Dear Linux Developers for DVB,
We encountered "memory leak in dvb_dvr_do_ioctl" when testing the
DVB driver with Syzkaller and our generated specifications.
The C reproducer and the config for the kernel are attached.
```
BUG: memory leak
unreferenced object 0xffffc9000ae81000 (size 4096):
comm "syz-executor.0", pid 23888, jiffies 4295016268 (age 8.980s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8541ee5e>] create_object mm/kmemleak.c:761 [inline]
[<ffffffff8541ee5e>] kmemleak_vmalloc+0x2e/0x90 mm/kmemleak.c:1082
[<ffffffff816382f6>] __vmalloc_node_range+0xc76/0xdb0 mm/vmalloc.c:3348
[<ffffffff816386c2>] __vmalloc_node mm/vmalloc.c:3385 [inline]
[<ffffffff816386c2>] vmalloc+0x52/0x60 mm/vmalloc.c:3418
[<ffffffff83db1c8c>] dvb_dvr_set_buffer_size
drivers/media/dvb-core/dmxdev.c:293 [inline]
[<ffffffff83db1c8c>] dvb_dvr_do_ioctl+0x12c/0x2a0
drivers/media/dvb-core/dmxdev.c:1296
[<ffffffff83db1252>] dvb_usercopy+0x82/0x220
drivers/media/dvb-core/dvbdev.c:986
[<ffffffff83db1b11>] dvb_dvr_ioctl+0x31/0x40
drivers/media/dvb-core/dmxdev.c:1333
[<ffffffff8171ca88>] vfs_ioctl fs/ioctl.c:51 [inline]
[<ffffffff8171ca88>] __do_sys_ioctl fs/ioctl.c:871 [inline]
[<ffffffff8171ca88>] __se_sys_ioctl fs/ioctl.c:857 [inline]
[<ffffffff8171ca88>] __x64_sys_ioctl+0x108/0x150 fs/ioctl.c:857
[<ffffffff8540b150>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff8540b150>] do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
[<ffffffff8560008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
```
The memory leak originates from the allocated memory `newmem = vmalloc(size);`,
as referenced in the code at
[https://elixir.bootlin.com/linux/latest/source/drivers/media/dvb-core/dmxdev.c#L293].
Besides, this memory leak is triggered when enabling
`CONFIG_DVB_MMAP=y`, which will be used when freeing the memory in
`dvb_dvr_release`
(https://elixir.bootlin.com/linux/latest/source/drivers/media/dvb-core/dmxdev.c#L214).
If you have any questions or require more information, please feel
free to contact us.
Reported-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx>
Best,
Chenyuan
Attachment:
config
Description: Binary data
Attachment:
dvb_ioctl_memleak.c
Description: Binary data
