linux-kernel - Re: [syzbot] memory leak in io_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0000000000009156db05f1d984c7@google.com>
Date:   Mon, 09 Jan 2023 11:10:17 -0800
From:   syzbot <syzbot+6c95df01470a47fc3af4@...kaller.appspotmail.com>
To:     asml.silence@...il.com, axboe@...nel.dk, io-uring@...r.kernel.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] memory leak in io_submit_sqes (4)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes

BUG: memory leak
unreferenced object 0xffff888113562900 (size 256):
  comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
  hex dump (first 32 bytes):
    00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00  ..P.............
    00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00  .........@......
  backtrace:
    [<ffffffff8476aaf4>] __io_alloc_req_refill+0x55/0x193 io_uring/io_uring.c:1040
    [<ffffffff8476c085>] io_alloc_req_refill io_uring/io_uring.h:378 [inline]
    [<ffffffff8476c085>] io_submit_sqes.cold+0x65/0x8a io_uring/io_uring.c:2384
    [<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
    [<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810522d080 (size 96):
  comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
  hex dump (first 32 bytes):
    00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00  ..P.............
    7b 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  { ..............
  backtrace:
    [<ffffffff814f94a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1062
    [<ffffffff823a73ac>] kmalloc include/linux/slab.h:580 [inline]
    [<ffffffff823a73ac>] io_req_alloc_apoll io_uring/poll.c:650 [inline]
    [<ffffffff823a73ac>] io_arm_poll_handler+0x1fc/0x470 io_uring/poll.c:694
    [<ffffffff823961cd>] io_queue_async+0x8d/0x2e0 io_uring/io_uring.c:2006
    [<ffffffff82397f18>] io_queue_sqe io_uring/io_uring.c:2037 [inline]
    [<ffffffff82397f18>] io_submit_sqe io_uring/io_uring.c:2286 [inline]
    [<ffffffff82397f18>] io_submit_sqes+0x968/0xb70 io_uring/io_uring.c:2397
    [<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
    [<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff888113564f00 (size 256):
  comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
  hex dump (first 32 bytes):
    00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00  ..P.............
    00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00  .........@......
  backtrace:
    [<ffffffff8476aaf4>] __io_alloc_req_refill+0x55/0x193 io_uring/io_uring.c:1040
    [<ffffffff8476c085>] io_alloc_req_refill io_uring/io_uring.h:378 [inline]
    [<ffffffff8476c085>] io_submit_sqes.cold+0x65/0x8a io_uring/io_uring.c:2384
    [<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
    [<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810522dc00 (size 96):
  comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
  hex dump (first 32 bytes):
    00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00  ..P.............
    7b 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  { ..............
  backtrace:
    [<ffffffff814f94a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1062
    [<ffffffff823a73ac>] kmalloc include/linux/slab.h:580 [inline]
    [<ffffffff823a73ac>] io_req_alloc_apoll io_uring/poll.c:650 [inline]
    [<ffffffff823a73ac>] io_arm_poll_handler+0x1fc/0x470 io_uring/poll.c:694
    [<ffffffff823961cd>] io_queue_async+0x8d/0x2e0 io_uring/io_uring.c:2006
    [<ffffffff82397f18>] io_queue_sqe io_uring/io_uring.c:2037 [inline]
    [<ffffffff82397f18>] io_submit_sqe io_uring/io_uring.c:2286 [inline]
    [<ffffffff82397f18>] io_submit_sqes+0x968/0xb70 io_uring/io_uring.c:2397
    [<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
    [<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff8881135a7600 (size 256):
  comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
  hex dump (first 32 bytes):
    00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00  ..P.............
    00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00  .........@......
  backtrace:
    [<ffffffff8476aaf4>] __io_alloc_req_refill+0x55/0x193 io_uring/io_uring.c:1040
    [<ffffffff8476c085>] io_alloc_req_refill io_uring/io_uring.h:378 [inline]
    [<ffffffff8476c085>] io_submit_sqes.cold+0x65/0x8a io_uring/io_uring.c:2384
    [<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
    [<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff888109a6d900 (size 96):
  comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
  hex dump (first 32 bytes):
    00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00  ..P.............
    7b 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  { ..............
  backtrace:
    [<ffffffff814f94a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1062
    [<ffffffff823a73ac>] kmalloc include/linux/slab.h:580 [inline]
    [<ffffffff823a73ac>] io_req_alloc_apoll io_uring/poll.c:650 [inline]
    [<ffffffff823a73ac>] io_arm_poll_handler+0x1fc/0x470 io_uring/poll.c:694
    [<ffffffff823961cd>] io_queue_async+0x8d/0x2e0 io_uring/io_uring.c:2006
    [<ffffffff82397f18>] io_queue_sqe io_uring/io_uring.c:2037 [inline]
    [<ffffffff82397f18>] io_submit_sqe io_uring/io_uring.c:2286 [inline]
    [<ffffffff82397f18>] io_submit_sqes+0x968/0xb70 io_uring/io_uring.c:2397
    [<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
    [<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd



Tested on:

commit:         a4b98579 Merge branch 'io_uring-6.2' into syztest
git tree:       git://git.kernel.dk/linux.git syztest
console output: https://syzkaller.appspot.com/x/log.txt?x=1560579a480000
kernel config:  https://syzkaller.appspot.com/x/.config?x=72a4287b7f412c8a
dashboard link: https://syzkaller.appspot.com/bug?extid=6c95df01470a47fc3af4
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.