linux-kernel - Re: [syzbot] memory leak in xas

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20220711133808.d86400ce9960febcb0fd537b@linux-foundation.org>
Date:   Mon, 11 Jul 2022 13:38:08 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     syzbot <syzbot+a785d07959bc94837d51@...kaller.appspotmail.com>
Cc:     linux-kernel@...r.kernel.org, linux-mm@...ck.org,
        syzkaller-bugs@...glegroups.com, Zach O'Keefe <zokeefe@...gle.com>,
        Yang Shi <shy828301@...il.com>,
        Liam Howlett <liam.howlett@...cle.com>
Subject: Re: [syzbot] memory leak in xas_create

On Sat, 09 Jul 2022 00:13:23 -0700 syzbot <syzbot+a785d07959bc94837d51@...kaller.appspotmail.com> wrote:

> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    c1084b6c5620 Merge tag 'soc-fixes-5.19-2' of git://git.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=14967ccc080000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=916233b7694a38ff
> dashboard link: https://syzkaller.appspot.com/bug?extid=a785d07959bc94837d51
> compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=122ae834080000
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+a785d07959bc94837d51@...kaller.appspotmail.com
> 
> 2022/07/05 05:22:17 executed programs: 828
> 2022/07/05 05:22:23 executed programs: 846
> 2022/07/05 05:22:30 executed programs: 866
> 2022/07/05 05:22:37 executed programs: 875
> BUG: memory leak

Thanks.  Presumably due to khugepaged changes.

Can we expect a bisection search?

> unreferenced object 0xffff888113662480 (size 576):
>   comm "khugepaged", pid 32, jiffies 4295002751 (age 22.940s)
>   hex dump (first 32 bytes):
>     06 15 08 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     58 08 46 1d 81 88 ff ff 98 24 66 13 81 88 ff ff  X.F......$f.....
>   backtrace:
>     [<ffffffff824aa006>] xas_alloc+0xf6/0x120 lib/xarray.c:377
>     [<ffffffff824acc55>] xas_create+0x395/0x820 lib/xarray.c:679
>     [<ffffffff824ad180>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
>     [<ffffffff815957f3>] collapse_file+0x283/0x2870 mm/khugepaged.c:1670
>     [<ffffffff8159b52c>] khugepaged_scan_file mm/khugepaged.c:2072 [inline]
>     [<ffffffff8159b52c>] khugepaged_scan_mm_slot mm/khugepaged.c:2167 [inline]
>     [<ffffffff8159b52c>] khugepaged_do_scan mm/khugepaged.c:2251 [inline]
>     [<ffffffff8159b52c>] khugepaged+0x227c/0x43a0 mm/khugepaged.c:2296
>     [<ffffffff8127b8b5>] kthread+0x125/0x160 kernel/kthread.c:376
>     [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> 
> BUG: memory leak
> unreferenced object 0xffff8881136e2900 (size 576):
>   comm "khugepaged", pid 32, jiffies 4295002751 (age 22.940s)
>   hex dump (first 32 bytes):
>     00 07 00 00 00 00 00 00 80 24 66 13 81 88 ff ff  .........$f.....
>     58 08 46 1d 81 88 ff ff 18 29 6e 13 81 88 ff ff  X.F......)n.....
>   backtrace:
>     [<ffffffff824aa006>] xas_alloc+0xf6/0x120 lib/xarray.c:377
>     [<ffffffff824acc55>] xas_create+0x395/0x820 lib/xarray.c:679
>     [<ffffffff824ad180>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
>     [<ffffffff815957f3>] collapse_file+0x283/0x2870 mm/khugepaged.c:1670
>     [<ffffffff8159b52c>] khugepaged_scan_file mm/khugepaged.c:2072 [inline]
>     [<ffffffff8159b52c>] khugepaged_scan_mm_slot mm/khugepaged.c:2167 [inline]
>     [<ffffffff8159b52c>] khugepaged_do_scan mm/khugepaged.c:2251 [inline]
>     [<ffffffff8159b52c>] khugepaged+0x227c/0x43a0 mm/khugepaged.c:2296
>     [<ffffffff8127b8b5>] kthread+0x125/0x160 kernel/kthread.c:376
>     [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> 
> BUG: memory leak
> unreferenced object 0xffff8881136e0480 (size 576):
>   comm "khugepaged", pid 32, jiffies 4295002751 (age 22.940s)
>   hex dump (first 32 bytes):
>     00 06 00 00 00 00 00 00 80 24 66 13 81 88 ff ff  .........$f.....
>     58 08 46 1d 81 88 ff ff 98 04 6e 13 81 88 ff ff  X.F.......n.....
>   backtrace:
>     [<ffffffff824aa006>] xas_alloc+0xf6/0x120 lib/xarray.c:377
>     [<ffffffff824acc55>] xas_create+0x395/0x820 lib/xarray.c:679
>     [<ffffffff824ad180>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
>     [<ffffffff815957f3>] collapse_file+0x283/0x2870 mm/khugepaged.c:1670
>     [<ffffffff8159b52c>] khugepaged_scan_file mm/khugepaged.c:2072 [inline]
>     [<ffffffff8159b52c>] khugepaged_scan_mm_slot mm/khugepaged.c:2167 [inline]
>     [<ffffffff8159b52c>] khugepaged_do_scan mm/khugepaged.c:2251 [inline]
>     [<ffffffff8159b52c>] khugepaged+0x227c/0x43a0 mm/khugepaged.c:2296
>     [<ffffffff8127b8b5>] kthread+0x125/0x160 kernel/kthread.c:376
>     [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> 
> BUG: memory leak
> unreferenced object 0xffff8881136de900 (size 576):
>   comm "khugepaged", pid 32, jiffies 4295002751 (age 22.940s)
>   hex dump (first 32 bytes):
>     00 05 00 00 00 00 00 00 80 24 66 13 81 88 ff ff  .........$f.....
>     58 08 46 1d 81 88 ff ff 18 e9 6d 13 81 88 ff ff  X.F.......m.....
>   backtrace:
>     [<ffffffff824aa006>] xas_alloc+0xf6/0x120 lib/xarray.c:377
>     [<ffffffff824acc55>] xas_create+0x395/0x820 lib/xarray.c:679
>     [<ffffffff824ad180>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
>     [<ffffffff815957f3>] collapse_file+0x283/0x2870 mm/khugepaged.c:1670
>     [<ffffffff8159b52c>] khugepaged_scan_file mm/khugepaged.c:2072 [inline]
>     [<ffffffff8159b52c>] khugepaged_scan_mm_slot mm/khugepaged.c:2167 [inline]
>     [<ffffffff8159b52c>] khugepaged_do_scan mm/khugepaged.c:2251 [inline]
>     [<ffffffff8159b52c>] khugepaged+0x227c/0x43a0 mm/khugepaged.c:2296
>     [<ffffffff8127b8b5>] kthread+0x125/0x160 kernel/kthread.c:376
>     [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> 
> BUG: memory leak
> unreferenced object 0xffff88811371b6c0 (size 576):
>   comm "khugepaged", pid 32, jiffies 4295002751 (age 22.940s)
>   hex dump (first 32 bytes):
>     00 04 00 00 00 00 00 00 80 24 66 13 81 88 ff ff  .........$f.....
>     58 08 46 1d 81 88 ff ff d8 b6 71 13 81 88 ff ff  X.F.......q.....
>   backtrace:
>     [<ffffffff824aa006>] xas_alloc+0xf6/0x120 lib/xarray.c:377
>     [<ffffffff824acc55>] xas_create+0x395/0x820 lib/xarray.c:679
>     [<ffffffff824ad180>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
>     [<ffffffff815957f3>] collapse_file+0x283/0x2870 mm/khugepaged.c:1670
>     [<ffffffff8159b52c>] khugepaged_scan_file mm/khugepaged.c:2072 [inline]
>     [<ffffffff8159b52c>] khugepaged_scan_mm_slot mm/khugepaged.c:2167 [inline]
>     [<ffffffff8159b52c>] khugepaged_do_scan mm/khugepaged.c:2251 [inline]
>     [<ffffffff8159b52c>] khugepaged+0x227c/0x43a0 mm/khugepaged.c:2296
>     [<ffffffff8127b8b5>] kthread+0x125/0x160 kernel/kthread.c:376
>     [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> 
> BUG: memory leak
> unreferenced object 0xffff888113666d80 (size 576):
>   comm "khugepaged", pid 32, jiffies 4295002751 (age 22.940s)
>   hex dump (first 32 bytes):
>     00 03 00 00 00 00 00 00 80 24 66 13 81 88 ff ff  .........$f.....
>     58 08 46 1d 81 88 ff ff 98 6d 66 13 81 88 ff ff  X.F......mf.....
>   backtrace:
>     [<ffffffff824aa006>] xas_alloc+0xf6/0x120 lib/xarray.c:377
>     [<ffffffff824acc55>] xas_create+0x395/0x820 lib/xarray.c:679
>     [<ffffffff824ad180>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
>     [<ffffffff815957f3>] collapse_file+0x283/0x2870 mm/khugepaged.c:1670
>     [<ffffffff8159b52c>] khugepaged_scan_file mm/khugepaged.c:2072 [inline]
>     [<ffffffff8159b52c>] khugepaged_scan_mm_slot mm/khugepaged.c:2167 [inline]
>     [<ffffffff8159b52c>] khugepaged_do_scan mm/khugepaged.c:2251 [inline]
>     [<ffffffff8159b52c>] khugepaged+0x227c/0x43a0 mm/khugepaged.c:2296
>     [<ffffffff8127b8b5>] kthread+0x125/0x160 kernel/kthread.c:376
>     [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302
> 
> 
> 
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@...glegroups.com.
> 
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches