memory leak in path_openat (2)

From: syzbot
Date: Wed Feb 17 2021 - 00:22:18 EST

Next message: DooHyun Hwang: "[PATCH 1/2] dt-bindings: mmc: Add no-single-read-retry property"
Previous message: Muchun Song: "Re: [External] Re: [PATCH 4/4] mm: memcontrol: fix swap uncharge on cgroup v2"
Next in thread: Al Viro: "Re: memory leak in path_openat (2)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hello,

syzbot found the following issue on:

HEAD commit: dcc0b490 Merge tag 'powerpc-5.11-8' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1316c614d00000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2fbb1a71525e1d5
dashboard link: https://syzkaller.appspot.com/bug?extid=921ef0ccfeed3a496721
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1378ba4cd00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12e73fc2d00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+921ef0ccfeed3a496721@xxxxxxxxxxxxxxxxxxxxxxxxx

BUG: memory leak
unreferenced object 0xffff88810ffa0780 (size 192):
comm "systemd-udevd", pid 9109, jiffies 4294974202 (age 70.810s)
hex dump (first 32 bytes):
44 80 00 00 06 00 00 00 00 00 00 00 00 00 00 00 D...............
00 00 00 00 00 00 00 00 c0 63 f1 0f 81 88 ff ff .........c......
backtrace:
[<000000000f4d69f8>] __d_alloc+0x2a/0x270 fs/dcache.c:1716
[<00000000a20f7fde>] d_alloc+0x25/0xd0 fs/dcache.c:1795
[<000000007cbd02b4>] d_alloc_parallel+0x6b/0x940 fs/dcache.c:2547
[<00000000fda6bfea>] lookup_open fs/namei.c:3033 [inline]
[<00000000fda6bfea>] open_last_lookups fs/namei.c:3180 [inline]
[<00000000fda6bfea>] path_openat+0xca3/0x1b00 fs/namei.c:3368
[<00000000e92e3050>] do_filp_open+0xa0/0x190 fs/namei.c:3398
[<00000000ca660767>] do_sys_openat2+0xed/0x230 fs/open.c:1172
[<000000002fb778b6>] do_sys_open fs/open.c:1188 [inline]
[<000000002fb778b6>] __do_sys_open fs/open.c:1196 [inline]
[<000000002fb778b6>] __se_sys_open fs/open.c:1192 [inline]
[<000000002fb778b6>] __x64_sys_open+0x7d/0xe0 fs/open.c:1192
[<0000000011942ea6>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<0000000076bff2b1>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810ffea360 (size 608):
comm "systemd-udevd", pid 9109, jiffies 4294974202 (age 70.810s)
hex dump (first 32 bytes):
a4 81 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
backtrace:
[<00000000cbb42cce>] alloc_inode+0xbe/0x100 fs/inode.c:235
[<00000000dc171831>] iget_locked+0x126/0x340 fs/inode.c:1192
[<0000000025e74921>] kernfs_get_inode+0x20/0x190 fs/kernfs/inode.c:252
[<000000008b802090>] kernfs_iop_lookup+0xa0/0xe0 fs/kernfs/dir.c:1100
[<00000000e4bc5624>] lookup_open fs/namei.c:3085 [inline]
[<00000000e4bc5624>] open_last_lookups fs/namei.c:3180 [inline]
[<00000000e4bc5624>] path_openat+0x95d/0x1b00 fs/namei.c:3368
[<00000000e92e3050>] do_filp_open+0xa0/0x190 fs/namei.c:3398
[<00000000ca660767>] do_sys_openat2+0xed/0x230 fs/open.c:1172
[<000000002fb778b6>] do_sys_open fs/open.c:1188 [inline]
[<000000002fb778b6>] __do_sys_open fs/open.c:1196 [inline]
[<000000002fb778b6>] __se_sys_open fs/open.c:1192 [inline]
[<000000002fb778b6>] __x64_sys_open+0x7d/0xe0 fs/open.c:1192
[<0000000011942ea6>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<0000000076bff2b1>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810ec1b2b8 (size 24):
comm "systemd-udevd", pid 9109, jiffies 4294974202 (age 70.810s)
hex dump (first 24 bytes):
98 a4 fe 0f 81 88 ff ff 30 e1 09 82 ff ff ff ff ........0.......
00 00 00 00 00 00 00 00 ........
backtrace:
[<00000000d6a1f02a>] kmem_cache_zalloc include/linux/slab.h:672 [inline]
[<00000000d6a1f02a>] lsm_inode_alloc security/security.c:590 [inline]
[<00000000d6a1f02a>] security_inode_alloc+0x2a/0xb0 security/security.c:973
[<000000009366b0d8>] inode_init_always+0x10c/0x250 fs/inode.c:170
[<00000000357b1464>] alloc_inode+0x44/0x100 fs/inode.c:240
[<00000000dc171831>] iget_locked+0x126/0x340 fs/inode.c:1192
[<0000000025e74921>] kernfs_get_inode+0x20/0x190 fs/kernfs/inode.c:252
[<000000008b802090>] kernfs_iop_lookup+0xa0/0xe0 fs/kernfs/dir.c:1100
[<00000000e4bc5624>] lookup_open fs/namei.c:3085 [inline]
[<00000000e4bc5624>] open_last_lookups fs/namei.c:3180 [inline]
[<00000000e4bc5624>] path_openat+0x95d/0x1b00 fs/namei.c:3368
[<00000000e92e3050>] do_filp_open+0xa0/0x190 fs/namei.c:3398
[<00000000ca660767>] do_sys_openat2+0xed/0x230 fs/open.c:1172
[<000000002fb778b6>] do_sys_open fs/open.c:1188 [inline]
[<000000002fb778b6>] __do_sys_open fs/open.c:1196 [inline]
[<000000002fb778b6>] __se_sys_open fs/open.c:1192 [inline]
[<000000002fb778b6>] __x64_sys_open+0x7d/0xe0 fs/open.c:1192
[<0000000011942ea6>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<0000000076bff2b1>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810ffc3f00 (size 192):
comm "kdevtmpfs", pid 21, jiffies 4294974223 (age 70.600s)
hex dump (first 32 bytes):
08 80 00 00 06 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 90 56 00 81 88 ff ff ..........V.....
backtrace:
[<000000000f4d69f8>] __d_alloc+0x2a/0x270 fs/dcache.c:1716
[<00000000a20f7fde>] d_alloc+0x25/0xd0 fs/dcache.c:1795
[<00000000e1f38abc>] __lookup_hash+0x77/0xd0 fs/namei.c:1441
[<000000002b4d8a6a>] filename_create+0xc3/0x240 fs/namei.c:3470
[<0000000049e829fd>] handle_create+0x49/0x28a drivers/base/devtmpfs.c:207
[<0000000033a814c1>] handle drivers/base/devtmpfs.c:377 [inline]
[<0000000033a814c1>] devtmpfs_work_loop drivers/base/devtmpfs.c:392 [inline]
[<0000000033a814c1>] devtmpfsd+0x14e/0x1d3 drivers/base/devtmpfs.c:434
[<00000000f978b357>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000000ea26e78>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888114e342d0 (size 720):
comm "kdevtmpfs", pid 21, jiffies 4294974223 (age 70.600s)
hex dump (first 32 bytes):
00 00 00 00 01 00 00 00 00 00 20 00 00 00 00 00 .......... .....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d4c4e200>] shmem_alloc_inode+0x18/0x40 mm/shmem.c:3826
[<00000000bbfd1b25>] alloc_inode+0x27/0x100 fs/inode.c:233
[<00000000639a7c47>] new_inode_pseudo fs/inode.c:927 [inline]
[<00000000639a7c47>] new_inode+0x23/0x100 fs/inode.c:956
[<000000004e164ffa>] shmem_get_inode+0xcd/0x460 mm/shmem.c:2303
[<00000000c3e9d654>] shmem_mknod+0x37/0x130 mm/shmem.c:2925
[<0000000094c3aa16>] vfs_mknod+0x339/0x430 fs/namei.c:3554
[<00000000a44105b5>] handle_create+0x1db/0x28a drivers/base/devtmpfs.c:215
[<0000000033a814c1>] handle drivers/base/devtmpfs.c:377 [inline]
[<0000000033a814c1>] devtmpfs_work_loop drivers/base/devtmpfs.c:392 [inline]
[<0000000033a814c1>] devtmpfsd+0x14e/0x1d3 drivers/base/devtmpfs.c:434
[<00000000f978b357>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000000ea26e78>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff88810ffa0780 (size 192):
comm "systemd-udevd", pid 9109, jiffies 4294974202 (age 70.960s)
hex dump (first 32 bytes):
44 80 00 00 06 00 00 00 00 00 00 00 00 00 00 00 D...............
00 00 00 00 00 00 00 00 c0 63 f1 0f 81 88 ff ff .........c......
backtrace:
[<000000000f4d69f8>] __d_alloc+0x2a/0x270 fs/dcache.c:1716
[<00000000a20f7fde>] d_alloc+0x25/0xd0 fs/dcache.c:1795
[<000000007cbd02b4>] d_alloc_parallel+0x6b/0x940 fs/dcache.c:2547
[<00000000fda6bfea>] lookup_open fs/namei.c:3033 [inline]
[<00000000fda6bfea>] open_last_lookups fs/namei.c:3180 [inline]
[<00000000fda6bfea>] path_openat+0xca3/0x1b00 fs/namei.c:3368
[<00000000e92e3050>] do_filp_open+0xa0/0x190 fs/namei.c:3398
[<00000000ca660767>] do_sys_openat2+0xed/0x230 fs/open.c:1172
[<000000002fb778b6>] do_sys_open fs/open.c:1188 [inline]
[<000000002fb778b6>] __do_sys_open fs/open.c:1196 [inline]
[<000000002fb778b6>] __se_sys_open fs/open.c:1192 [inline]
[<000000002fb778b6>] __x64_sys_open+0x7d/0xe0 fs/open.c:1192
[<0000000011942ea6>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<0000000076bff2b1>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810ffea360 (size 608):
comm "systemd-udevd", pid 9109, jiffies 4294974202 (age 70.960s)
hex dump (first 32 bytes):
a4 81 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
backtrace:
[<00000000cbb42cce>] alloc_inode+0xbe/0x100 fs/inode.c:235
[<00000000dc171831>] iget_locked+0x126/0x340 fs/inode.c:1192
[<0000000025e74921>] kernfs_get_inode+0x20/0x190 fs/kernfs/inode.c:252
[<000000008b802090>] kernfs_iop_lookup+0xa0/0xe0 fs/kernfs/dir.c:1100
[<00000000e4bc5624>] lookup_open fs/namei.c:3085 [inline]
[<00000000e4bc5624>] open_last_lookups fs/namei.c:3180 [inline]
[<00000000e4bc5624>] path_openat+0x95d/0x1b00 fs/namei.c:3368
[<00000000e92e3050>] do_filp_open+0xa0/0x190 fs/namei.c:3398
[<00000000ca660767>] do_sys_openat2+0xed/0x230 fs/open.c:1172
[<000000002fb778b6>] do_sys_open fs/open.c:1188 [inline]
[<000000002fb778b6>] __do_sys_open fs/open.c:1196 [inline]
[<000000002fb778b6>] __se_sys_open fs/open.c:1192 [inline]
[<000000002fb778b6>] __x64_sys_open+0x7d/0xe0 fs/open.c:1192
[<0000000011942ea6>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<0000000076bff2b1>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810ec1b2b8 (size 24):
comm "systemd-udevd", pid 9109, jiffies 4294974202 (age 70.960s)
hex dump (first 24 bytes):
98 a4 fe 0f 81 88 ff ff 30 e1 09 82 ff ff ff ff ........0.......
00 00 00 00 00 00 00 00 ........
backtrace:
[<00000000d6a1f02a>] kmem_cache_zalloc include/linux/slab.h:672 [inline]
[<00000000d6a1f02a>] lsm_inode_alloc security/security.c:590 [inline]
[<00000000d6a1f02a>] security_inode_alloc+0x2a/0xb0 security/security.c:973
[<000000009366b0d8>] inode_init_always+0x10c/0x250 fs/inode.c:170
[<00000000357b1464>] alloc_inode+0x44/0x100 fs/inode.c:240
[<00000000dc171831>] iget_locked+0x126/0x340 fs/inode.c:1192
[<0000000025e74921>] kernfs_get_inode+0x20/0x190 fs/kernfs/inode.c:252
[<000000008b802090>] kernfs_iop_lookup+0xa0/0xe0 fs/kernfs/dir.c:1100
[<00000000e4bc5624>] lookup_open fs/namei.c:3085 [inline]
[<00000000e4bc5624>] open_last_lookups fs/namei.c:3180 [inline]
[<00000000e4bc5624>] path_openat+0x95d/0x1b00 fs/namei.c:3368
[<00000000e92e3050>] do_filp_open+0xa0/0x190 fs/namei.c:3398
[<00000000ca660767>] do_sys_openat2+0xed/0x230 fs/open.c:1172
[<000000002fb778b6>] do_sys_open fs/open.c:1188 [inline]
[<000000002fb778b6>] __do_sys_open fs/open.c:1196 [inline]
[<000000002fb778b6>] __se_sys_open fs/open.c:1192 [inline]
[<000000002fb778b6>] __x64_sys_open+0x7d/0xe0 fs/open.c:1192
[<0000000011942ea6>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<0000000076bff2b1>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810ffc3f00 (size 192):
comm "kdevtmpfs", pid 21, jiffies 4294974223 (age 70.750s)
hex dump (first 32 bytes):
08 80 00 00 06 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 90 56 00 81 88 ff ff ..........V.....
backtrace:
[<000000000f4d69f8>] __d_alloc+0x2a/0x270 fs/dcache.c:1716
[<00000000a20f7fde>] d_alloc+0x25/0xd0 fs/dcache.c:1795
[<00000000e1f38abc>] __lookup_hash+0x77/0xd0 fs/namei.c:1441
[<000000002b4d8a6a>] filename_create+0xc3/0x240 fs/namei.c:3470
[<0000000049e829fd>] handle_create+0x49/0x28a drivers/base/devtmpfs.c:207
[<0000000033a814c1>] handle drivers/base/devtmpfs.c:377 [inline]
[<0000000033a814c1>] devtmpfs_work_loop drivers/base/devtmpfs.c:392 [inline]
[<0000000033a814c1>] devtmpfsd+0x14e/0x1d3 drivers/base/devtmpfs.c:434
[<00000000f978b357>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000000ea26e78>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

BUG: memory leak
unreferenced object 0xffff888114e342d0 (size 720):
comm "kdevtmpfs", pid 21, jiffies 4294974223 (age 70.750s)
hex dump (first 32 bytes):
00 00 00 00 01 00 00 00 00 00 20 00 00 00 00 00 .......... .....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000d4c4e200>] shmem_alloc_inode+0x18/0x40 mm/shmem.c:3826
[<00000000bbfd1b25>] alloc_inode+0x27/0x100 fs/inode.c:233
[<00000000639a7c47>] new_inode_pseudo fs/inode.c:927 [inline]
[<00000000639a7c47>] new_inode+0x23/0x100 fs/inode.c:956
[<000000004e164ffa>] shmem_get_inode+0xcd/0x460 mm/shmem.c:2303
[<00000000c3e9d654>] shmem_mknod+0x37/0x130 mm/shmem.c:2925
[<0000000094c3aa16>] vfs_mknod+0x339/0x430 fs/namei.c:3554
[<00000000a44105b5>] handle_create+0x1db/0x28a drivers/base/devtmpfs.c:215
[<0000000033a814c1>] handle drivers/base/devtmpfs.c:377 [inline]
[<0000000033a814c1>] devtmpfs_work_loop drivers/base/devtmpfs.c:392 [inline]
[<0000000033a814c1>] devtmpfsd+0x14e/0x1d3 drivers/base/devtmpfs.c:434
[<00000000f978b357>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<000000000ea26e78>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Next message: DooHyun Hwang: "[PATCH 1/2] dt-bindings: mmc: Add no-single-read-retry property"
Previous message: Muchun Song: "Re: [External] Re: [PATCH 4/4] mm: memcontrol: fix swap uncharge on cgroup v2"
Next in thread: Al Viro: "Re: memory leak in path_openat (2)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]