syzbot


memory leak in io_sqe_buffers_register

Status: fixed on 2021/11/10 00:50
Reported-by: syzbot+0f32d05d8b6cd8d7ea3e@syzkaller.appspotmail.com
Fix commit: bb6659cc0ad3 io_uring: Fix memory leak in io_sqe_buffers_register()
First crash: 648d, last: 646d

Sample crash report:
Warning: Permanently added '10.128.0.93' (ECDSA) to the list of known hosts.
executing program
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88810a37e280 (size 32):
  comm "syz-executor307", pid 8415, jiffies 4294942216 (age 23.270s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8146cee1>] kmalloc_node include/linux/slab.h:579 [inline]
    [<ffffffff8146cee1>] kvmalloc_node+0x61/0xf0 mm/util.c:587
    [<ffffffff815f44bf>] kvmalloc include/linux/mm.h:795 [inline]
    [<ffffffff815f44bf>] kvmalloc_array include/linux/mm.h:813 [inline]
    [<ffffffff815f44bf>] kvcalloc include/linux/mm.h:818 [inline]
    [<ffffffff815f44bf>] io_rsrc_data_alloc+0x4f/0xc0 fs/io_uring.c:7164
    [<ffffffff815f6058>] io_sqe_buffers_register+0x98/0x3d0 fs/io_uring.c:8383
    [<ffffffff815fbe27>] __io_uring_register+0xf67/0x18c0 fs/io_uring.c:9986
    [<ffffffff8160cba2>] __do_sys_io_uring_register fs/io_uring.c:10091 [inline]
    [<ffffffff8160cba2>] __se_sys_io_uring_register fs/io_uring.c:10071 [inline]
    [<ffffffff8160cba2>] __x64_sys_io_uring_register+0x112/0x230 fs/io_uring.c:10071
    [<ffffffff8431fd3a>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff88810a37e840 (size 32):
  comm "syz-executor307", pid 8420, jiffies 4294942744 (age 17.990s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8146cee1>] kmalloc_node include/linux/slab.h:579 [inline]
    [<ffffffff8146cee1>] kvmalloc_node+0x61/0xf0 mm/util.c:587
    [<ffffffff815f44bf>] kvmalloc include/linux/mm.h:795 [inline]
    [<ffffffff815f44bf>] kvmalloc_array include/linux/mm.h:813 [inline]
    [<ffffffff815f44bf>] kvcalloc include/linux/mm.h:818 [inline]
    [<ffffffff815f44bf>] io_rsrc_data_alloc+0x4f/0xc0 fs/io_uring.c:7164
    [<ffffffff815f6058>] io_sqe_buffers_register+0x98/0x3d0 fs/io_uring.c:8383
    [<ffffffff815fbe27>] __io_uring_register+0xf67/0x18c0 fs/io_uring.c:9986
    [<ffffffff8160cba2>] __do_sys_io_uring_register fs/io_uring.c:10091 [inline]
    [<ffffffff8160cba2>] __se_sys_io_uring_register fs/io_uring.c:10071 [inline]
    [<ffffffff8160cba2>] __x64_sys_io_uring_register+0x112/0x230 fs/io_uring.c:10071
    [<ffffffff8431fd3a>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff88810a3674a0 (size 32):
  comm "syz-executor307", pid 8423, jiffies 4294943274 (age 12.690s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8146cee1>] kmalloc_node include/linux/slab.h:579 [inline]
    [<ffffffff8146cee1>] kvmalloc_node+0x61/0xf0 mm/util.c:587
    [<ffffffff815f44bf>] kvmalloc include/linux/mm.h:795 [inline]
    [<ffffffff815f44bf>] kvmalloc_array include/linux/mm.h:813 [inline]
    [<ffffffff815f44bf>] kvcalloc include/linux/mm.h:818 [inline]
    [<ffffffff815f44bf>] io_rsrc_data_alloc+0x4f/0xc0 fs/io_uring.c:7164
    [<ffffffff815f6058>] io_sqe_buffers_register+0x98/0x3d0 fs/io_uring.c:8383
    [<ffffffff815fbe27>] __io_uring_register+0xf67/0x18c0 fs/io_uring.c:9986
    [<ffffffff8160cba2>] __do_sys_io_uring_register fs/io_uring.c:10091 [inline]
    [<ffffffff8160cba2>] __se_sys_io_uring_register fs/io_uring.c:10071 [inline]
    [<ffffffff8160cba2>] __x64_sys_io_uring_register+0x112/0x230 fs/io_uring.c:10071
    [<ffffffff8431fd3a>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff8881115e2b00 (size 32):
  comm "syz-executor307", pid 8424, jiffies 4294943803 (age 7.400s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8146cee1>] kmalloc_node include/linux/slab.h:579 [inline]
    [<ffffffff8146cee1>] kvmalloc_node+0x61/0xf0 mm/util.c:587
    [<ffffffff815f44bf>] kvmalloc include/linux/mm.h:795 [inline]
    [<ffffffff815f44bf>] kvmalloc_array include/linux/mm.h:813 [inline]
    [<ffffffff815f44bf>] kvcalloc include/linux/mm.h:818 [inline]
    [<ffffffff815f44bf>] io_rsrc_data_alloc+0x4f/0xc0 fs/io_uring.c:7164
    [<ffffffff815f6058>] io_sqe_buffers_register+0x98/0x3d0 fs/io_uring.c:8383
    [<ffffffff815fbe27>] __io_uring_register+0xf67/0x18c0 fs/io_uring.c:9986
    [<ffffffff8160cba2>] __do_sys_io_uring_register fs/io_uring.c:10091 [inline]
    [<ffffffff8160cba2>] __se_sys_io_uring_register fs/io_uring.c:10071 [inline]
    [<ffffffff8160cba2>] __x64_sys_io_uring_register+0x112/0x230 fs/io_uring.c:10071
    [<ffffffff8431fd3a>] do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47
    [<ffffffff84400068>] entry_SYSCALL_64_after_hwframe+0x44/0xae


Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-gce-leak 2021/05/01 01:16 upstream 65ec0a7d2491 77e2b668 .config console log report syz C memory leak in io_sqe_buffers_register
ci-upstream-gce-leak 2021/04/29 22:12 upstream d2b6f8a17919 77e2b668 .config console log report syz C memory leak in io_sqe_buffers_register
* Struck through repros no longer work on HEAD.