include <stdint.h> >> #include <stdlib.h> >> #include <string.h> >> #include <sys/syscall.h> >> #include <unistd.h> >> #include <sys/types.h> >> #include <sys/wait.h> >> >> void work() >> { >> long r[7]; >> memset(r, -1, sizeof(r)); >> r[0] = syscall(SYS_mmap, 0x20000000ul, 0x10000ul, 0x3ul, 0x32ul, >> 0xfffffffffffffffful, 0x0ul); >> r[2] = syscall(SYS_open, "/dev/ptmx", 0x8002ul, 0x0ul, 0, 0, 0); >> *(uint32_t*)0x20002b1e = (uint32_t)0x10; >> r[4] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20002b1eul, 0, 0, 0); >> *(uint32_t*)0x20009000 = (uint32_t)0x7; >> r[6] = syscall(SYS_ioctl, r[2], 0x5423ul, 0x20009000ul, 0, 0, 0); >> } >> >> int main() { >> int running, status; > > (gcc complained about "running" being used uninitialized, though a few > mock runs suggest it got initialized to 0 anyhow. I initialized > "running" to 0 explicitly for the real runs.) > >> for (;;) { >> while (running < 32) { >> if (fork() == 0) { >> work(); >> exit(0); >> } >> running++; >> } >> if (wait(&status) > 0) >> running--; >> } >> } > > (Note to self: this hammers my laptop with about 2.000 runs per second. > After some time systemd's logging appears to have trouble handling the > output this reproducer generates, so maybe messages end up getting > dropped.) > >> While running it, sample/proc/slabinfo with: >> >> # cat /proc/slabinfo | egrep "^kmalloc-2048" >> >> It constantly grows. > > I don't really know how /proc/slabinfo should be interpreted, sorry. But > the interesting fields appear to be "<active_objs>" and "<num_objs>". > "<num_objs>" seems to be stable here (during the runs of a few minutes > that I dare to inflict on my laptop). "<active_objs>" is more volatile. > But I also saw it going down while the reproducer was running. > > What are you seeing here?
I see that active_objs is slowly, constantly growing.
I've attached my config file, please try with it. You mentioned that "16 is N_GIGASET_M101, while 7 is N_6PACK", probably one of these ttys is not enabled in your config, and so the reproducer is not doing anything useful. [unhandled content-type:application/octet-stream] | |