memory leak in gsm_activate_mux

Status: upstream: reported C repro on 2023/09/15 06:29
Subsystems: serial
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+b5d1f455d385b2c7da3c@syzkaller.appspotmail.com
First crash: 1134d, last: 7d05h
▶ ▼ ✨ AI Jobs (8)
ID Workflow Result Correct Bug Created Started Finished Revision
bba51275 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in gsm_activate_mux 2026/09/04 05:33 2026/09/04 05:33 2026/09/04 06:10 801f0966
4318cdea assessment-security 💥 memory leak in gsm_activate_mux 2026/08/05 00:04 2026/08/05 00:04 2026/08/05 00:04 d4abbeac
d6ccc352 assessment-security 💥 memory leak in gsm_activate_mux 2026/07/05 05:43 2026/07/05 05:43 2026/07/05 05:59 93f57954
a0a6c68a assessment-security 💥 memory leak in gsm_activate_mux 2026/06/18 05:16 2026/06/18 05:16 2026/06/18 05:31 b62b3ded
098b6833 assessment-security 💥 memory leak in gsm_activate_mux 2026/06/10 01:13 2026/06/10 01:13 2026/06/10 01:30 c36c07f6
0976464c assessment-security 💥 memory leak in gsm_activate_mux 2026/06/04 03:30 2026/06/04 03:30 2026/06/04 03:44 62fe1528
dc7ef8bb assessment-security 💥 memory leak in gsm_activate_mux 2026/06/01 18:20 2026/06/01 18:20 2026/06/01 18:44 386cc6da
ade5e3aa assessment-security 💥 memory leak in gsm_activate_mux 2026/05/17 15:35 2026/05/17 15:35 2026/05/17 15:53 de5aae85
▶ ▼ Discussions (9)
Title Replies (including bot) Last reply
[syzbot] Monthly serial report (Oct 2026) 0 (1) 2026/10/05 20:33
[syzbot] Monthly serial report (Aug 2026) 0 (1) 2026/08/04 12:32
[syzbot] [serial?] memory leak in gsm_activate_mux 0 (3) 2026/07/06 14:26
[PATCH] tty: n_gsm: fix memory leak in gsm_activate_mux 2 (2) 2026/05/11 14:44
[PATCH] tty: n_gsm: fix memory leak in gsm_activate_mux 1 (2) 2026/04/22 18:04
Re: [PATCH] tty: fix memory leak in gsm_activate_mux 7 (7) 2023/09/20 06:38
Re: [PATCH] tty: fix memory leak in gsm_activate_mux 1 (1) 2023/09/18 12:02
Re: [PATCH] tty: fix memory leak in gsm_activate_mux 1 (1) 2023/09/18 09:13
Re: [PATCH] tty: fix memory leak in gsm_activate_mux 1 (1) 2023/09/18 08:06
▶ ▼ Last patch testing requests (15)
Created Duration User Patch Repo Result
2026/10/12 15:53 24m retest repro upstream report job log log
2026/10/12 15:53 38m retest repro upstream report job log log
2026/10/12 15:53 28m retest repro upstream report job log log
2026/07/23 20:40 3h07m retest repro upstream report log
2026/07/23 20:40 5h53m retest repro upstream report log
2026/07/06 14:26 28m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda OK log
2026/07/06 12:16 21m dmantipov@yandex.ru https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 8cdeaa50eae8dad34885515f62559ee83e7e8dda report log
2026/05/10 23:28 44m retest repro upstream report log
2026/04/22 17:37 26m s9430939@naver.com patch git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty.git tty-next OK log
2026/03/01 18:26 12m retest repro upstream report log
2026/03/01 18:15 14m retest repro upstream report log
2025/12/21 17:45 18m retest repro upstream report log
2025/10/12 17:10 12m retest repro upstream report log
2023/09/15 10:07 18m eadavis@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f97e18a3f2fb OK log
2023/09/15 09:27 10m eadavis@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f97e18a3f2fb error

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888112aca000 (size 1024):
  comm "syz.4.21", pid 6097, jiffies 4294943407
  hex dump (first 32 bytes):
    00 fc b8 13 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc edd4fe8f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    gsm_dlci_alloc+0x29/0x1b0 drivers/tty/n_gsm.c:2648
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812cf5e000 (size 4096):
  comm "syz.4.21", pid 6097, jiffies 4294943407
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_node_noprof+0x412/0x560 mm/slub.c:5426
    _kmalloc_array_node_noprof include/linux/slab.h:1297 [inline]
    __kfifo_alloc_node+0x95/0x100 lib/kfifo.c:44
    __kfifo_alloc include/linux/kfifo.h:932 [inline]
    gsm_dlci_alloc+0x6b/0x1b0 drivers/tty/n_gsm.c:2653
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881097f0c00 (size 1024):
  comm "syz.0.27", pid 6098, jiffies 4294943409
  hex dump (first 32 bytes):
    00 e0 e8 02 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc ca5a5e0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    gsm_dlci_alloc+0x29/0x1b0 drivers/tty/n_gsm.c:2648
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881264ce000 (size 4096):
  comm "syz.0.27", pid 6098, jiffies 4294943409
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_node_noprof+0x412/0x560 mm/slub.c:5426
    _kmalloc_array_node_noprof include/linux/slab.h:1297 [inline]
    __kfifo_alloc_node+0x95/0x100 lib/kfifo.c:44
    __kfifo_alloc include/linux/kfifo.h:932 [inline]
    gsm_dlci_alloc+0x6b/0x1b0 drivers/tty/n_gsm.c:2653
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881097f3800 (size 1024):
  comm "syz.2.19", pid 6105, jiffies 4294943433
  hex dump (first 32 bytes):
    00 d0 ae 12 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc e7a8c109):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    gsm_dlci_alloc+0x29/0x1b0 drivers/tty/n_gsm.c:2648
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126761000 (size 4096):
  comm "syz.2.19", pid 6105, jiffies 4294943433
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_node_noprof+0x412/0x560 mm/slub.c:5426
    _kmalloc_array_node_noprof include/linux/slab.h:1297 [inline]
    __kfifo_alloc_node+0x95/0x100 lib/kfifo.c:44
    __kfifo_alloc include/linux/kfifo.h:932 [inline]
    gsm_dlci_alloc+0x6b/0x1b0 drivers/tty/n_gsm.c:2653
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126032c00 (size 1024):
  comm "syz.1.18", pid 6106, jiffies 4294943439
  hex dump (first 32 bytes):
    00 0c ae 12 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc ecbb24ff):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    gsm_dlci_alloc+0x29/0x1b0 drivers/tty/n_gsm.c:2648
    gsm_activate_mux+0x1a/0x1a0 drivers/tty/n_gsm.c:3189
    gsm_config_ext drivers/tty/n_gsm.c:3494 [inline]
    gsmld_ioctl+0x1b8/0x9e0 drivers/tty/n_gsm.c:3858
    tty_ioctl+0xabc/0xd50 drivers/tty/tty_io.c:2774
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/28 01:26 upstream efb44d93a620 a3c7249d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in gsm_activate_mux
2026/07/08 21:39 upstream 0e35b9b6ec0f ab40da58 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in gsm_activate_mux
2024/01/05 05:18 upstream 5eff55d725a4 28c42cff .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in gsm_activate_mux
2023/09/11 06:23 upstream 0bb80ecc33a8 6654cf89 .config console log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in gsm_activate_mux
* Struck through repros no longer work on HEAD.