Re: memory leak in prepare_creds
On 28/11/2020 08:00, Hillf Danton wrote: > On Fri, 27 Nov 2020 19:47:15 -0800 >> syzbot has found a reproducer for the following issue on: >> >> HEAD commit:99c710c4 Merge tag 'platform-drivers-x86-v5.10-2' of git:/.. >> git tree: upstream >> console output: https://syzkaller.appspot.com/x/log.txt?x=12a77ddd50 >> kernel config: https://syzkaller.appspot.com/x/.config?x=c7a27a77f20fbc95 >> dashboard link: https://syzkaller.appspot.com/bug?extid=71c4697e27c99fddcf17 >> compiler: gcc (GCC) 10.1.0-syz 20200507 >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12d6161d50 >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f15e6550 >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+71c4697e27c99fddc...@syzkaller.appspotmail.com >> >> BUG: memory leak >> unreferenced object 0x888101401300 (size 168): >> comm "syz-executor355", pid 8461, jiffies 4294953658 (age 32.400s) >> hex dump (first 32 bytes): >> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> backtrace: >> [] prepare_creds+0x25/0x390 kernel/cred.c:258 >> [<1821b99d>] copy_creds+0x3a/0x230 kernel/cred.c:358 >> [<22c32914>] copy_process+0x661/0x24d0 kernel/fork.c:1971 >> [ ] kernel_clone+0xf3/0x670 kernel/fork.c:2456 >> [ ] __do_sys_clone+0x76/0xa0 kernel/fork.c:2573 >> [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 >> [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 >> >> BUG: memory leak >> unreferenced object 0x88810b0a6f20 (size 32): >> comm "syz-executor355", pid 8461, jiffies 4294953658 (age 32.400s) >> hex dump (first 32 bytes): >> b0 6e 93 00 81 88 ff ff 00 00 00 00 00 00 00 00 .n.. >> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> backtrace: >> [<7d750ba1>] kmalloc include/linux/slab.h:557 [inline] >> [<7d750ba1>] kzalloc include/linux/slab.h:664 [inline] >> [<7d750ba1>] lsm_cred_alloc security/security.c:533 [inline] >> [<7d750ba1>] security_prepare_creds+0xa5/0xd0 >> security/security.c:1632 >> [ ] prepare_creds+0x277/0x390 kernel/cred.c:285 >> [<1821b99d>] copy_creds+0x3a/0x230 kernel/cred.c:358 >> [<22c32914>] copy_process+0x661/0x24d0 kernel/fork.c:1971 >> [ ] kernel_clone+0xf3/0x670 kernel/fork.c:2456 >> [ ] __do_sys_clone+0x76/0xa0 kernel/fork.c:2573 >> [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 >> [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > Fail to spot the cred leak. >> >> BUG: memory leak >> unreferenced object 0x888101ea2200 (size 256): >> comm "syz-executor355", pid 8470, jiffies 4294953658 (age 32.400s) >> hex dump (first 32 bytes): >> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >> 20 59 03 01 81 88 ff ff 80 87 a8 10 81 88 ff ff Y.. >> backtrace: >> [<2e0a7c5f>] kmem_cache_zalloc include/linux/slab.h:654 [inline] >> [<2e0a7c5f>] __alloc_file+0x1f/0x130 fs/file_table.c:101 >> [<1a55b73a>] alloc_empty_file+0x69/0x120 fs/file_table.c:151 >> [ ] alloc_file+0x33/0x1b0 fs/file_table.c:193 >> [<6e1465bb>] alloc_file_pseudo+0xb2/0x140 fs/file_table.c:233 >> [<7118092a>] anon_inode_getfile fs/anon_inodes.c:91 [inline] >> [<7118092a>] anon_inode_getfile+0xaa/0x120 fs/anon_inodes.c:74 >> [<2ae99012>] io_uring_get_fd fs/io_uring.c:9198 [inline] >> [<2ae99012>] io_uring_create fs/io_uring.c:9377 [inline] >> [<2ae99012>] io_uring_setup+0x1125/0x1630 fs/io_uring.c:9411 >> [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 >> [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 >> > Put file as part of the error handling after getting a new one. Looks genuine to me, would you send a real patch? > > --- a/fs/io_uring.c > +++ b/fs/io_uring.c > @@ -9182,6 +9182,7 @@ static int io_uring_get_fd(struct io_rin > { > struct file *file; > int ret; > + int fd; > > #if defined(CONFIG_UNIX) > ret = sock_create_kern(_net, PF_UNIX, SOCK_RAW, IPPROTO_IP, > @@ -9190,28 +9191,29 @@ static int io_uring_get_fd(struct io_rin > return ret; > #endif > > - ret = get_unused_fd_flags(O_RDWR | O_CLOEXEC); > + ret = fd = get_unused_fd_flags(O_RDWR | O_CLOEXEC); > if (ret < 0) > goto err; > > file = anon_inode_getfile("[io_uring]", _uring_fops, ctx, > O_RDWR | O_CLOEXEC); > if (IS_ERR(file)) { > -err_fd: > - put_unused_fd(ret); >
Re: memory leak in prepare_creds
syzbot writes: > syzbot has found a reproducer for the following issue on: > > HEAD commit:99c710c4 Merge tag 'platform-drivers-x86-v5.10-2' of git:/.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=12a77ddd50 > kernel config: https://syzkaller.appspot.com/x/.config?x=c7a27a77f20fbc95 > dashboard link: https://syzkaller.appspot.com/bug?extid=71c4697e27c99fddcf17 > compiler: gcc (GCC) 10.1.0-syz 20200507 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12d6161d50 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f15e6550 > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+71c4697e27c99fddc...@syzkaller.appspotmail.com My guess is someones error cleanup somewhere did the wrong thing. It looks like there was one forced failure in tomoyo and the rest were in io_uring. Adding the relevant maintainers perhaps one of them can see the problem. > > BUG: memory leak > unreferenced object 0x888101401300 (size 168): > comm "syz-executor355", pid 8461, jiffies 4294953658 (age 32.400s) > hex dump (first 32 bytes): > 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > backtrace: > [] prepare_creds+0x25/0x390 kernel/cred.c:258 > [<1821b99d>] copy_creds+0x3a/0x230 kernel/cred.c:358 > [<22c32914>] copy_process+0x661/0x24d0 kernel/fork.c:1971 > [ ] kernel_clone+0xf3/0x670 kernel/fork.c:2456 > [ ] __do_sys_clone+0x76/0xa0 kernel/fork.c:2573 > [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > BUG: memory leak > unreferenced object 0x88810b0a6f20 (size 32): > comm "syz-executor355", pid 8461, jiffies 4294953658 (age 32.400s) > hex dump (first 32 bytes): > b0 6e 93 00 81 88 ff ff 00 00 00 00 00 00 00 00 .n.. > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > backtrace: > [<7d750ba1>] kmalloc include/linux/slab.h:557 [inline] > [<7d750ba1>] kzalloc include/linux/slab.h:664 [inline] > [<7d750ba1>] lsm_cred_alloc security/security.c:533 [inline] > [<7d750ba1>] security_prepare_creds+0xa5/0xd0 > security/security.c:1632 > [ ] prepare_creds+0x277/0x390 kernel/cred.c:285 > [<1821b99d>] copy_creds+0x3a/0x230 kernel/cred.c:358 > [<22c32914>] copy_process+0x661/0x24d0 kernel/fork.c:1971 > [ ] kernel_clone+0xf3/0x670 kernel/fork.c:2456 > [ ] __do_sys_clone+0x76/0xa0 kernel/fork.c:2573 > [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > BUG: memory leak > unreferenced object 0x888101ea2200 (size 256): > comm "syz-executor355", pid 8470, jiffies 4294953658 (age 32.400s) > hex dump (first 32 bytes): > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > 20 59 03 01 81 88 ff ff 80 87 a8 10 81 88 ff ff Y.. > backtrace: > [<2e0a7c5f>] kmem_cache_zalloc include/linux/slab.h:654 [inline] > [<2e0a7c5f>] __alloc_file+0x1f/0x130 fs/file_table.c:101 > [<1a55b73a>] alloc_empty_file+0x69/0x120 fs/file_table.c:151 > [ ] alloc_file+0x33/0x1b0 fs/file_table.c:193 > [<6e1465bb>] alloc_file_pseudo+0xb2/0x140 fs/file_table.c:233 > [<7118092a>] anon_inode_getfile fs/anon_inodes.c:91 [inline] > [<7118092a>] anon_inode_getfile+0xaa/0x120 fs/anon_inodes.c:74 > [<2ae99012>] io_uring_get_fd fs/io_uring.c:9198 [inline] > [<2ae99012>] io_uring_create fs/io_uring.c:9377 [inline] > [<2ae99012>] io_uring_setup+0x1125/0x1630 fs/io_uring.c:9411 > [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 Eric
Re: memory leak in prepare_creds
syzbot has found a reproducer for the following issue on: HEAD commit:99c710c4 Merge tag 'platform-drivers-x86-v5.10-2' of git:/.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=12a77ddd50 kernel config: https://syzkaller.appspot.com/x/.config?x=c7a27a77f20fbc95 dashboard link: https://syzkaller.appspot.com/bug?extid=71c4697e27c99fddcf17 compiler: gcc (GCC) 10.1.0-syz 20200507 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12d6161d50 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16f15e6550 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+71c4697e27c99fddc...@syzkaller.appspotmail.com BUG: memory leak unreferenced object 0x888101401300 (size 168): comm "syz-executor355", pid 8461, jiffies 4294953658 (age 32.400s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace: [] prepare_creds+0x25/0x390 kernel/cred.c:258 [<1821b99d>] copy_creds+0x3a/0x230 kernel/cred.c:358 [<22c32914>] copy_process+0x661/0x24d0 kernel/fork.c:1971 [ ] kernel_clone+0xf3/0x670 kernel/fork.c:2456 [ ] __do_sys_clone+0x76/0xa0 kernel/fork.c:2573 [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 BUG: memory leak unreferenced object 0x88810b0a6f20 (size 32): comm "syz-executor355", pid 8461, jiffies 4294953658 (age 32.400s) hex dump (first 32 bytes): b0 6e 93 00 81 88 ff ff 00 00 00 00 00 00 00 00 .n.. 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace: [<7d750ba1>] kmalloc include/linux/slab.h:557 [inline] [<7d750ba1>] kzalloc include/linux/slab.h:664 [inline] [<7d750ba1>] lsm_cred_alloc security/security.c:533 [inline] [<7d750ba1>] security_prepare_creds+0xa5/0xd0 security/security.c:1632 [ ] prepare_creds+0x277/0x390 kernel/cred.c:285 [<1821b99d>] copy_creds+0x3a/0x230 kernel/cred.c:358 [<22c32914>] copy_process+0x661/0x24d0 kernel/fork.c:1971 [ ] kernel_clone+0xf3/0x670 kernel/fork.c:2456 [ ] __do_sys_clone+0x76/0xa0 kernel/fork.c:2573 [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 BUG: memory leak unreferenced object 0x888101ea2200 (size 256): comm "syz-executor355", pid 8470, jiffies 4294953658 (age 32.400s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 59 03 01 81 88 ff ff 80 87 a8 10 81 88 ff ff Y.. backtrace: [<2e0a7c5f>] kmem_cache_zalloc include/linux/slab.h:654 [inline] [<2e0a7c5f>] __alloc_file+0x1f/0x130 fs/file_table.c:101 [<1a55b73a>] alloc_empty_file+0x69/0x120 fs/file_table.c:151 [ ] alloc_file+0x33/0x1b0 fs/file_table.c:193 [<6e1465bb>] alloc_file_pseudo+0xb2/0x140 fs/file_table.c:233 [<7118092a>] anon_inode_getfile fs/anon_inodes.c:91 [inline] [<7118092a>] anon_inode_getfile+0xaa/0x120 fs/anon_inodes.c:74 [<2ae99012>] io_uring_get_fd fs/io_uring.c:9198 [inline] [<2ae99012>] io_uring_create fs/io_uring.c:9377 [inline] [<2ae99012>] io_uring_setup+0x1125/0x1630 fs/io_uring.c:9411 [<8280baad>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 [<685d8cf0>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
memory leak in prepare_creds
Hello, syzbot found the following issue on: HEAD commit:c3d8f220 Merge tag 'kbuild-fixes-v5.9' of git://git.kernel.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=14bf4f5e90 kernel config: https://syzkaller.appspot.com/x/.config?x=948134d9ff96e950 dashboard link: https://syzkaller.appspot.com/bug?extid=71c4697e27c99fddcf17 compiler: gcc (GCC) 10.1.0-syz 20200507 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=115a551990 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+71c4697e27c99fddc...@syzkaller.appspotmail.com BUG: memory leak unreferenced object 0x88812a413f00 (size 168): comm "syz-executor.0", pid 6554, jiffies 4294953946 (age 13.120s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace: [<8b882031>] prepare_creds+0x25/0x2f0 kernel/cred.c:258 [<1d1756e8>] copy_creds+0x2e/0x1d1 kernel/cred.c:358 [] copy_process+0x50c/0x1f20 kernel/fork.c:1949 [ ] _do_fork+0xad/0x530 kernel/fork.c:2428 [<70af4cd7>] __do_sys_clone+0x76/0xa0 kernel/fork.c:2545 [<1470b5cf>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xa9 BUG: memory leak unreferenced object 0x88811b54e440 (size 32): comm "syz-executor.0", pid 6554, jiffies 4294953946 (age 13.120s) hex dump (first 32 bytes): 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace: [<138403e6>] kmalloc include/linux/slab.h:559 [inline] [<138403e6>] kzalloc include/linux/slab.h:666 [inline] [<138403e6>] lsm_cred_alloc security/security.c:532 [inline] [<138403e6>] security_prepare_creds+0x97/0xc0 security/security.c:1631 [<51662e48>] prepare_creds+0x1e1/0x2f0 kernel/cred.c:285 [<1d1756e8>] copy_creds+0x2e/0x1d1 kernel/cred.c:358 [ ] copy_process+0x50c/0x1f20 kernel/fork.c:1949 [ ] _do_fork+0xad/0x530 kernel/fork.c:2428 [<70af4cd7>] __do_sys_clone+0x76/0xa0 kernel/fork.c:2545 [<1470b5cf>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xa9 BUG: memory leak unreferenced object 0x88812a657a00 (size 256): comm "syz-executor.0", pid 6790, jiffies 4294953946 (age 13.120s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 e1 14 2b 81 88 ff ff 80 74 8f 16 81 88 ff ff ...+.t.. backtrace: [<53e1d866>] kmem_cache_zalloc include/linux/slab.h:656 [inline] [<53e1d866>] __alloc_file+0x23/0x120 fs/file_table.c:101 [<0d5d3703>] alloc_empty_file+0x4f/0xe0 fs/file_table.c:151 [<91abea17>] alloc_file+0x31/0x160 fs/file_table.c:193 [<4bfab74c>] alloc_file_pseudo+0xae/0x120 fs/file_table.c:233 [ ] anon_inode_getfile fs/anon_inodes.c:91 [inline] [ ] anon_inode_getfile+0x8e/0x100 fs/anon_inodes.c:74 [ ] anon_inode_getfd+0x42/0x90 fs/anon_inodes.c:136 [<589d6af2>] bpf_map_new_fd kernel/bpf/syscall.c:686 [inline] [<589d6af2>] bpf_map_new_fd kernel/bpf/syscall.c:678 [inline] [<589d6af2>] map_create kernel/bpf/syscall.c:872 [inline] [<589d6af2>] __do_sys_bpf+0x67c/0x2450 kernel/bpf/syscall.c:4160 [<1470b5cf>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 [ ] entry_SYSCALL_64_after_hwframe+0x44/0xa9 BUG: memory leak unreferenced object 0x88812a73db50 (size 16): comm "syz-executor.0", pid 6790, jiffies 4294953946 (age 13.120s) hex dump (first 16 bytes): 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 backtrace: [<8ddd472b>] kmem_cache_zalloc include/linux/slab.h:656 [inline] [<8ddd472b>] lsm_file_alloc security/security.c:567 [inline] [<8ddd472b>] security_file_alloc+0x2e/0xc0 security/security.c:1455 [<79d891d7>] __alloc_file+0x61/0x120 fs/file_table.c:106 [<0d5d3703>] alloc_empty_file+0x4f/0xe0 fs/file_table.c:151 [<91abea17>] alloc_file+0x31/0x160 fs/file_table.c:193 [<4bfab74c>] alloc_file_pseudo+0xae/0x120 fs/file_table.c:233 [ ] anon_inode_getfile fs/anon_inodes.c:91 [inline] [ ] anon_inode_getfile+0x8e/0x100 fs/anon_inodes.c:74 [ ] anon_inode_getfd+0x42/0x90 fs/anon_inodes.c:136 [<589d6af2>] bpf_map_new_fd kernel/bpf/syscall.c:686 [inline] [<589d6af2>] bpf_map_new_fd kernel/bpf/syscall.c:678 [inline]
