From: syzbot <syzbot+006987d1be3586e13555@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [arm-msm?] [net?] memory leak in radix_tree_insert (2)
Date: Sat, 09 Dec 2023 22:30:03 -0800 [thread overview]
Message-ID: <0000000000009259a9060c21f28a@google.com> (raw)
In-Reply-To: <tencent_F5872516BA75BB5A33CC9E661B2F4BB81B08@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in radix_tree_insert
2023/12/10 06:24:31 executed programs: 3
BUG: memory leak
unreferenced object 0xffff88810dca76d0 (size 576):
comm "syz-executor.0", pid 5751, jiffies 4294945011 (age 13.020s)
hex dump (first 32 bytes):
3c 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 <...............
30 76 57 0c 81 88 ff ff e8 76 ca 0d 81 88 ff ff 0vW......v......
backtrace:
[<ffffffff81631398>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff81631398>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff81631398>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff81631398>] slab_alloc mm/slub.c:3486 [inline]
[<ffffffff81631398>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline]
[<ffffffff81631398>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502
[<ffffffff84b5094c>] radix_tree_node_alloc.constprop.0+0x7c/0x1a0 lib/radix-tree.c:276
[<ffffffff84b524cf>] __radix_tree_create lib/radix-tree.c:636 [inline]
[<ffffffff84b524cf>] radix_tree_insert+0x14f/0x360 lib/radix-tree.c:724
[<ffffffff84ae10b8>] qrtr_tx_wait net/qrtr/af_qrtr.c:277 [inline]
[<ffffffff84ae10b8>] qrtr_node_enqueue+0x5b8/0x670 net/qrtr/af_qrtr.c:354
[<ffffffff84ae2756>] qrtr_bcast_enqueue+0x66/0xd0 net/qrtr/af_qrtr.c:897
[<ffffffff84ae3332>] qrtr_sendmsg+0x232/0x450 net/qrtr/af_qrtr.c:998
[<ffffffff83ec3c42>] sock_sendmsg_nosec net/socket.c:730 [inline]
[<ffffffff83ec3c42>] __sock_sendmsg+0x52/0xa0 net/socket.c:745
[<ffffffff83ec3d8b>] sock_write_iter+0xfb/0x180 net/socket.c:1158
[<ffffffff816961a7>] call_write_iter include/linux/fs.h:2020 [inline]
[<ffffffff816961a7>] new_sync_write fs/read_write.c:491 [inline]
[<ffffffff816961a7>] vfs_write+0x327/0x590 fs/read_write.c:584
[<ffffffff816966fb>] ksys_write+0x13b/0x170 fs/read_write.c:637
[<ffffffff84b6de2f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84b6de2f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff88810dca66d8 (size 576):
comm "syz-executor.0", pid 5751, jiffies 4294945011 (age 13.020s)
hex dump (first 32 bytes):
36 0f 01 00 00 00 00 00 d0 76 ca 0d 81 88 ff ff 6........v......
30 76 57 0c 81 88 ff ff f0 66 ca 0d 81 88 ff ff 0vW......f......
backtrace:
[<ffffffff81631398>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff81631398>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff81631398>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff81631398>] slab_alloc mm/slub.c:3486 [inline]
[<ffffffff81631398>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline]
[<ffffffff81631398>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502
[<ffffffff84b5094c>] radix_tree_node_alloc.constprop.0+0x7c/0x1a0 lib/radix-tree.c:276
[<ffffffff84b524cf>] __radix_tree_create lib/radix-tree.c:636 [inline]
[<ffffffff84b524cf>] radix_tree_insert+0x14f/0x360 lib/radix-tree.c:724
[<ffffffff84ae10b8>] qrtr_tx_wait net/qrtr/af_qrtr.c:277 [inline]
[<ffffffff84ae10b8>] qrtr_node_enqueue+0x5b8/0x670 net/qrtr/af_qrtr.c:354
[<ffffffff84ae2756>] qrtr_bcast_enqueue+0x66/0xd0 net/qrtr/af_qrtr.c:897
[<ffffffff84ae3332>] qrtr_sendmsg+0x232/0x450 net/qrtr/af_qrtr.c:998
[<ffffffff83ec3c42>] sock_sendmsg_nosec net/socket.c:730 [inline]
[<ffffffff83ec3c42>] __sock_sendmsg+0x52/0xa0 net/socket.c:745
[<ffffffff83ec3d8b>] sock_write_iter+0xfb/0x180 net/socket.c:1158
[<ffffffff816961a7>] call_write_iter include/linux/fs.h:2020 [inline]
[<ffffffff816961a7>] new_sync_write fs/read_write.c:491 [inline]
[<ffffffff816961a7>] vfs_write+0x327/0x590 fs/read_write.c:584
[<ffffffff816966fb>] ksys_write+0x13b/0x170 fs/read_write.c:637
[<ffffffff84b6de2f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84b6de2f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff88810dd0f488 (size 576):
comm "syz-executor.0", pid 5751, jiffies 4294945011 (age 13.020s)
hex dump (first 32 bytes):
30 3f 01 00 00 00 00 00 d8 66 ca 0d 81 88 ff ff 0?.......f......
30 76 57 0c 81 88 ff ff a0 f4 d0 0d 81 88 ff ff 0vW.............
backtrace:
[<ffffffff81631398>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff81631398>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff81631398>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff81631398>] slab_alloc mm/slub.c:3486 [inline]
[<ffffffff81631398>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline]
[<ffffffff81631398>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502
[<ffffffff84b5094c>] radix_tree_node_alloc.constprop.0+0x7c/0x1a0 lib/radix-tree.c:276
[<ffffffff84b524cf>] __radix_tree_create lib/radix-tree.c:636 [inline]
[<ffffffff84b524cf>] radix_tree_insert+0x14f/0x360 lib/radix-tree.c:724
[<ffffffff84ae10b8>] qrtr_tx_wait net/qrtr/af_qrtr.c:277 [inline]
[<ffffffff84ae10b8>] qrtr_node_enqueue+0x5b8/0x670 net/qrtr/af_qrtr.c:354
[<ffffffff84ae2756>] qrtr_bcast_enqueue+0x66/0xd0 net/qrtr/af_qrtr.c:897
[<ffffffff84ae3332>] qrtr_sendmsg+0x232/0x450 net/qrtr/af_qrtr.c:998
[<ffffffff83ec3c42>] sock_sendmsg_nosec net/socket.c:730 [inline]
[<ffffffff83ec3c42>] __sock_sendmsg+0x52/0xa0 net/socket.c:745
[<ffffffff83ec3d8b>] sock_write_iter+0xfb/0x180 net/socket.c:1158
[<ffffffff816961a7>] call_write_iter include/linux/fs.h:2020 [inline]
[<ffffffff816961a7>] new_sync_write fs/read_write.c:491 [inline]
[<ffffffff816961a7>] vfs_write+0x327/0x590 fs/read_write.c:584
[<ffffffff816966fb>] ksys_write+0x13b/0x170 fs/read_write.c:637
[<ffffffff84b6de2f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84b6de2f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff8881005e0000 (size 576):
comm "syz-executor.0", pid 5751, jiffies 4294945011 (age 13.020s)
hex dump (first 32 bytes):
2a 3f 00 00 00 00 00 00 88 f4 d0 0d 81 88 ff ff *?..............
30 76 57 0c 81 88 ff ff 18 00 5e 00 81 88 ff ff 0vW.......^.....
backtrace:
[<ffffffff81631398>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff81631398>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff81631398>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff81631398>] slab_alloc mm/slub.c:3486 [inline]
[<ffffffff81631398>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline]
[<ffffffff81631398>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502
[<ffffffff84b5094c>] radix_tree_node_alloc.constprop.0+0x7c/0x1a0 lib/radix-tree.c:276
[<ffffffff84b524cf>] __radix_tree_create lib/radix-tree.c:636 [inline]
[<ffffffff84b524cf>] radix_tree_insert+0x14f/0x360 lib/radix-tree.c:724
[<ffffffff84ae10b8>] qrtr_tx_wait net/qrtr/af_qrtr.c:277 [inline]
[<ffffffff84ae10b8>] qrtr_node_enqueue+0x5b8/0x670 net/qrtr/af_qrtr.c:354
[<ffffffff84ae2756>] qrtr_bcast_enqueue+0x66/0xd0 net/qrtr/af_qrtr.c:897
[<ffffffff84ae3332>] qrtr_sendmsg+0x232/0x450 net/qrtr/af_qrtr.c:998
[<ffffffff83ec3c42>] sock_sendmsg_nosec net/socket.c:730 [inline]
[<ffffffff83ec3c42>] __sock_sendmsg+0x52/0xa0 net/socket.c:745
[<ffffffff83ec3d8b>] sock_write_iter+0xfb/0x180 net/socket.c:1158
[<ffffffff816961a7>] call_write_iter include/linux/fs.h:2020 [inline]
[<ffffffff816961a7>] new_sync_write fs/read_write.c:491 [inline]
[<ffffffff816961a7>] vfs_write+0x327/0x590 fs/read_write.c:584
[<ffffffff816966fb>] ksys_write+0x13b/0x170 fs/read_write.c:637
[<ffffffff84b6de2f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84b6de2f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
Tested on:
commit: 33cc938e Linux 6.7-rc4
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17e587dae80000
kernel config: https://syzkaller.appspot.com/x/.config?x=37d1b8bb20150e6
dashboard link: https://syzkaller.appspot.com/bug?extid=006987d1be3586e13555
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1626d7eee80000
next parent reply other threads:[~2023-12-10 6:36 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <tencent_F5872516BA75BB5A33CC9E661B2F4BB81B08@qq.com>
2023-12-10 6:30 ` syzbot [this message]
[not found] <20231211051540.1882463-1-lizhi.xu@windriver.com>
2023-12-11 5:52 ` [syzbot] [arm-msm?] [net?] memory leak in radix_tree_insert (2) syzbot
[not found] <20231211042442.1442601-1-lizhi.xu@windriver.com>
2023-12-11 4:41 ` syzbot
[not found] <tencent_5DCBB36DE37A697AA3A5A44C176557784605@qq.com>
2023-12-10 8:13 ` syzbot
[not found] <tencent_9CCF8C7BE26EA02CF16DE894A8E88EEDA60A@qq.com>
2023-12-10 5:39 ` syzbot
[not found] <tencent_FDEC79DE6C3C2C356F409770E8F6EFC2CE0A@qq.com>
2023-12-10 4:48 ` syzbot
[not found] <tencent_1571C9B12ED06EED4CAC67FD86C052FC4606@qq.com>
2023-12-10 4:08 ` syzbot
[not found] <tencent_0E30CFAC0DE825820DBC923D5DE75DAF1907@qq.com>
2023-12-10 1:19 ` syzbot
[not found] <tencent_140DE9120A5D895DEA192FCF900D9FA5F807@qq.com>
2023-12-09 7:10 ` syzbot
[not found] <tencent_366443176A9766C6D8D36A8374896363B605@qq.com>
2023-12-09 7:05 ` syzbot
[not found] <tencent_170675C9766F66183C77360A96A237AE4B09@qq.com>
2023-12-09 5:17 ` syzbot
[not found] <20231208094538.2466543-1-lizhi.xu@windriver.com>
2023-12-08 10:59 ` syzbot
[not found] <20231208074438.4102005-1-lizhi.xu@windriver.com>
2023-12-08 8:17 ` syzbot
[not found] <20231208065944.3611430-1-lizhi.xu@windriver.com>
2023-12-08 7:16 ` syzbot
[not found] <20231208055640.1895881-1-lizhi.xu@windriver.com>
2023-12-08 6:15 ` syzbot
[not found] <20231208041309.2699993-1-lizhi.xu@windriver.com>
2023-12-08 5:17 ` syzbot
2023-12-08 0:52 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000009259a9060c21f28a@google.com \
--to=syzbot+006987d1be3586e13555@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox