linux-kernel - Re: memory leak in io_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <00000000000002261d05bca94f7b@google.com>
Date:   Wed, 03 Mar 2021 14:24:04 -0800
From:   syzbot <syzbot+91b4b56ead187d35c9d3@...kaller.appspotmail.com>
To:     asml.silence@...il.com, axboe@...nel.dk, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: memory leak in io_submit_sqes (2)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes

BUG: memory leak
unreferenced object 0xffff88811043cc00 (size 232):
  comm "syz-executor.0", pid 10595, jiffies 4294944973 (age 10.850s)
  hex dump (first 32 bytes):
    00 f0 40 10 81 88 ff ff 00 00 00 00 00 00 00 00  ..@.............
    00 7a 5f 81 ff ff ff ff 00 00 00 00 00 00 00 00  .z_.............
  backtrace:
    [<000000005cfa592c>] io_alloc_req fs/io_uring.c:1610 [inline]
    [<000000005cfa592c>] io_submit_sqes+0x7ae/0x22f0 fs/io_uring.c:6518
    [<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
    [<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888124dd1300 (size 256):
  comm "syz-executor.0", pid 10595, jiffies 4294944973 (age 10.850s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000099ea7aac>] kmalloc include/linux/slab.h:559 [inline]
    [<0000000099ea7aac>] __io_alloc_async_data fs/io_uring.c:3060 [inline]
    [<0000000099ea7aac>] io_setup_async_rw fs/io_uring.c:3079 [inline]
    [<0000000099ea7aac>] io_setup_async_rw+0xa3/0x1e0 fs/io_uring.c:3072
    [<0000000002d951db>] io_read+0x1fe/0x560 fs/io_uring.c:3257
    [<00000000ca56953d>] io_issue_sqe+0x18d/0x23e0 fs/io_uring.c:5933
    [<00000000a5a737fd>] __io_queue_sqe+0x9a/0x4f0 fs/io_uring.c:6200
    [<00000000af920b23>] io_queue_sqe+0x361/0x560 fs/io_uring.c:6253
    [<00000000deecb73d>] io_submit_sqe fs/io_uring.c:6417 [inline]
    [<00000000deecb73d>] io_submit_sqes+0x1fc1/0x22f0 fs/io_uring.c:6531
    [<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
    [<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff88810d21fa00 (size 232):
  comm "syz-executor.0", pid 10613, jiffies 4294944997 (age 10.610s)
  hex dump (first 32 bytes):
    00 47 b1 11 81 88 ff ff 00 00 00 00 00 00 00 00  .G..............
    00 7a 5f 81 ff ff ff ff 00 00 00 00 00 00 00 00  .z_.............
  backtrace:
    [<000000005cfa592c>] io_alloc_req fs/io_uring.c:1610 [inline]
    [<000000005cfa592c>] io_submit_sqes+0x7ae/0x22f0 fs/io_uring.c:6518
    [<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
    [<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888124e98500 (size 256):
  comm "syz-executor.0", pid 10613, jiffies 4294944997 (age 10.610s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000099ea7aac>] kmalloc include/linux/slab.h:559 [inline]
    [<0000000099ea7aac>] __io_alloc_async_data fs/io_uring.c:3060 [inline]
    [<0000000099ea7aac>] io_setup_async_rw fs/io_uring.c:3079 [inline]
    [<0000000099ea7aac>] io_setup_async_rw+0xa3/0x1e0 fs/io_uring.c:3072
    [<0000000002d951db>] io_read+0x1fe/0x560 fs/io_uring.c:3257
    [<00000000ca56953d>] io_issue_sqe+0x18d/0x23e0 fs/io_uring.c:5933
    [<00000000a5a737fd>] __io_queue_sqe+0x9a/0x4f0 fs/io_uring.c:6200
    [<00000000af920b23>] io_queue_sqe+0x361/0x560 fs/io_uring.c:6253
    [<00000000deecb73d>] io_submit_sqe fs/io_uring.c:6417 [inline]
    [<00000000deecb73d>] io_submit_sqes+0x1fc1/0x22f0 fs/io_uring.c:6531
    [<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
    [<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff88810edcff00 (size 232):
  comm "syz-executor.0", pid 10633, jiffies 4294945010 (age 10.480s)
  hex dump (first 32 bytes):
    00 99 b3 11 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 7a 5f 81 ff ff ff ff 00 00 00 00 00 00 00 00  .z_.............
  backtrace:
    [<000000005cfa592c>] io_alloc_req fs/io_uring.c:1610 [inline]
    [<000000005cfa592c>] io_submit_sqes+0x7ae/0x22f0 fs/io_uring.c:6518
    [<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
    [<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888124c06300 (size 256):
  comm "syz-executor.0", pid 10633, jiffies 4294945010 (age 10.480s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000099ea7aac>] kmalloc include/linux/slab.h:559 [inline]
    [<0000000099ea7aac>] __io_alloc_async_data fs/io_uring.c:3060 [inline]
    [<0000000099ea7aac>] io_setup_async_rw fs/io_uring.c:3079 [inline]
    [<0000000099ea7aac>] io_setup_async_rw+0xa3/0x1e0 fs/io_uring.c:3072
    [<0000000002d951db>] io_read+0x1fe/0x560 fs/io_uring.c:3257
    [<00000000ca56953d>] io_issue_sqe+0x18d/0x23e0 fs/io_uring.c:5933
    [<00000000a5a737fd>] __io_queue_sqe+0x9a/0x4f0 fs/io_uring.c:6200
    [<00000000af920b23>] io_queue_sqe+0x361/0x560 fs/io_uring.c:6253
    [<00000000deecb73d>] io_submit_sqe fs/io_uring.c:6417 [inline]
    [<00000000deecb73d>] io_submit_sqes+0x1fc1/0x22f0 fs/io_uring.c:6531
    [<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
    [<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae



Tested on:

commit:         4f766d6f io_uring: ensure that threads freeze on suspend
git tree:       git://git.kernel.dk/linux-block io_uring-5.12
console output: https://syzkaller.appspot.com/x/log.txt?x=143ce02ad00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c43bda1f1543d72b
dashboard link: https://syzkaller.appspot.com/bug?extid=91b4b56ead187d35c9d3
compiler: