linux-kernel - Re: [syzbot] [arm-msm?] [net?] memory leak in radix_tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 09 Dec 2023 22:58:21 -0800
From:   syzbot <syzbot+006987d1be3586e13555@...kaller.appspotmail.com>
To:     linux-kernel@...r.kernel.org
Subject: Re: [syzbot] [arm-msm?] [net?] memory leak in radix_tree_insert

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org.

***

Subject: [arm-msm?] [net?] memory leak in radix_tree_insert
Author: eadavis@...com

please test memory leak in radix_tree_insert

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 33cc938e65a9

diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index eae67015ce51..cc3e9fc7bae0 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -254,6 +254,7 @@ unsigned int radix_tree_gang_lookup_tag_slot(const struct radix_tree_root *,
 		void __rcu ***results, unsigned long first_index,
 		unsigned int max_items, unsigned int tag);
 int radix_tree_tagged(const struct radix_tree_root *, unsigned int tag);
+unsigned long radix_tree_maxindex(const struct radix_tree_root *root);
 
 static inline void radix_tree_preload_end(void)
 {
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index b98e9f2c24ac..a89df8afa510 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -404,6 +404,18 @@ static unsigned radix_tree_load_root(const struct radix_tree_root *root,
 	return 0;
 }
 
+unsigned long radix_tree_maxindex(const struct radix_tree_root *root)
+{
+	struct radix_tree_node *node = rcu_dereference_raw(root->xa_head);
+
+	if (likely(radix_tree_is_internal_node(node))) {
+		node = entry_to_node(node);
+		return node_maxindex(node);
+	}
+
+	return 0;
+}
+
 /*
  *	Extend a radix tree so it can store key @index.
  */
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 41ece61eb57a..abdae567a370 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -274,7 +274,8 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
 		flow = kzalloc(sizeof(*flow), GFP_KERNEL);
 		if (flow) {
 			init_waitqueue_head(&flow->resume_tx);
-			if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
+			if (ret = radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
+				printk("r: %d, k: %llu, f: %p, %s\n", ret, key, flow, __func__);
 				kfree(flow);
 				flow = NULL;
 			}
@@ -344,6 +344,13 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
 	struct qrtr_hdr_v1 *hdr;
 	size_t len = skb->len;
 	int rc, confirm_rx;
+	unsigned long maxidx;
+
+	if (to->sq_node == QRTR_NODE_BCAST) {
+		maxidx = radix_tree_maxindex(&node->qrtr_tx_flow);
+		to->sq_node = maxidx + 1;
+		printk("mi: %llu, sn: %llu, %s\n", maxidx, to->sq_node, __func__);
+	}
 
 	confirm_rx = qrtr_tx_wait(node, to->sq_node, to->sq_port, type);
 	if (confirm_rx < 0) {