Hello, The following program causes memory leak of 6 objects allocated in mkiss_open:
// autogenerated by syzkaller (http://github.com/google/syzkaller) #include <sys/types.h> #include <sys/stat.h> #include <fcntl.h> #include <sys/ioctl.h> #include <stdlib.h> #include <linux/tty.h> int main(int argc, char **argv) { int fd, val; fd = open("/dev/ptmx", O_RDWR); val = N_AX25; ioctl(fd, TIOCSETD, &val); return 0; } unreferenced object 0xffff8800628991d8 (size 4096): comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 61 78 30 00 00 00 00 00 ........ax0..... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slub.c:1337 [< inline >] slab_alloc_node mm/slub.c:2596 [< inline >] slab_alloc mm/slub.c:2604 [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564 [< inline >] kmalloc include/linux/slab.h:468 [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607 [<ffffffff85551442>] alloc_netdev_mqs+0x82/0xd20 net/core/dev.c:7387 [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707 [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2655 [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff8800652b1aa0 (size 96): comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s) hex dump (first 32 bytes): b8 94 89 62 00 88 ff ff b8 94 89 62 00 88 ff ff ...b.......b.... 98 92 9c aa b0 40 02 00 00 00 00 00 00 00 00 00 .....@.......... backtrace: [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slub.c:1337 [< inline >] slab_alloc_node mm/slub.c:2596 [< inline >] slab_alloc mm/slub.c:2604 [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621 [< inline >] kmalloc include/linux/slab.h:463 [<ffffffff8557a4e2>] __hw_addr_create_ex+0x62/0x240 net/core/dev_addr_lists.c:34 [<ffffffff8557a7bc>] __hw_addr_add_ex+0xfc/0x270 net/core/dev_addr_lists.c:80 [< inline >] __hw_addr_add net/core/dev_addr_lists.c:88 [<ffffffff8557ac35>] dev_addr_init+0x105/0x1c0 net/core/dev_addr_lists.c:371 [<ffffffff855514f0>] alloc_netdev_mqs+0x130/0xd20 net/core/dev.c:7400 [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707 [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2655 [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff8800620b6a48 (size 512): comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s) hex dump (first 32 bytes): e0 91 89 62 00 88 ff ff 40 20 68 88 ff ff ff ff ...b....@ h..... 40 20 68 88 ff ff ff ff 00 00 00 00 00 00 00 00 @ h............. backtrace: [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slub.c:1337 [< inline >] slab_alloc_node mm/slub.c:2596 [< inline >] slab_alloc mm/slub.c:2604 [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564 [< inline >] kmalloc include/linux/slab.h:468 [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607 [< inline >] netif_alloc_netdev_queues net/core/dev.c:6870 [<ffffffff85551a4c>] alloc_netdev_mqs+0x68c/0xd20 net/core/dev.c:7430 [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707 [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2655 [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff88006544ce10 (size 128): comm "a.out", pid 7081, jiffies 4294920662 (age 35.917s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slub.c:1337 [< inline >] slab_alloc_node mm/slub.c:2596 [< inline >] slab_alloc mm/slub.c:2604 [<ffffffff8176b585>] __kmalloc+0x1c5/0x3a0 mm/slub.c:3564 [< inline >] kmalloc include/linux/slab.h:468 [<ffffffff8554c93e>] kzalloc+0x1e/0x30 include/linux/slab.h:607 [< inline >] netif_alloc_rx_queues net/core/dev.c:6828 [<ffffffff85551bcc>] alloc_netdev_mqs+0x80c/0xd20 net/core/dev.c:7436 [<ffffffff83ef39da>] mkiss_open+0xaa/0xc30 drivers/net/hamradio/mkiss.c:707 [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2655 [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 [<ffffffffffffffff>] 0xffffffffffffffff unreferenced object 0xffff880062a09860 (size 8): comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s) hex dump (first 8 bytes): 61 78 30 00 00 88 ff ff ax0..... backtrace: [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slub.c:1337 [< inline >] slab_alloc_node mm/slub.c:2596 [< inline >] slab_alloc mm/slub.c:2604 [<ffffffff8176ee99>] __kmalloc_track_caller+0x1b9/0x380 mm/slub.c:4068 [<ffffffff816bbc89>] kstrdup+0x39/0x70 mm/util.c:53 [<ffffffff816bbd06>] kstrdup_const+0x46/0x60 mm/util.c:74 [<ffffffff82c3acce>] kvasprintf_const+0x10e/0x160 lib/kasprintf.c:47 [<ffffffff82c0cb96>] kobject_set_name_vargs+0x56/0x140 lib/kobject.c:265 [<ffffffff835aa0d4>] dev_set_name+0xa4/0xc0 drivers/base/core.c:937 [<ffffffff855c0eb3>] netdev_register_kobject+0xc3/0x3e0 net/core/net-sysfs.c:1531 [<ffffffff85571863>] register_netdevice+0x8f3/0xdb0 net/core/dev.c:6986 [<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098 [<ffffffff83ef3f64>] mkiss_open+0x634/0xc30 drivers/net/hamradio/mkiss.c:735 [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2655 [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 unreferenced object 0xffff880065785f48 (size 256): comm "a.out", pid 7081, jiffies 4294920662 (age 35.963s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff a0 7f cf 89 ff ff ff ff ................ backtrace: [<ffffffff86680923>] kmemleak_alloc+0x63/0xa0 mm/kmemleak.c:916 [< inline >] kmemleak_alloc_recursive include/linux/kmemleak.h:47 [< inline >] slab_post_alloc_hook mm/slub.c:1337 [< inline >] slab_alloc_node mm/slub.c:2596 [< inline >] slab_alloc mm/slub.c:2604 [<ffffffff8176ae6e>] kmem_cache_alloc_trace+0x1ee/0x350 mm/slub.c:2621 [< inline >] kzalloc include/linux/slab.h:463 [<ffffffff835ae60d>] device_private_init+0x4d/0x180 drivers/base/core.c:993 [<ffffffff835af5a3>] device_add+0xe63/0x1480 drivers/base/core.c:1037 [<ffffffff855c0f77>] netdev_register_kobject+0x187/0x3e0 net/core/net-sysfs.c:1550 [<ffffffff85571863>] register_netdevice+0x8f3/0xdb0 net/core/dev.c:6986 [<ffffffff85571d3a>] register_netdev+0x1a/0x30 net/core/dev.c:7098 [<ffffffff83ef3f64>] mkiss_open+0x634/0xc30 drivers/net/hamradio/mkiss.c:735 [<ffffffff82fbd258>] tty_ldisc_open.isra.2+0x78/0xd0 drivers/tty/tty_ldisc.c:454 [<ffffffff82fbd842>] tty_set_ldisc+0x292/0x8a0 drivers/tty/tty_ldisc.c:561 [< inline >] tiocsetd drivers/tty/tty_io.c:2655 [<ffffffff82fa651e>] tty_ioctl+0xb2e/0x2160 drivers/tty/tty_io.c:2910 [< inline >] vfs_ioctl fs/ioctl.c:43 [<ffffffff8180597c>] do_vfs_ioctl+0x18c/0xfb0 fs/ioctl.c:674 [< inline >] SYSC_ioctl fs/ioctl.c:689 [<ffffffff8180682f>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:680 [<ffffffff8669ddb6>] entry_SYSCALL_64_fastpath+0x16/0x7a arch/x86/entry/entry_64.S:185 [<ffffffffffffffff>] 0xffffffffffffffff On commit 23300f657594656e7ebac3130b43460ebc4381cc (Feb 19).
