linux-kernel - memory leak in proc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0000000000002e72eb058a7000d0@google.com>
Date:   Mon, 03 Jun 2019 12:02:07 -0700
From:   syzbot <syzbot+06780effeefb578dcbfa@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        tglx@...utronix.de
Subject: memory leak in proc_register

Hello,

syzbot found the following crash on:

HEAD commit:    9221dced Merge tag 'for-linus-20190601' of git://git.kerne..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=179a80f2a00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=50393f7bfe444ff6
dashboard link: https://syzkaller.appspot.com/bug?extid=06780effeefb578dcbfa
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12155636a00000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=126f1042a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+06780effeefb578dcbfa@...kaller.appspotmail.com

m
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88821b68d780 (size 128):
   comm "swapper/0", pid 1, jiffies 4294937320 (age 1363.880s)
   hex dump (first 32 bytes):
     ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
     ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
   backtrace:
     [<000000005ff104f1>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:55 [inline]
     [<000000005ff104f1>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000005ff104f1>] slab_alloc mm/slab.c:3326 [inline]
     [<000000005ff104f1>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
     [<000000008feae05f>] kmalloc include/linux/slab.h:547 [inline]
     [<000000008feae05f>] kzalloc include/linux/slab.h:742 [inline]
     [<000000008feae05f>] ida_alloc_range+0x2d6/0x520 lib/idr.c:416
     [<00000000dd09fe3e>] proc_alloc_inum fs/proc/generic.c:209 [inline]
     [<00000000dd09fe3e>] proc_register+0x34/0x200 fs/proc/generic.c:354
     [<00000000433ed329>] proc_mkdir_data+0x89/0xc0 fs/proc/generic.c:476
     [<0000000040802aab>] proc_mkdir+0x22/0x30 fs/proc/generic.c:494
     [<00000000a4ab923e>] register_irq_proc+0xbe/0x1d0 kernel/irq/proc.c:352
     [<00000000204292a9>] init_irq_proc+0x74/0xb0 kernel/irq/proc.c:438
     [<000000002b246fb2>] do_basic_setup init/main.c:1006 [inline]
     [<000000002b246fb2>] kernel_init_freeable+0x12b/0x26c init/main.c:1169
     [<00000000cc140f05>] kernel_init+0x10/0x155 init/main.c:1087
     [<00000000d18604ff>] ret_from_fork+0x1f/0x30  
arch/x86/entry/entry_64.S:352

BUG: memory leak
unreferenced object 0xffff888113775d00 (size 96):
   comm "syz-executor225", pid 7540, jiffies 4295072562 (age 11.510s)
   hex dump (first 32 bytes):
     02 00 00 00 00 00 00 00 70 87 bb 82 ff ff ff ff  ........p.......
     00 00 00 00 00 00 00 00 50 9b bb 82 ff ff ff ff  ........P.......
   backtrace:
     [<000000001a48c6be>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:55 [inline]
     [<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
     [<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0  
mm/slab.c:3597
     [<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
     [<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
     [<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
     [<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
     [<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
     [<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
     [<000000005df86337>] allocate_hook_entries_size+0x3b/0x60  
net/netfilter/core.c:61
     [<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190  
net/netfilter/core.c:248
     [<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0  
net/netfilter/core.c:416
     [<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70  
net/netfilter/core.c:431
     [<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50  
net/netfilter/core.c:499
     [<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30  
security/selinux/hooks.c:7089
     [<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80  
net/core/net_namespace.c:154
     [<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
     [<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
     [<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0  
kernel/nsproxy.c:107
     [<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100  
kernel/nsproxy.c:206
     [<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
     [<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
     [<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
     [<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff888113a5e680 (size 96):
   comm "syz-executor225", pid 7540, jiffies 4295072562 (age 11.510s)
   hex dump (first 32 bytes):
     02 00 00 00 00 00 00 00 90 9b bb 82 ff ff ff ff  ................
     00 00 00 00 00 00 00 00 40 87 bb 82 ff ff ff ff  ........@.......
   backtrace:
     [<000000001a48c6be>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:55 [inline]
     [<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
     [<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0  
mm/slab.c:3597
     [<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
     [<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
     [<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
     [<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
     [<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
     [<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
     [<000000005df86337>] allocate_hook_entries_size+0x3b/0x60  
net/netfilter/core.c:61
     [<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190  
net/netfilter/core.c:248
     [<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0  
net/netfilter/core.c:416
     [<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70  
net/netfilter/core.c:431
     [<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50  
net/netfilter/core.c:499
     [<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30  
security/selinux/hooks.c:7089
     [<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80  
net/core/net_namespace.c:154
     [<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
     [<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
     [<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0  
kernel/nsproxy.c:107
     [<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100  
kernel/nsproxy.c:206
     [<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
     [<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
     [<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
     [<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff888113775d00 (size 96):
   comm "syz-executor225", pid 7540, jiffies 4295072562 (age 14.060s)
   hex dump (first 32 bytes):
     02 00 00 00 00 00 00 00 70 87 bb 82 ff ff ff ff  ........p.......
     00 00 00 00 00 00 00 00 50 9b bb 82 ff ff ff ff  ........P.......
   backtrace:
     [<000000001a48c6be>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:55 [inline]
     [<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
     [<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0  
mm/slab.c:3597
     [<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
     [<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
     [<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
     [<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
     [<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
     [<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
     [<000000005df86337>] allocate_hook_entries_size+0x3b/0x60  
net/netfilter/core.c:61
     [<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190  
net/netfilter/core.c:248
     [<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0  
net/netfilter/core.c:416
     [<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70  
net/netfilter/core.c:431
     [<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50  
net/netfilter/core.c:499
     [<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30  
security/selinux/hooks.c:7089
     [<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80  
net/core/net_namespace.c:154
     [<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
     [<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
     [<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0  
kernel/nsproxy.c:107
     [<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100  
kernel/nsproxy.c:206
     [<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
     [<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
     [<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
     [<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff888113a5e680 (size 96):
   comm "syz-executor225", pid 7540, jiffies 4295072562 (age 14.060s)
   hex dump (first 32 bytes):
     02 00 00 00 00 00 00 00 90 9b bb 82 ff ff ff ff  ................
     00 00 00 00 00 00 00 00 40 87 bb 82 ff ff ff ff  ........@.......
   backtrace:
     [<000000001a48c6be>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:55 [inline]
     [<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
     [<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0  
mm/slab.c:3597
     [<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
     [<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
     [<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
     [<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
     [<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
     [<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
     [<000000005df86337>] allocate_hook_entries_size+0x3b/0x60  
net/netfilter/core.c:61
     [<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190  
net/netfilter/core.c:248
     [<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0  
net/netfilter/core.c:416
     [<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70  
net/netfilter/core.c:431
     [<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50  
net/netfilter/core.c:499
     [<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30  
security/selinux/hooks.c:7089
     [<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80  
net/core/net_namespace.c:154
     [<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
     [<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
     [<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0  
kernel/nsproxy.c:107
     [<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100  
kernel/nsproxy.c:206
     [<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
     [<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
     [<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
     [<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff88811491e580 (size 96):
   comm "syz-executor225", pid 7540, jiffies 4295072562 (age 14.060s)
   hex dump (first 32 bytes):
     02 00 00 00 00 00 00 00 80 66 bb 82 ff ff ff ff  .........f......
     00 00 00 00 00 00 00 00 e0 9a bb 82 ff ff ff ff  ................
   backtrace:
     [<000000001a48c6be>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:55 [inline]
     [<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
     [<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0  
mm/slab.c:3597
     [<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
     [<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
     [<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
     [<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
     [<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
     [<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
     [<000000005df86337>] allocate_hook_entries_size+0x3b/0x60  
net/netfilter/core.c:61
     [<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190  
net/netfilter/core.c:248
     [<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0  
net/netfilter/core.c:416
     [<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70  
net/netfilter/core.c:431
     [<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50  
net/netfilter/core.c:499
     [<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30  
security/selinux/hooks.c:7089
     [<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80  
net/core/net_namespace.c:154
     [<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
     [<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
     [<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0  
kernel/nsproxy.c:107
     [<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100  
kernel/nsproxy.c:206
     [<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
     [<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
     [<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
     [<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

executing program
executing program
executing program
executing program
executing program


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches