thr3ads.net - Virtualization - memory leak in vhost_net

If this information is useful, please help other people find it:
Share via:

Hillf Danton

2019-Jun-14 02:45 UTC

memory leak in vhost_net_ioctl

Hello Syzbot

On Fri, 14 Jun 2019 02:26:02 +0800 syzbot wrote:>
> Hello,
>
> syzbot has tested the proposed patch but the reproducer still triggered
crash:
> memory leak in vhost_net_ioctl
>Oh sorry for my poor patch.
> ANGE): hsr_slave_1: link becomes ready
> 2019/06/13 18:24:57 executed programs: 18
> BUG: memory leak
> unreferenced object 0xffff88811cbc6ac0 (size 64):
>    comm "syz-executor.0", pid 7196, jiffies 4294943804 (age
14.770s)
>    hex dump (first 32 bytes):
>      01 00 00 00 81 88 ff ff 00 00 00 00 82 88 ff ff  ................
>      d0 6a bc 1c 81 88 ff ff d0 6a bc 1c 81 88 ff ff  .j.......j......
>    backtrace:
>      [<000000006c752978>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
>      [<000000006c752978>] slab_post_alloc_hook mm/slab.h:439 [inline]
>      [<000000006c752978>] slab_alloc mm/slab.c:3326 [inline]
>      [<000000006c752978>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
>      [<00000000b3825d52>] kmalloc include/linux/slab.h:547 [inline]
>      [<00000000b3825d52>] vhost_net_ubuf_alloc
drivers/vhost/net.c:241 [inline]
>      [<00000000b3825d52>] vhost_net_set_backend
drivers/vhost/net.c:1535 [inline]
>      [<00000000b3825d52>] vhost_net_ioctl+0xb43/0xc10
drivers/vhost/net.c:1717
>      [<00000000700f02d7>] vfs_ioctl fs/ioctl.c:46 [inline]
>      [<00000000700f02d7>] file_ioctl fs/ioctl.c:509 [inline]
>      [<00000000700f02d7>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
>      [<000000009a0ec0a7>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
>      [<00000000d9416323>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>      [<00000000d9416323>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>      [<00000000d9416323>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
>      [<00000000e4407a23>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
>      [<000000008715c149>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> BUG: memory leak
> unreferenced object 0xffff88810b1365c0 (size 64):
>    comm "syz-executor.2", pid 7193, jiffies 4294943823 (age
14.580s)
>    hex dump (first 32 bytes):
>      01 00 00 00 81 88 ff ff 00 00 00 00 81 88 ff ff  ................
>      d0 65 13 0b 81 88 ff ff d0 65 13 0b 81 88 ff ff  .e.......e......
>    backtrace:
>      [<000000006c752978>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
>      [<000000006c752978>] slab_post_alloc_hook mm/slab.h:439 [inline]
>      [<000000006c752978>] slab_alloc mm/slab.c:3326 [inline]
>
>      [<00000000b3825d52>] kmalloc include/linux/slab.h:547 [inline]
>      [<00000000b3825d52>] vhost_net_ubuf_alloc
drivers/vhost/net.c:241 [inline]
>      [<00000000b3825d52>] vhost_net_set_backend
drivers/vhost/net.c:1535 [inline]
>      [<00000000b3825d52>] vhost_net_ioctl+0xb43/0xc10
drivers/vhost/net.c:1717
>      [<00000000700f02d7>] vfs_ioctl fs/ioctl.c:46 [inline]
>      [<00000000700f02d7>] file_ioctl fs/ioctl.c:509 [inline]
>      [<00000000700f02d7>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
>      [<000000009a0ec0a7>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
>      [<00000000d9416323>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>      [<00000000d9416323>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>      [<00000000d9416323>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
>      [<00000000e4407a23>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
>      [<000000008715c149>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> BUG: memory leak
> unreferenced object 0xffff88810be23700 (size 64):
>    comm "syz-executor.3", pid 7194, jiffies 4294943823 (age
14.580s)
>    hex dump (first 32 bytes):
>      01 00 00 00 00 00 00 00 00 00 00 00 00 c9 ff ff  ................
>      10 37 e2 0b 81 88 ff ff 10 37 e2 0b 81 88 ff ff  .7.......7......
>    backtrace:
>      [<000000006c752978>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
>      [<000000006c752978>] slab_post_alloc_hook mm/slab.h:439 [inline]
>      [<000000006c752978>] slab_alloc mm/slab.c:3326 [inline]
>      [<000000006c752978>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
>      [<00000000b3825d52>] kmalloc include/linux/slab.h:547 [inline]
>      [<00000000b3825d52>] vhost_net_ubuf_alloc
drivers/vhost/net.c:241 [inline]
>      [<00000000b3825d52>] vhost_net_set_backend
drivers/vhost/net.c:1535 [inline]
>      [<00000000b3825d52>] vhost_net_ioctl+0xb43/0xc10
drivers/vhost/net.c:1717
>      [<00000000700f02d7>] vfs_ioctl fs/ioctl.c:46 [inline]
>      [<00000000700f02d7>] file_ioctl fs/ioctl.c:509 [inline]
>      [<00000000700f02d7>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
>      [<000000009a0ec0a7>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
>      [<00000000d9416323>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>      [<00000000d9416323>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>      [<00000000d9416323>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
>      [<00000000e4407a23>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
>      [<000000008715c149>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> BUG: memory leak
> unreferenced object 0xffff88810b136500 (size 64):
>    comm "syz-executor.6", pid 7228, jiffies 4294943827 (age
14.540s)
>    hex dump (first 32 bytes):
>      01 00 00 00 20 69 6f 63 00 00 00 00 64 65 76 2f  .... ioc....dev/
>      10 65 13 0b 81 88 ff ff 10 65 13 0b 81 88 ff ff  .e.......e......
>    backtrace:
>      [<000000006c752978>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
>      [<000000006c752978>] slab_post_alloc_hook mm/slab.h:439 [inline]
>      [<000000006c752978>] slab_alloc mm/slab.c:3326 [inline]
>      [<000000006c752978>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
>      [<00000000b3825d52>] kmalloc include/linux/slab.h:547 [inline]
>      [<00000000b3825d52>] vhost_net_ubuf_alloc
drivers/vhost/net.c:241 [inline]
>      [<00000000b3825d52>] vhost_net_set_backend
drivers/vhost/net.c:1535 [inline]
>      [<00000000b3825d52>] vhost_net_ioctl+0xb43/0xc10
drivers/vhost/net.c:1717
>      [<00000000700f02d7>] vfs_ioctl fs/ioctl.c:46 [inline]
>      [<00000000700f02d7>] file_ioctl fs/ioctl.c:509 [inline]
>      [<00000000700f02d7>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
>      [<000000009a0ec0a7>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
>      [<00000000d9416323>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>      [<00000000d9416323>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>      [<00000000d9416323>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
>      [<00000000e4407a23>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
>      [<000000008715c149>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> BUG: memory leak
> unreferenced object 0xffff88810b9cfec0 (size 64):
>    comm "syz-executor.7", pid 7236, jiffies 4294943829 (age
14.520s)
>    hex dump (first 32 bytes):
>      01 00 00 00 20 69 6f 63 00 00 00 00 64 65 76 2f  .... ioc....dev/
>      d0 fe 9c 0b 81 88 ff ff d0 fe 9c 0b 81 88 ff ff  ................
>    backtrace:
>      [<000000006c752978>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
>      [<000000006c752978>] slab_post_alloc_hook mm/slab.h:439 [inline]
>      [<000000006c752978>] slab_alloc mm/slab.c:3326 [inline]
>      [<000000006c752978>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
>      [<00000000b3825d52>] kmalloc include/linux/slab.h:547 [inline]
>      [<00000000b3825d52>] vhost_net_ubuf_alloc
drivers/vhost/net.c:241 [inline]
>      [<00000000b3825d52>] vhost_net_set_backend
drivers/vhost/net.c:1535 [inline]
>      [<00000000b3825d52>] vhost_net_ioctl+0xb43/0xc10
drivers/vhost/net.c:1717
>      [<00000000700f02d7>] vfs_ioctl fs/ioctl.c:46 [inline]
>      [<00000000700f02d7>] file_ioctl fs/ioctl.c:509 [inline]
>      [<00000000700f02d7>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
>      [<000000009a0ec0a7>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
>      [<00000000d9416323>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>      [<00000000d9416323>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>      [<00000000d9416323>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
>      [<00000000e4407a23>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
>      [<000000008715c149>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> BUG: memory leak
> unreferenced object 0xffff88810b9cd380 (size 64):
>    comm "syz-executor.4", pid 7218, jiffies 4294943834 (age
14.470s)
>    hex dump (first 32 bytes):
>      01 00 00 00 81 88 ff ff 00 00 00 00 81 88 ff ff  ................
>      90 d3 9c 0b 81 88 ff ff 90 d3 9c 0b 81 88 ff ff  ................
>    backtrace:
>      [<000000006c752978>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
>      [<000000006c752978>] slab_post_alloc_hook mm/slab.h:439 [inline]
>      [<000000006c752978>] slab_alloc mm/slab.c:3326 [inline]
>      [<000000006c752978>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
>      [<00000000b3825d52>] kmalloc include/linux/slab.h:547 [inline]
>      [<00000000b3825d52>] vhost_net_ubuf_alloc
drivers/vhost/net.c:241 [inline]
>      [<00000000b3825d52>] vhost_net_set_backend
drivers/vhost/net.c:1535 [inline]
>      [<00000000b3825d52>] vhost_net_ioctl+0xb43/0xc10
drivers/vhost/net.c:1717
>      [<00000000700f02d7>] vfs_ioctl fs/ioctl.c:46 [inline]
>      [<00000000700f02d7>] file_ioctl fs/ioctl.c:509 [inline]
>      [<00000000700f02d7>] do_vfs_ioctl+0x62a/0x810 fs/ioctl.c:696
>      [<000000009a0ec0a7>] ksys_ioctl+0x86/0xb0 fs/ioctl.c:713
>      [<00000000d9416323>] __do_sys_ioctl fs/ioctl.c:720 [inline]
>      [<00000000d9416323>] __se_sys_ioctl fs/ioctl.c:718 [inline]
>      [<00000000d9416323>] __x64_sys_ioctl+0x1e/0x30 fs/ioctl.c:718
>      [<00000000e4407a23>] do_syscall_64+0x76/0x1a0
arch/x86/entry/common.c:301
>      [<000000008715c149>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
>
>
> Tested on:
>
> commit:         c11fb13a Merge branch 'for-linus' of
git://git.kernel.org/..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=11c6b666a00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cb38d33cd06d8d48
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=11ff0de1a00000
>
And I want to try again the following tiny diff made based on the logic:

1_> vhost_net_ubuf_alloc() in the dump info suggests that it is ubuf leak.

2_> commit c38e39c378f4 ("vhost-net: fix use-after-free in
vhost_net_flush")
makes vhost_net_flush() no longer release ubuf.

3_> in both reset_owner and release pathes, see vhost_net_reset_owner() and
vhost_net_release() please, vq is reset in wake of flush:

        vhost_net_flush(n);
        vhost_dev_stop(&n->dev);
        vhost_dev_cleanup(&n->dev);
        vhost_net_vq_reset(n);

4_> the ubufs pointer is cleared in vhost_net_vq_reset()


#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

Can you give it a shoot please if there is not anything missed in the
above logic?


Thanks
Hillf
------->8---
---
 drivers/vhost/net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 3beb401..87db9b3 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -309,6 +309,8 @@ static void vhost_net_vq_reset(struct vhost_net *n)
 	for (i = 0; i < VHOST_NET_VQ_MAX; i++) {
 		n->vqs[i].done_idx = 0;
 		n->vqs[i].upend_idx = 0;
+		if (n->vqs[i].ubufs)
+			vhost_net_ubuf_put_wait_and_free(n->vqs[i].ubufs);
 		n->vqs[i].ubufs = NULL;
 		n->vqs[i].vhost_hlen = 0;
 		n->vqs[i].sock_hlen = 0;
--

syzbot

2019-Jun-14 03:04 UTC

head link

memory leak in vhost_net_ioctl

Hello,

syzbot has tested the proposed patch but the reproducer still triggered  
crash:
memory leak in batadv_tvlv_handler_register

   484.626788][  T156] bond0 (unregistering): Releasing backup interface  
bond_slave_1
Warning: Permanently added '10.128.0.87' (ECDSA) to the list of known
hosts.
BUG: memory leak
unreferenced object 0xffff88811d25c4c0 (size 64):
   comm "softirq", pid 0, jiffies 4294943668 (age 434.830s)
   hex dump (first 32 bytes):
     00 00 00 00 00 00 00 00 e0 fc 5b 20 81 88 ff ff  ..........[ ....
     00 00 00 00 00 00 00 00 20 91 15 83 ff ff ff ff  ........ .......
   backtrace:
     [<000000000045bc9d>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:43 [inline]
     [<000000000045bc9d>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000000045bc9d>] slab_alloc mm/slab.c:3326 [inline]
     [<000000000045bc9d>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
     [<00000000197d773e>] kmalloc include/linux/slab.h:547 [inline]
     [<00000000197d773e>] kzalloc include/linux/slab.h:742 [inline]
     [<00000000197d773e>] batadv_tvlv_handler_register+0xae/0x140  
net/batman-adv/tvlv.c:529
     [<00000000fa9f11af>] batadv_tt_init+0x78/0x180  
net/batman-adv/translation-table.c:4411
     [<000000008c50839d>] batadv_mesh_init+0x196/0x230  
net/batman-adv/main.c:208
     [<000000001c5a74a3>] batadv_softif_init_late+0x1ca/0x220  
net/batman-adv/soft-interface.c:861
     [<000000004e676cd1>] register_netdevice+0xbf/0x600
net/core/dev.c:8635
     [<000000005601497b>] __rtnl_newlink+0xaca/0xb30  
net/core/rtnetlink.c:3199
     [<00000000ad02cf5e>] rtnl_newlink+0x4e/0x80 net/core/rtnetlink.c:3245
     [<00000000eceb53af>] rtnetlink_rcv_msg+0x178/0x4b0  
net/core/rtnetlink.c:5214
     [<00000000140451f6>] netlink_rcv_skb+0x61/0x170  
net/netlink/af_netlink.c:2482
     [<00000000237e38f7>] rtnetlink_rcv+0x1d/0x30
net/core/rtnetlink.c:5232
     [<000000000d47c000>] netlink_unicast_kernel  
net/netlink/af_netlink.c:1307 [inline]
     [<000000000d47c000>] netlink_unicast+0x1ec/0x2d0  
net/netlink/af_netlink.c:1333
     [<0000000098503d79>] netlink_sendmsg+0x26a/0x480  
net/netlink/af_netlink.c:1922
     [<000000009263e868>] sock_sendmsg_nosec net/socket.c:646 [inline]
     [<000000009263e868>] sock_sendmsg+0x54/0x70 net/socket.c:665
     [<000000007791ad47>] __sys_sendto+0x148/0x1f0 net/socket.c:1958
     [<00000000d6f3807d>] __do_sys_sendto net/socket.c:1970 [inline]
     [<00000000d6f3807d>] __se_sys_sendto net/socket.c:1966 [inline]
     [<00000000d6f3807d>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1966

BUG: memory leak
unreferenced object 0xffff8881024a3340 (size 64):
   comm "softirq", pid 0, jiffies 4294943678 (age 434.730s)
   hex dump (first 32 bytes):
     00 00 00 00 00 00 00 00 e0 2c 66 04 81 88 ff ff  .........,f.....
     00 00 00 00 00 00 00 00 20 91 15 83 ff ff ff ff  ........ .......
   backtrace:
     [<000000000045bc9d>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:43 [inline]
     [<000000000045bc9d>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000000045bc9d>] slab_alloc mm/slab.c:3326 [inline]
     [<000000000045bc9d>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
     [<00000000197d773e>] kmalloc include/linux/slab.h:547 [inline]
     [<00000000197d773e>] kzalloc include/linux/slab.h:742 [inline]
     [<00000000197d773e>] batadv_tvlv_handler_register+0xae/0x140  
net/batman-adv/tvlv.c:529
     [<00000000fa9f11af>] batadv_tt_init+0x78/0x180  
net/batman-adv/translation-table.c:4411
     [<000000008c50839d>] batadv_mesh_init+0x196/0x230  
net/batman-adv/main.c:208
     [<000000001c5a74a3>] batadv_softif_init_late+0x1ca/0x220  
net/batman-adv/soft-interface.c:861
     [<000000004e676cd1>] register_netdevice+0xbf/0x600
net/core/dev.c:8635
     [<000000005601497b>] __rtnl_newlink+0xaca/0xb30  
net/core/rtnetlink.c:3199
     [<00000000ad02cf5e>] rtnl_newlink+0x4e/0x80 net/core/rtnetlink.c:3245
     [<00000000eceb53af>] rtnetlink_rcv_msg+0x178/0x4b0  
net/core/rtnetlink.c:5214
     [<00000000140451f6>] netlink_rcv_skb+0x61/0x170  
net/netlink/af_netlink.c:2482
     [<00000000237e38f7>] rtnetlink_rcv+0x1d/0x30
net/core/rtnetlink.c:5232
     [<000000000d47c000>] netlink_unicast_kernel  
net/netlink/af_netlink.c:1307 [inline]
     [<000000000d47c000>] netlink_unicast+0x1ec/0x2d0  
net/netlink/af_netlink.c:1333
     [<0000000098503d79>] netlink_sendmsg+0x26a/0x480  
net/netlink/af_netlink.c:1922
     [<000000009263e868>] sock_sendmsg_nosec net/socket.c:646 [inline]
     [<000000009263e868>] sock_sendmsg+0x54/0x70 net/socket.c:665
     [<000000007791ad47>] __sys_sendto+0x148/0x1f0 net/socket.c:1958
     [<00000000d6f3807d>] __do_sys_sendto net/socket.c:1970 [inline]
     [<00000000d6f3807d>] __se_sys_sendto net/socket.c:1966 [inline]
     [<00000000d6f3807d>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1966

BUG: memory leak
unreferenced object 0xffff888108a71b80 (size 128):
   comm "syz-executor.3", pid 7367, jiffies 4294943696 (age 434.550s)
   hex dump (first 32 bytes):
     f0 f8 bf 02 81 88 ff ff f0 f8 bf 02 81 88 ff ff  ................
     1a dc 77 da 54 a0 be 41 64 20 e9 56 ff ff ff ff  ..w.T..Ad .V....
   backtrace:
     [<000000000045bc9d>] kmemleak_alloc_recursive  
include/linux/kmemleak.h:43 [inline]
     [<000000000045bc9d>] slab_post_alloc_hook mm/slab.h:439 [inline]
     [<000000000045bc9d>] slab_alloc mm/slab.c:3326 [inline]
     [<000000000045bc9d>] kmem_cache_alloc_trace+0x13d/0x280
mm/slab.c:3553
     [<00000000cc6863ae>] kmalloc include/linux/slab.h:547 [inline]
     [<00000000cc6863ae>] hsr_create_self_node+0x42/0x150  
net/hsr/hsr_framereg.c:84
     [<000000000e2bb6b0>] hsr_dev_finalize+0xa4/0x233  
net/hsr/hsr_device.c:441
     [<000000003b100a4a>] hsr_newlink+0xf3/0x140 net/hsr/hsr_netlink.c:69
     [<00000000b5efb0eb>] __rtnl_newlink+0x892/0xb30  
net/core/rtnetlink.c:3187
     [<00000000ad02cf5e>] rtnl_newlink+0x4e/0x80 net/core/rtnetlink.c:3245
     [<00000000eceb53af>] rtnetlink_rcv_msg+0x178/0x4b0  
net/core/rtnetlink.c:5214
     [<00000000140451f6>] netlink_rcv_skb+0x61/0x170  
net/netlink/af_netlink.c:2482
     [<00000000237e38f7>] rtnetlink_rcv+0x1d/0x30
net/core/rtnetlink.c:5232
     [<000000000d47c000>] netlink_unicast_kernel  
net/netlink/af_netlink.c:1307 [inline]
     [<000000000d47c000>] netlink_unicast+0x1ec/0x2d0  
net/netlink/af_netlink.c:1333
     [<0000000098503d79>] netlink_sendmsg+0x26a/0x480  
net/netlink/af_netlink.c:1922
     [<000000009263e868>] sock_sendmsg_nosec net/socket.c:646 [inline]
     [<000000009263e868>] sock_sendmsg+0x54/0x70 net/socket.c:665
     [<000000007791ad47>] __sys_sendto+0x148/0x1f0 net/socket.c:1958
     [<00000000d6f3807d>] __do_sys_sendto net/socket.c:1970 [inline]
     [<00000000d6f3807d>] __se_sys_sendto net/socket.c:1966 [inline]
     [<00000000d6f3807d>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1966
     [<000000003ba31db7>] do_syscall_64+0x76/0x1a0  
arch/x86/entry/common.c:301
     [<0000000075c8daad>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



Tested on:

commit:         c11fb13a Merge branch 'for-linus' of
git://git.kernel.org/..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15c8f3b6a00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=cb38d33cd06d8d48
compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
patch:          https://syzkaller.appspot.com/x/patch.diff?x=12477101a00000

Jeremy Sowden

2019-Jun-14 08:38 UTC

head link

memory leak in vhost_net_ioctl

On 2019-06-13, at 20:04:01 -0700, syzbot wrote:> syzbot has tested the proposed patch but the reproducer still
> triggered crash: memory leak in batadv_tvlv_handler_register
There's already a fix for this batman leak:

  https://lore.kernel.org/netdev/00000000000017d64c058965f966 at google.com/
  https://www.open-mesh.org/issues/378
>   484.626788][  T156] bond0 (unregistering): Releasing backup
>   interface bond_slave_1
> Warning: Permanently added '10.128.0.87' (ECDSA) to the list of
known
> hosts.
> BUG: memory leak
> unreferenced object 0xffff88811d25c4c0 (size 64):
>   comm "softirq", pid 0, jiffies 4294943668 (age 434.830s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 e0 fc 5b 20 81 88 ff ff  ..........[ ....
>     00 00 00 00 00 00 00 00 20 91 15 83 ff ff ff ff  ........ .......
>   backtrace:
>     [<000000000045bc9d>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
>     [<000000000045bc9d>] slab_post_alloc_hook mm/slab.h:439 [inline]
>     [<000000000045bc9d>] slab_alloc mm/slab.c:3326 [inline]
>     [<000000000045bc9d>] kmem_cache_alloc_trace+0x13d/0x280
> mm/slab.c:3553
>     [<00000000197d773e>] kmalloc include/linux/slab.h:547 [inline]
>     [<00000000197d773e>] kzalloc include/linux/slab.h:742 [inline]
>     [<00000000197d773e>] batadv_tvlv_handler_register+0xae/0x140
> net/batman-adv/tvlv.c:529
>     [<00000000fa9f11af>] batadv_tt_init+0x78/0x180
> net/batman-adv/translation-table.c:4411
>     [<000000008c50839d>] batadv_mesh_init+0x196/0x230
> net/batman-adv/main.c:208
>     [<000000001c5a74a3>] batadv_softif_init_late+0x1ca/0x220
> net/batman-adv/soft-interface.c:861
>     [<000000004e676cd1>] register_netdevice+0xbf/0x600
> net/core/dev.c:8635
>     [<000000005601497b>] __rtnl_newlink+0xaca/0xb30
> net/core/rtnetlink.c:3199
>     [<00000000ad02cf5e>] rtnl_newlink+0x4e/0x80
> net/core/rtnetlink.c:3245
>     [<00000000eceb53af>] rtnetlink_rcv_msg+0x178/0x4b0
> net/core/rtnetlink.c:5214
>     [<00000000140451f6>] netlink_rcv_skb+0x61/0x170
> net/netlink/af_netlink.c:2482
>     [<00000000237e38f7>] rtnetlink_rcv+0x1d/0x30
> net/core/rtnetlink.c:5232
>     [<000000000d47c000>] netlink_unicast_kernel
> net/netlink/af_netlink.c:1307 [inline]
>     [<000000000d47c000>] netlink_unicast+0x1ec/0x2d0
> net/netlink/af_netlink.c:1333
>     [<0000000098503d79>] netlink_sendmsg+0x26a/0x480
> net/netlink/af_netlink.c:1922
>     [<000000009263e868>] sock_sendmsg_nosec net/socket.c:646 [inline]
>     [<000000009263e868>] sock_sendmsg+0x54/0x70 net/socket.c:665
>     [<000000007791ad47>] __sys_sendto+0x148/0x1f0 net/socket.c:1958
>     [<00000000d6f3807d>] __do_sys_sendto net/socket.c:1970 [inline]
>     [<00000000d6f3807d>] __se_sys_sendto net/socket.c:1966 [inline]
>     [<00000000d6f3807d>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1966
>
> BUG: memory leak
> unreferenced object 0xffff8881024a3340 (size 64):
>   comm "softirq", pid 0, jiffies 4294943678 (age 434.730s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 e0 2c 66 04 81 88 ff ff  .........,f.....
>     00 00 00 00 00 00 00 00 20 91 15 83 ff ff ff ff  ........ .......
>   backtrace:
>     [<000000000045bc9d>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
>     [<000000000045bc9d>] slab_post_alloc_hook mm/slab.h:439 [inline]
>     [<000000000045bc9d>] slab_alloc mm/slab.c:3326 [inline]
>     [<000000000045bc9d>] kmem_cache_alloc_trace+0x13d/0x280
> mm/slab.c:3553
>     [<00000000197d773e>] kmalloc include/linux/slab.h:547 [inline]
>     [<00000000197d773e>] kzalloc include/linux/slab.h:742 [inline]
>     [<00000000197d773e>] batadv_tvlv_handler_register+0xae/0x140
> net/batman-adv/tvlv.c:529
>     [<00000000fa9f11af>] batadv_tt_init+0x78/0x180
> net/batman-adv/translation-table.c:4411
>     [<000000008c50839d>] batadv_mesh_init+0x196/0x230
> net/batman-adv/main.c:208
>     [<000000001c5a74a3>] batadv_softif_init_late+0x1ca/0x220
> net/batman-adv/soft-interface.c:861
>     [<000000004e676cd1>] register_netdevice+0xbf/0x600
> net/core/dev.c:8635
>     [<000000005601497b>] __rtnl_newlink+0xaca/0xb30
> net/core/rtnetlink.c:3199
>     [<00000000ad02cf5e>] rtnl_newlink+0x4e/0x80
> net/core/rtnetlink.c:3245
>     [<00000000eceb53af>] rtnetlink_rcv_msg+0x178/0x4b0
> net/core/rtnetlink.c:5214
>     [<00000000140451f6>] netlink_rcv_skb+0x61/0x170
> net/netlink/af_netlink.c:2482
>     [<00000000237e38f7>] rtnetlink_rcv+0x1d/0x30
> net/core/rtnetlink.c:5232
>     [<000000000d47c000>] netlink_unicast_kernel
> net/netlink/af_netlink.c:1307 [inline]
>     [<000000000d47c000>] netlink_unicast+0x1ec/0x2d0
> net/netlink/af_netlink.c:1333
>     [<0000000098503d79>] netlink_sendmsg+0x26a/0x480
> net/netlink/af_netlink.c:1922
>     [<000000009263e868>] sock_sendmsg_nosec net/socket.c:646 [inline]
>     [<000000009263e868>] sock_sendmsg+0x54/0x70 net/socket.c:665
>     [<000000007791ad47>] __sys_sendto+0x148/0x1f0 net/socket.c:1958
>     [<00000000d6f3807d>] __do_sys_sendto net/socket.c:1970 [inline]
>     [<00000000d6f3807d>] __se_sys_sendto net/socket.c:1966 [inline]
>     [<00000000d6f3807d>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1966
>
> BUG: memory leak
> unreferenced object 0xffff888108a71b80 (size 128):
>   comm "syz-executor.3", pid 7367, jiffies 4294943696 (age
434.550s)
>   hex dump (first 32 bytes):
>     f0 f8 bf 02 81 88 ff ff f0 f8 bf 02 81 88 ff ff  ................
>     1a dc 77 da 54 a0 be 41 64 20 e9 56 ff ff ff ff  ..w.T..Ad .V....
>   backtrace:
>     [<000000000045bc9d>] kmemleak_alloc_recursive
> include/linux/kmemleak.h:43 [inline]
>     [<000000000045bc9d>] slab_post_alloc_hook mm/slab.h:439 [inline]
>     [<000000000045bc9d>] slab_alloc mm/slab.c:3326 [inline]
>     [<000000000045bc9d>] kmem_cache_alloc_trace+0x13d/0x280
> mm/slab.c:3553
>     [<00000000cc6863ae>] kmalloc include/linux/slab.h:547 [inline]
>     [<00000000cc6863ae>] hsr_create_self_node+0x42/0x150
> net/hsr/hsr_framereg.c:84
>     [<000000000e2bb6b0>] hsr_dev_finalize+0xa4/0x233
> net/hsr/hsr_device.c:441
>     [<000000003b100a4a>] hsr_newlink+0xf3/0x140
> net/hsr/hsr_netlink.c:69
>     [<00000000b5efb0eb>] __rtnl_newlink+0x892/0xb30
> net/core/rtnetlink.c:3187
>     [<00000000ad02cf5e>] rtnl_newlink+0x4e/0x80
> net/core/rtnetlink.c:3245
>     [<00000000eceb53af>] rtnetlink_rcv_msg+0x178/0x4b0
> net/core/rtnetlink.c:5214
>     [<00000000140451f6>] netlink_rcv_skb+0x61/0x170
> net/netlink/af_netlink.c:2482
>     [<00000000237e38f7>] rtnetlink_rcv+0x1d/0x30
> net/core/rtnetlink.c:5232
>     [<000000000d47c000>] netlink_unicast_kernel
> net/netlink/af_netlink.c:1307 [inline]
>     [<000000000d47c000>] netlink_unicast+0x1ec/0x2d0
> net/netlink/af_netlink.c:1333
>     [<0000000098503d79>] netlink_sendmsg+0x26a/0x480
> net/netlink/af_netlink.c:1922
>     [<000000009263e868>] sock_sendmsg_nosec net/socket.c:646 [inline]
>     [<000000009263e868>] sock_sendmsg+0x54/0x70 net/socket.c:665
>     [<000000007791ad47>] __sys_sendto+0x148/0x1f0 net/socket.c:1958
>     [<00000000d6f3807d>] __do_sys_sendto net/socket.c:1970 [inline]
>     [<00000000d6f3807d>] __se_sys_sendto net/socket.c:1966 [inline]
>     [<00000000d6f3807d>] __x64_sys_sendto+0x2a/0x30 net/socket.c:1966
>     [<000000003ba31db7>] do_syscall_64+0x76/0x1a0
> arch/x86/entry/common.c:301
>     [<0000000075c8daad>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Tested on:
>
> commit:         c11fb13a Merge branch 'for-linus' of
git://git.kernel.org/..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15c8f3b6a00000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=cb38d33cd06d8d48
> compiler:       gcc (GCC) 9.0.0 20181231 (experimental)
> patch:          https://syzkaller.appspot.com/x/patch.diff?x=12477101a00000
J.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL:
<http://lists.linuxfoundation.org/pipermail/virtualization/attachments/20190614/6b7c2d08/attachment-0001.sig>

Maybe Matching Threads

Search for more reasonably related threads

Virtualization - Jun 2019 - memory leak in vhost_net_ioctl

memory leak in vhost_net_ioctl

memory leak in vhost_net_ioctl

memory leak in vhost_net_ioctl

Maybe Matching Threads