linux-kernel - memory leak in getname

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 17 Sep 2020 19:32:12 +0530
From:   "\\xcH3332\\" <ch3332xr@...il.com>
To:     linux-kernel@...r.kernel.org
Cc:     syzkaller@...glegroups.com
Subject: memory leak in getname_flags ( 5.9.0-rc5)

Syzkaller hit 'memory leak in getname_flags' bug.


 5.9.0-rc5


2020/09/17 10:31:39 executed programs: 195
2020/09/17 10:31:45 executed programs: 204
2020/09/17 10:31:50 executed programs: 226
2020/09/17 10:31:56 executed programs: 239
BUG: memory leak
unreferenced object 0xffff8ba9f42fa000 (size 4096):
  comm "syz-executor.4", pid 5686, jiffies 4295939335 (age 12.397s)
  hex dump (first 32 bytes):
    20 a0 2f f4 a9 8b ff ff 40 02 00 20 00 00 00 00   ./.....@.. ....
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000084fbe16c>] getname_flags+0x57/0x260
    [<00000000a25b6483>] __io_openat_prep+0x76/0x100
    [<0000000030fd3f89>] io_openat2_prep.part.0+0x5b/0xb0
    [<00000000e274bfc6>] io_issue_sqe+0x445/0x1940
    [<00000000bad7fba6>] __io_queue_sqe+0x189/0x540
    [<000000000d09a5ef>] io_queue_sqe+0x28f/0x440
    [<00000000c36c4e95>] io_submit_sqes+0x7e9/0xa90
    [<00000000a15f6a28>] __x64_sys_io_uring_enter+0x23e/0x350
    [<00000000449792f4>] do_syscall_64+0x33/0x40
    [<00000000bdacf1c3>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



Syzkaller reproducer:
# {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:8
Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:true
NetInjection:false NetDevices:true NetReset:true Cgroups:true
BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false USB:false
VhciInjection:false UseTmpDir:true HandleSegv:true Repro:false
Trace:false}
r0 = syz_io_uring_setup(0x5bfa, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2,
0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil,
&(0x7f0000000100)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0)
syz_io_uring_submit(r1, r2,
&(0x7f00000001c0)=@...ING_OP_OPENAT2={0x1c, 0x0, 0x0,
0xffffffffffffff9c, &(0x7f0000000200)={0x42},
&(0x7f0000000240)='./file1\x00', 0x18, 0x0, 0x12345}, 0x0)
io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0)

Download attachment "syz.config" of type "application/octet-stream" (129435 bytes)

View attachment "repro.c" of type "text/x-csrc" (5394 bytes)