memory leak in usb_urb_init

Status: fixed on 2021/11/10 00:50
Subsystems: media usb
[Documentation on labels]
Reported-by: syzbot+3c2be7424cea3b932b0e@syzkaller.appspotmail.com
Fix commit: b7cd0da982e3 media: dvb-usb: fix memory leak in dvb_usb_adapter_init
First crash: 2040d, last: 2040d
▶ ▼ Discussions (15)
Title Replies (including bot) Last reply
[PATCH 4.19 000/425] 4.19.191-rc1 review 438 (438) 2021/06/24 10:04
[PATCH 5.4 000/184] 5.4.118-rc1 review 201 (201) 2021/06/18 09:41
[PATCH 5.10 000/299] 5.10.36-rc1 review 323 (323) 2021/05/28 16:59
[PATCH 4.9 000/240] 4.9.269-rc1 review 245 (245) 2021/05/21 16:52
[PATCH 4.14 000/323] 4.14.233-rc1 review 326 (326) 2021/05/21 05:55
[PATCH 4.4 000/190] 4.4.269-rc1 review 196 (196) 2021/05/20 21:46
[PATCH 5.11 000/342] 5.11.20-rc1 review 354 (354) 2021/05/12 06:38
[PATCH 5.12 000/384] 5.12.3-rc1 review 395 (395) 2021/05/11 21:07
[PATCH AUTOSEL 4.9 01/24] scsi: target: pscsi: Fix warning in pscsi_complete_cmd() 26 (26) 2021/05/07 10:59
[PATCH AUTOSEL 4.4 01/16] scsi: target: pscsi: Fix warning in pscsi_complete_cmd() 16 (16) 2021/05/03 16:43
[PATCH AUTOSEL 4.14 01/31] scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe 31 (31) 2021/05/03 16:42
[PATCH AUTOSEL 4.19 01/35] scsi: lpfc: Fix incorrect dbde assignment when building target abts wqe 35 (35) 2021/05/03 16:41
[PATCH AUTOSEL 5.4 01/57] drm: Added orientation quirk for OneGX1 Pro 57 (57) 2021/05/03 16:39
[PATCH] usb: dvb-usb: fix memory leak in dvb_usb_adapter_init 1 (1) 2021/03/28 19:32
memory leak in usb_urb_init 0 (1) 2021/01/05 02:49
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2021/03/28 16:57 15m paskripkin@gmail.com https://linux.googlesource.com/linux/kernel/git/torvalds/linux refs/changes/38/9538/1 OK
2021/03/25 21:12 8m igormtorrente@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ master report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888114a12180 (size 192):
  comm "kworker/1:3", pid 8132, jiffies 4294980969 (age 13.460s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 98 21 a1 14 81 88 ff ff  .........!......
  backtrace:
    [<00000000270adc89>] kmalloc include/linux/slab.h:557 [inline]
    [<00000000270adc89>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007ddd474e>] usb_bulk_urb_init drivers/media/usb/dvb-usb/usb-urb.c:148 [inline]
    [<000000007ddd474e>] usb_urb_init+0x17a/0x3d0 drivers/media/usb/dvb-usb/usb-urb.c:229
    [<00000000bdcce353>] dvb_usb_adapter_stream_init+0x5b/0x120 drivers/media/usb/dvb-usb/dvb-usb-urb.c:108
    [<00000000adc3ae74>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:82 [inline]
    [<00000000adc3ae74>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:173 [inline]
    [<00000000adc3ae74>] dvb_usb_device_init.cold+0x483/0x6ae drivers/media/usb/dvb-usb/dvb-usb-init.c:287
    [<00000000979fb93a>] m920x_probe+0x1d7/0x470 drivers/media/usb/dvb-usb/m920x.c:834
    [<00000000dc58d155>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<0000000011b900cd>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<000000003bf38880>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<000000003450ad28>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000005a93a91d>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<0000000058084795>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<00000000e0d09782>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<000000004566d8b7>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<000000000471371f>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000d93dc50f>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<00000000a0057c67>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293

BUG: memory leak
unreferenced object 0xffff888114a126c0 (size 192):
  comm "kworker/1:3", pid 8132, jiffies 4294980969 (age 13.460s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 d8 26 a1 14 81 88 ff ff  .........&......
  backtrace:
    [<00000000270adc89>] kmalloc include/linux/slab.h:557 [inline]
    [<00000000270adc89>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007ddd474e>] usb_bulk_urb_init drivers/media/usb/dvb-usb/usb-urb.c:148 [inline]
    [<000000007ddd474e>] usb_urb_init+0x17a/0x3d0 drivers/media/usb/dvb-usb/usb-urb.c:229
    [<00000000bdcce353>] dvb_usb_adapter_stream_init+0x5b/0x120 drivers/media/usb/dvb-usb/dvb-usb-urb.c:108
    [<00000000adc3ae74>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:82 [inline]
    [<00000000adc3ae74>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:173 [inline]
    [<00000000adc3ae74>] dvb_usb_device_init.cold+0x483/0x6ae drivers/media/usb/dvb-usb/dvb-usb-init.c:287
    [<00000000979fb93a>] m920x_probe+0x1d7/0x470 drivers/media/usb/dvb-usb/m920x.c:834
    [<00000000dc58d155>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<0000000011b900cd>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<000000003bf38880>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<000000003450ad28>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000005a93a91d>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<0000000058084795>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<00000000e0d09782>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<000000004566d8b7>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<000000000471371f>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000d93dc50f>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<00000000a0057c67>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293

BUG: memory leak
unreferenced object 0xffff888114bbf900 (size 192):
  comm "kworker/1:3", pid 8132, jiffies 4294980969 (age 13.460s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 18 f9 bb 14 81 88 ff ff  ................
  backtrace:
    [<00000000270adc89>] kmalloc include/linux/slab.h:557 [inline]
    [<00000000270adc89>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007ddd474e>] usb_bulk_urb_init drivers/media/usb/dvb-usb/usb-urb.c:148 [inline]
    [<000000007ddd474e>] usb_urb_init+0x17a/0x3d0 drivers/media/usb/dvb-usb/usb-urb.c:229
    [<00000000bdcce353>] dvb_usb_adapter_stream_init+0x5b/0x120 drivers/media/usb/dvb-usb/dvb-usb-urb.c:108
    [<00000000adc3ae74>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:82 [inline]
    [<00000000adc3ae74>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:173 [inline]
    [<00000000adc3ae74>] dvb_usb_device_init.cold+0x483/0x6ae drivers/media/usb/dvb-usb/dvb-usb-init.c:287
    [<00000000979fb93a>] m920x_probe+0x1d7/0x470 drivers/media/usb/dvb-usb/m920x.c:834
    [<00000000dc58d155>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<0000000011b900cd>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<000000003bf38880>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<000000003450ad28>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000005a93a91d>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<0000000058084795>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<00000000e0d09782>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<000000004566d8b7>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<000000000471371f>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000d93dc50f>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
    [<00000000a0057c67>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/01/01 02:42 upstream f6e1ea196492 79264ae3 .config console log report syz C ci-upstream-gce-leak
* Struck through repros no longer work on HEAD.