Re: memory leak in io_submit_sqes (2)

From: syzbot
Date: Wed Mar 03 2021 - 19:11:25 EST

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes

BUG: memory leak
unreferenced object 0xffff88811043cc00 (size 232):
comm "syz-executor.0", pid 10595, jiffies 4294944973 (age 10.850s)
hex dump (first 32 bytes):
00 f0 40 10 81 88 ff ff 00 00 00 00 00 00 00 00 ..@.............
00 7a 5f 81 ff ff ff ff 00 00 00 00 00 00 00 00 .z_.............
backtrace:
[<000000005cfa592c>] io_alloc_req fs/io_uring.c:1610 [inline]
[<000000005cfa592c>] io_submit_sqes+0x7ae/0x22f0 fs/io_uring.c:6518
[<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
[<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888124dd1300 (size 256):
comm "syz-executor.0", pid 10595, jiffies 4294944973 (age 10.850s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000099ea7aac>] kmalloc include/linux/slab.h:559 [inline]
[<0000000099ea7aac>] __io_alloc_async_data fs/io_uring.c:3060 [inline]
[<0000000099ea7aac>] io_setup_async_rw fs/io_uring.c:3079 [inline]
[<0000000099ea7aac>] io_setup_async_rw+0xa3/0x1e0 fs/io_uring.c:3072
[<0000000002d951db>] io_read+0x1fe/0x560 fs/io_uring.c:3257
[<00000000ca56953d>] io_issue_sqe+0x18d/0x23e0 fs/io_uring.c:5933
[<00000000a5a737fd>] __io_queue_sqe+0x9a/0x4f0 fs/io_uring.c:6200
[<00000000af920b23>] io_queue_sqe+0x361/0x560 fs/io_uring.c:6253
[<00000000deecb73d>] io_submit_sqe fs/io_uring.c:6417 [inline]
[<00000000deecb73d>] io_submit_sqes+0x1fc1/0x22f0 fs/io_uring.c:6531
[<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
[<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff88810d21fa00 (size 232):
comm "syz-executor.0", pid 10613, jiffies 4294944997 (age 10.610s)
hex dump (first 32 bytes):
00 47 b1 11 81 88 ff ff 00 00 00 00 00 00 00 00 .G..............
00 7a 5f 81 ff ff ff ff 00 00 00 00 00 00 00 00 .z_.............
backtrace:
[<000000005cfa592c>] io_alloc_req fs/io_uring.c:1610 [inline]
[<000000005cfa592c>] io_submit_sqes+0x7ae/0x22f0 fs/io_uring.c:6518
[<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
[<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888124e98500 (size 256):
comm "syz-executor.0", pid 10613, jiffies 4294944997 (age 10.610s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000099ea7aac>] kmalloc include/linux/slab.h:559 [inline]
[<0000000099ea7aac>] __io_alloc_async_data fs/io_uring.c:3060 [inline]
[<0000000099ea7aac>] io_setup_async_rw fs/io_uring.c:3079 [inline]
[<0000000099ea7aac>] io_setup_async_rw+0xa3/0x1e0 fs/io_uring.c:3072
[<0000000002d951db>] io_read+0x1fe/0x560 fs/io_uring.c:3257
[<00000000ca56953d>] io_issue_sqe+0x18d/0x23e0 fs/io_uring.c:5933
[<00000000a5a737fd>] __io_queue_sqe+0x9a/0x4f0 fs/io_uring.c:6200
[<00000000af920b23>] io_queue_sqe+0x361/0x560 fs/io_uring.c:6253
[<00000000deecb73d>] io_submit_sqe fs/io_uring.c:6417 [inline]
[<00000000deecb73d>] io_submit_sqes+0x1fc1/0x22f0 fs/io_uring.c:6531
[<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
[<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff88810edcff00 (size 232):
comm "syz-executor.0", pid 10633, jiffies 4294945010 (age 10.480s)
hex dump (first 32 bytes):
00 99 b3 11 81 88 ff ff 00 00 00 00 00 00 00 00 ................
00 7a 5f 81 ff ff ff ff 00 00 00 00 00 00 00 00 .z_.............
backtrace:
[<000000005cfa592c>] io_alloc_req fs/io_uring.c:1610 [inline]
[<000000005cfa592c>] io_submit_sqes+0x7ae/0x22f0 fs/io_uring.c:6518
[<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
[<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888124c06300 (size 256):
comm "syz-executor.0", pid 10633, jiffies 4294945010 (age 10.480s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000099ea7aac>] kmalloc include/linux/slab.h:559 [inline]
[<0000000099ea7aac>] __io_alloc_async_data fs/io_uring.c:3060 [inline]
[<0000000099ea7aac>] io_setup_async_rw fs/io_uring.c:3079 [inline]
[<0000000099ea7aac>] io_setup_async_rw+0xa3/0x1e0 fs/io_uring.c:3072
[<0000000002d951db>] io_read+0x1fe/0x560 fs/io_uring.c:3257
[<00000000ca56953d>] io_issue_sqe+0x18d/0x23e0 fs/io_uring.c:5933
[<00000000a5a737fd>] __io_queue_sqe+0x9a/0x4f0 fs/io_uring.c:6200
[<00000000af920b23>] io_queue_sqe+0x361/0x560 fs/io_uring.c:6253
[<00000000deecb73d>] io_submit_sqe fs/io_uring.c:6417 [inline]
[<00000000deecb73d>] io_submit_sqes+0x1fc1/0x22f0 fs/io_uring.c:6531
[<00000000bffe23f4>] __do_sys_io_uring_enter+0x857/0x10c0 fs/io_uring.c:9108
[<000000002e2222f2>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000005e5fec34>] entry_SYSCALL_64_after_hwframe+0x44/0xae



Tested on:

commit: 4f766d6f io_uring: ensure that threads freeze on suspend
git tree: git://git.kernel.dk/linux-block io_uring-5.12
console output: https://syzkaller.appspot.com/x/log.txt?x=143ce02ad00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c43bda1f1543d72b
dashboard link: https://syzkaller.appspot.com/bug?extid=91b4b56ead187d35c9d3
compiler: