[syzbot] [btrfs?] [ext4?] [ntfs3?] memory leak in __pcs_replace_full_main

[syzbot] [btrfs?] [ext4?] [ntfs3?] memory leak in __pcs_replace_full_main

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    36aad21d50d1 Merge tag 'ksmbd-for-7.4-rc1-part2' of git://..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14e205f1580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=afcef595c54d5d11
dashboard link: https://syzkaller.appspot.com/bug?extid=4d078516add5f4f12cea
compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12e205f1580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/67a38cdd86cf/disk-36aad21d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7b8834e6d3d5/vmlinux-36aad21d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9103be67c72d/bzImage-36aad21d.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/a661f7a0d152/mount_0.gz
  fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=130fea8d580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/5aa6292982d9/mount_13.gz
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/5bf87b41f4ce/mount_16.gz
  fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=13558981580000)

AI-generated root cause summary:
The SLUB allocator's sheaf caching layer allocates 'struct slab_sheaf' objects
via kmalloc_flags(), which registers them with kmemleak for leak tracking. When
full RCU sheaves are retired in __kfree_rcu_sheaf(), they are queued into RCU
via call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf). While pending in RCU's
singly-linked callback list, if any preceding callback resides in memory
untracked or ignored by kmemleak (such as struct slab from
call_rcu(&slab->rcu_head, rcu_free_slab)), kmemleak cannot traverse the chain to
reach subsequent callbacks. Because __alloc_empty_sheaf() does not mark the
sheaf with kmemleak_not_leak() (which marks the metadata grey so it is not
reported as a leak while still scanning its cached objects), kmemleak falsely
flags pending RCU sheaves as unreferenced memory leaks.

full analysis:  https://syzkaller.appspot.com/x/ai_root_cause?x=4d078516add5f4f12cea

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff8881009d4e00 (size 512):
  comm "kworker/0:1", pid 10, jiffies 4294937433
  hex dump (first 32 bytes):
    b0 7e 81 2d 81 88 ff ff 60 bd b3 81 ff ff ff ff  .~.-....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 91d5a5d8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    vfree mm/vmalloc.c:3549 [inline]
    vfree+0xa8/0x390 mm/vmalloc.c:3521
    delayed_vfree_work+0x29/0x40 mm/vmalloc.c:3451
    process_one_work+0x2b7/0x5c0 kernel/workqueue.c:3495
    process_scheduled_works kernel/workqueue.c:3578 [inline]
    worker_thread+0x255/0x4a0 kernel/workqueue.c:3659
    kthread+0x150/0x1a0 kernel/kthread.c:436
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888102382600 (size 512):
  comm "kworker/u8:6", pid 403, jiffies 4294937442
  hex dump (first 32 bytes):
    10 45 0c 2d 81 88 ff ff 60 bd b3 81 ff ff ff ff  .E.-....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 2d83b05a):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    call_usermodehelper_freeinfo kernel/umh.c:43 [inline]
    umh_complete kernel/umh.c:57 [inline]
    call_usermodehelper_exec_async+0x1c7/0x1f0 kernel/umh.c:117
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff8881009e5600 (size 512):
  comm "softirq", pid 0, jiffies 4294937452
  hex dump (first 32 bytes):
    10 25 4b 2c 81 88 ff ff 60 bd b3 81 ff ff ff ff  .%K,....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 9cf07d25):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    security_task_free+0x6e/0x130 security/security.c:2827
    __put_task_struct+0x9f/0x260 kernel/fork.c:792
    rcu_do_batch kernel/rcu/tree.c:2650 [inline]
    rcu_core+0x269/0x720 kernel/rcu/tree.c:2919
    handle_softirqs+0x114/0x330 kernel/softirq.c:669
    run_ksoftirqd kernel/softirq.c:1133 [inline]
    run_ksoftirqd+0x20/0x30 kernel/softirq.c:1125
    smpboot_thread_fn+0x1f5/0x430 kernel/smpboot.c:162
    kthread+0x150/0x1a0 kernel/kthread.c:436
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888109c00000 (size 512):
  comm "udevadm", pid 4995, jiffies 4294938376
  hex dump (first 32 bytes):
    00 3e 67 26 81 88 ff ff 60 bd b3 81 ff ff ff ff  .>g&....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc acde3b3b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_empty_main+0x260/0x2e0 mm/slub.c:4806
    alloc_from_pcs mm/slub.c:4887 [inline]
    slab_alloc_node mm/slub.c:5021 [inline]
    __kmalloc_cache_noprof+0x370/0x3f0 mm/slub.c:5676
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    kernfs_get_open_node fs/kernfs/file.c:537 [inline]
    kernfs_fop_open+0x523/0x620 fs/kernfs/file.c:725
    do_dentry_open+0x1d9/0x7e0 fs/open.c:1000
    vfs_open_consume+0x4e/0x1c0 fs/open.c:1131
    do_open fs/namei.c:4851 [inline]
    path_openat+0xb90/0x1250 fs/namei.c:5016
    do_file_open+0x121/0x200 fs/namei.c:5045
    do_sys_openat2+0xd9/0x140 fs/open.c:1442
    do_sys_open fs/open.c:1448 [inline]
    __do_sys_openat fs/open.c:1464 [inline]
    __se_sys_openat fs/open.c:1459 [inline]
    __x64_sys_openat+0x82/0xf0 fs/open.c:1459
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888109bff800 (size 512):
  comm "udevd", pid 4994, jiffies 4294938441
  hex dump (first 32 bytes):
    70 76 fd 26 81 88 ff ff 60 bd b3 81 ff ff ff ff  pv.&....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 1107e34f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __kfree_rcu_sheaf+0x1aa/0x2d0 mm/slub.c:6282
    kfree_rcu_sheaf mm/slab_common.c:1689 [inline]
    kvfree_call_rcu+0x1ef/0x3a0 mm/slab_common.c:2044
    kernfs_unlink_open_file+0x18f/0x1a0 fs/kernfs/file.c:611
    kernfs_fop_release+0x55/0x110 fs/kernfs/file.c:790
    __fput+0x1a6/0x4f0 fs/file_table.c:512
    fput_close_sync+0x67/0x130 fs/file_table.c:618
    filp_close_sync fs/open.c:1573 [inline]
    __do_sys_close fs/open.c:1596 [inline]
    __se_sys_close fs/open.c:1583 [inline]
    __x64_sys_close+0x4a/0xc0 fs/open.c:1583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a9dae00 (size 512):
  comm "sshd", pid 5384, jiffies 4294938845
  hex dump (first 32 bytes):
    00 7e 05 26 81 88 ff ff 60 bd b3 81 ff ff ff ff  .~.&....`.......
    00 4a 04 00 81 88 ff ff 20 00 00 00 00 00 00 00  .J...... .......
  backtrace (crc b8bd2d90):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    kmem_cache_prefill_sheaf+0x1a2/0x2d0 mm/slub.c:5279
    mt_get_sheaf lib/maple_tree.c:154 [inline]
    mas_alloc_nodes lib/maple_tree.c:1079 [inline]
    mas_preallocate+0x3fb/0x6f0 lib/maple_tree.c:5016
    vma_iter_prealloc mm/vma.h:698 [inline]
    __mmap_new_vma mm/vma.c:2713 [inline]
    __mmap_region+0xd92/0x1be0 mm/vma.c:3054
    mmap_region+0x19c/0x2a0 mm/vma.c:3136
    do_mmap+0x950/0xdf0 mm/mmap.c:573
    vm_mmap_pgoff+0x195/0x310 mm/util.c:581
    ksys_mmap_pgoff+0x89/0x2e0 mm/mmap.c:619
    __do_sys_mmap arch/x86/kernel/sys_x86_64.c:96 [inline]
    __se_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
    __x64_sys_mmap+0x6f/0xa0 arch/x86/kernel/sys_x86_64.c:89
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
** replaying previous printk message **


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Forwarded: [PATCH] mm/slub: fix kmemleak false positive in RCU sheaves

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [PATCH] mm/slub: fix kmemleak false positive in RCU sheaves
Author: gowtham398gs@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The SLUB allocator's sheaf caching layer allocates `struct slab_sheaf`
objects via `kmalloc_flags()`, which registers them with kmemleak
for leak tracking. When full RCU sheaves are retired in
`__kfree_rcu_sheaf()`, they are queued into RCU via
`call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf)`.

While pending in RCU's singly-linked callback list, if any preceding
callback resides in memory untracked or ignored by kmemleak
(such as `struct slab` from `call_rcu(&slab->rcu_head, rcu_free_slab)`),
kmemleak cannot traverse the chain to reach subsequent callbacks.
Because `__alloc_empty_sheaf()` does not mark the sheaf with
`kmemleak_not_leak()`,kmemleak falsely flags pending RCU sheaves
as unreferenced memory leaks.

Applying `kmemleak_not_leak()` marks the sheaf metadata as grey,
preventing the false leak report while ensuring kmemleak still scans the
cached objects within `sheaf->objects[]`, whose freeing hooks
are deferred until `rcu_free_sheaf()` runs.

Reported-by: syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4d078516add5f4f12cea
Fixes: 36aad21d50d1 ("mm/slub: add RCU sheaf caching")

Signed-off-by: Gowtham S Bhushan <gowtham398gs@gmail.com>
---
 mm/slub.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/mm/slub.c b/mm/slub.c
index 45e077c7526c..61cd77644c3b 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -2856,6 +2856,8 @@ static struct slab_sheaf *__alloc_empty_sheaf(struct kmem_cache *s, gfp_t gfp,
 	if (unlikely(!sheaf))
 		return NULL;
 
+	kmemleak_not_leak(sheaf);
+
 	sheaf->cache = s;
 
 	stat(s, SHEAF_ALLOC);
-- 
2.56.0