From: Eric Biggers <ebiggers@kernel.org>
To: "\\xcH3332\\" <ch3332xr@gmail.com>
Cc: linux-kernel@vger.kernel.org, syzkaller@googlegroups.com
Subject: Re: memory leak in getname_flags ( 5.9.0-rc5)
Date: Thu, 17 Sep 2020 08:24:02 -0700 [thread overview]
Message-ID: <20200917152402.GA855@sol.localdomain> (raw)
In-Reply-To: <CAJ5WPnFq5TrRT9uyjnZdVB_V6doXVGYQQJ3h98cnuRYY6xueQQ@mail.gmail.com>
On Thu, Sep 17, 2020 at 07:32:12PM +0530, \xcH3332\ wrote:
> Syzkaller hit 'memory leak in getname_flags' bug.
>
>
> 5.9.0-rc5
>
>
> 2020/09/17 10:31:39 executed programs: 195
> 2020/09/17 10:31:45 executed programs: 204
> 2020/09/17 10:31:50 executed programs: 226
> 2020/09/17 10:31:56 executed programs: 239
> BUG: memory leak
> unreferenced object 0xffff8ba9f42fa000 (size 4096):
> comm "syz-executor.4", pid 5686, jiffies 4295939335 (age 12.397s)
> hex dump (first 32 bytes):
> 20 a0 2f f4 a9 8b ff ff 40 02 00 20 00 00 00 00 ./.....@.. ....
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<0000000084fbe16c>] getname_flags+0x57/0x260
> [<00000000a25b6483>] __io_openat_prep+0x76/0x100
> [<0000000030fd3f89>] io_openat2_prep.part.0+0x5b/0xb0
> [<00000000e274bfc6>] io_issue_sqe+0x445/0x1940
> [<00000000bad7fba6>] __io_queue_sqe+0x189/0x540
> [<000000000d09a5ef>] io_queue_sqe+0x28f/0x440
> [<00000000c36c4e95>] io_submit_sqes+0x7e9/0xa90
> [<00000000a15f6a28>] __x64_sys_io_uring_enter+0x23e/0x350
> [<00000000449792f4>] do_syscall_64+0x33/0x40
> [<00000000bdacf1c3>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
>
>
> Syzkaller reproducer:
> # {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:8
> Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:true
> NetInjection:false NetDevices:true NetReset:true Cgroups:true
> BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false USB:false
> VhciInjection:false UseTmpDir:true HandleSegv:true Repro:false
> Trace:false}
> r0 = syz_io_uring_setup(0x5bfa, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2,
> 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil,
> &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0)
> syz_io_uring_submit(r1, r2,
> &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0,
> 0xffffffffffffff9c, &(0x7f0000000200)={0x42},
> &(0x7f0000000240)='./file1\x00', 0x18, 0x0, 0x12345}, 0x0)
> io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0)
You need to send this to the appropriate maintainers:
$ ./scripts/get_maintainer.pl fs/io_uring.c
Jens Axboe <axboe@kernel.dk> (maintainer:IO_URING)
Alexander Viro <viro@zeniv.linux.org.uk> (maintainer:FILESYSTEMS (VFS and infrastructure))
io-uring@vger.kernel.org (open list:IO_URING)
linux-fsdevel@vger.kernel.org (open list:FILESYSTEMS (VFS and infrastructure))
linux-kernel@vger.kernel.org (open list)
prev parent reply other threads:[~2020-09-17 15:41 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-17 14:02 memory leak in getname_flags ( 5.9.0-rc5) \xcH3332\
2020-09-17 15:24 ` Eric Biggers [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200917152402.GA855@sol.localdomain \
--to=ebiggers@kernel.org \
--cc=ch3332xr@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox