Re: memory leak in getname_flags ( 5.9.0-rc5)

[Eric Biggers]

On Thu, Sep 17, 2020 at 07:32:12PM +0530, \xcH3332\ wrote:
> Syzkaller hit 'memory leak in getname_flags' bug.
> 
> 
>  5.9.0-rc5
> 
> 
> 2020/09/17 10:31:39 executed programs: 195
> 2020/09/17 10:31:45 executed programs: 204
> 2020/09/17 10:31:50 executed programs: 226
> 2020/09/17 10:31:56 executed programs: 239
> BUG: memory leak
> unreferenced object 0xffff8ba9f42fa000 (size 4096):
>   comm "syz-executor.4", pid 5686, jiffies 4295939335 (age 12.397s)
>   hex dump (first 32 bytes):
>     20 a0 2f f4 a9 8b ff ff 40 02 00 20 00 00 00 00   ./.....@.. ....
>     01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<0000000084fbe16c>] getname_flags+0x57/0x260
>     [<00000000a25b6483>] __io_openat_prep+0x76/0x100
>     [<0000000030fd3f89>] io_openat2_prep.part.0+0x5b/0xb0
>     [<00000000e274bfc6>] io_issue_sqe+0x445/0x1940
>     [<00000000bad7fba6>] __io_queue_sqe+0x189/0x540
>     [<000000000d09a5ef>] io_queue_sqe+0x28f/0x440
>     [<00000000c36c4e95>] io_submit_sqes+0x7e9/0xa90
>     [<00000000a15f6a28>] __x64_sys_io_uring_enter+0x23e/0x350
>     [<00000000449792f4>] do_syscall_64+0x33/0x40
>     [<00000000bdacf1c3>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> 
> 
> Syzkaller reproducer:
> # {Threaded:true Collide:true Repeat:true RepeatTimes:0 Procs:8
> Sandbox:none Fault:false FaultCall:-1 FaultNth:0 Leak:true
> NetInjection:false NetDevices:true NetReset:true Cgroups:true
> BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false USB:false
> VhciInjection:false UseTmpDir:true HandleSegv:true Repro:false
> Trace:false}
> r0 = syz_io_uring_setup(0x5bfa, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2,
> 0x0, 0x0, 0x0}, &(0x7f00000a0000)=nil, &(0x7f00000b0000)=nil,
> &(0x7f0000000100)=<r1=>0x0, &(0x7f0000000140)=<r2=>0x0)
> syz_io_uring_submit(r1, r2,
> &(0x7f00000001c0)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0,
> 0xffffffffffffff9c, &(0x7f0000000200)={0x42},
> &(0x7f0000000240)='./file1\x00', 0x18, 0x0, 0x12345}, 0x0)
> io_uring_enter(r0, 0x1, 0x1, 0x1, 0x0, 0x0)

You need to send this to the appropriate maintainers:

$ ./scripts/get_maintainer.pl fs/io_uring.c
Jens Axboe <axboe@xxxxxxxxx> (maintainer:IO_URING)
Alexander Viro <viro@xxxxxxxxxxxxxxxxxx> (maintainer:FILESYSTEMS (VFS and infrastructure))
io-uring@xxxxxxxxxxxxxxx (open list:IO_URING)
linux-fsdevel@xxxxxxxxxxxxxxx (open list:FILESYSTEMS (VFS and infrastructure))
linux-kernel@xxxxxxxxxxxxxxx (open list)