memory leak in snd_pcm_hw_params

Status: fixed on 2020/02/18 14:31
Subsystems: sound
[Documentation on labels]
Reported-by: syzbot+30edd0f34bfcdc548ac4@syzkaller.appspotmail.com
Fix commit: 66f2d19f8116 ALSA: pcm: Fix memory leak at closing a stream without hw_free
First crash: 2376d, last: 2368d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH 5.5 000/367] 5.5.3-stable review 385 (385) 2020/02/12 07:27
memory leak in snd_pcm_hw_params 0 (1) 2020/01/29 16:06

Sample crash report:
executing program
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff8881188c5380 (size 64):
  comm "syz-executor317", pid 7263, jiffies 4294945078 (age 13.870s)
  hex dump (first 32 bytes):
    07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 10 42 08 00 c9 ff ff 00 00 00 00 00 00 00 00  ..B.............
  backtrace:
    [<0000000065375c92>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000065375c92>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<0000000065375c92>] slab_alloc mm/slab.c:3320 [inline]
    [<0000000065375c92>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
    [<00000000063e2ce3>] kmalloc include/linux/slab.h:555 [inline]
    [<00000000063e2ce3>] kzalloc include/linux/slab.h:669 [inline]
    [<00000000063e2ce3>] snd_pcm_lib_malloc_pages+0x12b/0x200 sound/core/pcm_memory.c:404
    [<000000007570b850>] snd_pcm_hw_params+0x720/0x830 sound/core/pcm_native.c:691
    [<00000000b73219eb>] snd_pcm_kernel_ioctl+0xb5/0x170 sound/core/pcm_native.c:3238
    [<0000000052ef9624>] snd_pcm_oss_change_params_locked+0x745/0x1140 sound/core/oss/pcm_oss.c:944
    [<0000000085f0e124>] snd_pcm_oss_change_params+0x43/0x80 sound/core/oss/pcm_oss.c:1087
    [<00000000e03394e9>] snd_pcm_oss_make_ready+0x55/0xc0 sound/core/oss/pcm_oss.c:1146
    [<000000007040c7d7>] snd_pcm_oss_sync.isra.0+0xb8/0x310 sound/core/oss/pcm_oss.c:1707
    [<00000000ce509083>] snd_pcm_oss_release+0xef/0x100 sound/core/oss/pcm_oss.c:2545
    [<00000000571d4e73>] __fput+0xed/0x300 fs/file_table.c:280
    [<000000004233d05e>] ____fput+0x16/0x20 fs/file_table.c:313
    [<000000001e6ffb23>] task_work_run+0x9d/0xc0 kernel/task_work.c:113
    [<0000000085feb841>] exit_task_work include/linux/task_work.h:22 [inline]
    [<0000000085feb841>] do_exit+0x3fa/0xe20 kernel/exit.c:801
    [<0000000033e0e614>] do_group_exit+0x4b/0xe0 kernel/exit.c:899
    [<00000000ebd36532>] __do_sys_exit_group kernel/exit.c:910 [inline]
    [<00000000ebd36532>] __se_sys_exit_group kernel/exit.c:908 [inline]
    [<00000000ebd36532>] __x64_sys_exit_group+0x1c/0x20 kernel/exit.c:908
    [<000000001d40b338>] do_syscall_64+0x73/0x220 arch/x86/entry/common.c:294

BUG: memory leak
unreferenced object 0xffff8881188c5300 (size 64):
  comm "syz-executor317", pid 7264, jiffies 4294945676 (age 7.890s)
  hex dump (first 32 bytes):
    07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 d0 ae 08 00 c9 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000065375c92>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000065375c92>] slab_post_alloc_hook mm/slab.h:586 [inline]
    [<0000000065375c92>] slab_alloc mm/slab.c:3320 [inline]
    [<0000000065375c92>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3549
    [<00000000063e2ce3>] kmalloc include/linux/slab.h:555 [inline]
    [<00000000063e2ce3>] kzalloc include/linux/slab.h:669 [inline]
    [<00000000063e2ce3>] snd_pcm_lib_malloc_pages+0x12b/0x200 sound/core/pcm_memory.c:404
    [<000000007570b850>] snd_pcm_hw_params+0x720/0x830 sound/core/pcm_native.c:691
    [<00000000b73219eb>] snd_pcm_kernel_ioctl+0xb5/0x170 sound/core/pcm_native.c:3238
    [<0000000052ef9624>] snd_pcm_oss_change_params_locked+0x745/0x1140 sound/core/oss/pcm_oss.c:944
    [<0000000085f0e124>] snd_pcm_oss_change_params+0x43/0x80 sound/core/oss/pcm_oss.c:1087
    [<00000000e03394e9>] snd_pcm_oss_make_ready+0x55/0xc0 sound/core/oss/pcm_oss.c:1146
    [<000000007040c7d7>] snd_pcm_oss_sync.isra.0+0xb8/0x310 sound/core/oss/pcm_oss.c:1707
    [<00000000ce509083>] snd_pcm_oss_release+0xef/0x100 sound/core/oss/pcm_oss.c:2545
    [<00000000571d4e73>] __fput+0xed/0x300 fs/file_table.c:280
    [<000000004233d05e>] ____fput+0x16/0x20 fs/file_table.c:313
    [<000000001e6ffb23>] task_work_run+0x9d/0xc0 kernel/task_work.c:113
    [<0000000085feb841>] exit_task_work include/linux/task_work.h:22 [inline]
    [<0000000085feb841>] do_exit+0x3fa/0xe20 kernel/exit.c:801
    [<0000000033e0e614>] do_group_exit+0x4b/0xe0 kernel/exit.c:899
    [<00000000ebd36532>] __do_sys_exit_group kernel/exit.c:910 [inline]
    [<00000000ebd36532>] __se_sys_exit_group kernel/exit.c:908 [inline]
    [<00000000ebd36532>] __x64_sys_exit_group+0x1c/0x20 kernel/exit.c:908
    [<000000001d40b338>] do_syscall_64+0x73/0x220 arch/x86/entry/common.c:294

BUG: memory leak
unreferenced object 0xffffc90008aed000 (size 2097152):
  comm "syz-executor317", pid 7264, jiffies 4294945676 (age 7.890s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000ee45b0e9>] __vmalloc_node_range+0x288/0x300 mm/vmalloc.c:2565
    [<00000000a3480908>] __vmalloc_node mm/vmalloc.c:2609 [inline]
    [<00000000a3480908>] __vmalloc+0x44/0x50 mm/vmalloc.c:2615
    [<00000000bf7c9d21>] snd_dma_alloc_pages+0x137/0x1e0 sound/core/memalloc.c:146
    [<0000000069589e81>] do_alloc_pages+0x63/0xc0 sound/core/pcm_memory.c:42
    [<00000000dd98cf84>] snd_pcm_lib_malloc_pages+0x16d/0x200 sound/core/pcm_memory.c:408
    [<000000007570b850>] snd_pcm_hw_params+0x720/0x830 sound/core/pcm_native.c:691
    [<00000000b73219eb>] snd_pcm_kernel_ioctl+0xb5/0x170 sound/core/pcm_native.c:3238
    [<0000000052ef9624>] snd_pcm_oss_change_params_locked+0x745/0x1140 sound/core/oss/pcm_oss.c:944
    [<0000000085f0e124>] snd_pcm_oss_change_params+0x43/0x80 sound/core/oss/pcm_oss.c:1087
    [<00000000e03394e9>] snd_pcm_oss_make_ready+0x55/0xc0 sound/core/oss/pcm_oss.c:1146
    [<000000007040c7d7>] snd_pcm_oss_sync.isra.0+0xb8/0x310 sound/core/oss/pcm_oss.c:1707
    [<00000000ce509083>] snd_pcm_oss_release+0xef/0x100 sound/core/oss/pcm_oss.c:2545
    [<00000000571d4e73>] __fput+0xed/0x300 fs/file_table.c:280
    [<000000004233d05e>] ____fput+0x16/0x20 fs/file_table.c:313
    [<000000001e6ffb23>] task_work_run+0x9d/0xc0 kernel/task_work.c:113
    [<0000000085feb841>] exit_task_work include/linux/task_work.h:22 [inline]
    [<0000000085feb841>] do_exit+0x3fa/0xe20 kernel/exit.c:801

Crashes (25):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/02/06 05:52 upstream 4c7d00ccf40d 662cf49a .config console log report syz C ci-upstream-gce-leak
2020/02/06 04:53 upstream 4c7d00ccf40d 662cf49a .config console log report syz C ci-upstream-gce-leak
2020/02/05 16:54 upstream 6992ca0dd017 662cf49a .config console log report syz C ci-upstream-gce-leak
2020/02/05 16:38 upstream 6992ca0dd017 662cf49a .config console log report syz C ci-upstream-gce-leak
2020/02/05 03:59 upstream 33b40134e5cf 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/04 22:06 upstream 33b40134e5cf 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/04 14:07 upstream 322bf2d3446a 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/04 08:19 upstream 322bf2d3446a 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/03 14:31 upstream 46d6b7becb1d 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/03 06:23 upstream 46d6b7becb1d 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/02 22:40 upstream 46d6b7becb1d 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/02 18:24 upstream 94f2630b1897 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/02 15:16 upstream 94f2630b1897 93e5e335 .config console log report syz C ci-upstream-gce-leak
2020/02/02 00:01 upstream 94f2630b1897 2274ad39 .config console log report syz C ci-upstream-gce-leak
2020/02/01 12:13 upstream 26dca6dbd62d 0eb59c27 .config console log report syz C ci-upstream-gce-leak
2020/02/01 10:51 upstream 26dca6dbd62d 0eb59c27 .config console log report syz C ci-upstream-gce-leak
2020/01/31 19:59 upstream ccaaaf6fe5a5 c30117b2 .config console log report syz C ci-upstream-gce-leak
2020/01/31 16:22 upstream ccaaaf6fe5a5 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/31 02:00 upstream 9f68e3655aae 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/31 01:37 upstream 9f68e3655aae 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/30 14:35 upstream 39bed42de2e7 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/30 06:54 upstream 39bed42de2e7 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/29 22:05 upstream b3a608222336 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/29 20:02 upstream b3a608222336 5ed23f9a .config console log report syz C ci-upstream-gce-leak
2020/01/29 12:53 upstream b3a608222336 c8e81ce4 .config console log report syz C ci-upstream-gce-leak
* Struck through repros no longer work on HEAD.