LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
To: Kees Cook <keescook@chromium.org>,
	Andy Lutomirski <luto@amacapital.net>,
	Will Drewry <wad@chromium.org>,
	Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Andrii Nakryiko <andrii@kernel.org>,
	Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>,
	Yonghong Song <yhs@fb.com>,
	John Fastabend <john.fastabend@gmail.com>,
	KP Singh <kpsingh@kernel.org>
Cc: linux-kernel <linux-kernel@vger.kernel.org>,
	netdev <netdev@vger.kernel.org>,
	bpf@vger.kernel.org
Subject: memory leak in do_seccomp
Date: Sat, 31 Jul 2021 20:20:29 +0100	[thread overview]
Message-ID: <CADVatmPShADZ0F133eS3KjeKj1ZjTNAQfy_QOoJVBan02wuR+Q@mail.gmail.com> (raw)

Hi All,

We had been running syzkaller on v5.10.y and a "memory leak in
do_seccomp" was being reported on it. I got some time to check that
today and have managed to get a syzkaller
reproducer. I dont have a C reproducer which I can share but I can use
the syz-reproducer to reproduce this with next-20210730.
The old report on v5.10.y is at
https://elisa-builder-00.iol.unh.edu/syzkaller/report?id=f6ddd3b592f00e95f9cbd2e74f70a5b04b015c6f

BUG: memory leak
unreferenced object 0xffff888019282c00 (size 512):
  comm "syz-executor.1", pid 7389, jiffies 4294761829 (age 17.841s)
  hex dump (first 32 bytes):
    01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000762c0963>] do_seccomp+0x2d5/0x27d0
    [<0000000006e512d1>] do_syscall_64+0x3b/0x90
    [<0000000094ae9ff8>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffffc900006b5000 (size 4096):
  comm "syz-executor.1", pid 7389, jiffies 4294761829 (age 17.841s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000854901e5>] __vmalloc_node_range+0x550/0x9a0
    [<000000002686628f>] __vmalloc_node+0xb5/0x100
    [<0000000004cbd298>] bpf_prog_alloc_no_stats+0x38/0x350
    [<0000000009149728>] bpf_prog_alloc+0x24/0x170
    [<000000000fe7f1e7>] bpf_prog_create_from_user+0xad/0x2e0
    [<000000000c70eb02>] do_seccomp+0x325/0x27d0
    [<0000000006e512d1>] do_syscall_64+0x3b/0x90
    [<0000000094ae9ff8>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888026eb1000 (size 2048):
  comm "syz-executor.1", pid 7389, jiffies 4294761829 (age 17.842s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000072de7240>] bpf_prog_alloc_no_stats+0xeb/0x350
    [<0000000009149728>] bpf_prog_alloc+0x24/0x170
    [<000000000fe7f1e7>] bpf_prog_create_from_user+0xad/0x2e0
    [<000000000c70eb02>] do_seccomp+0x325/0x27d0
    [<0000000006e512d1>] do_syscall_64+0x3b/0x90
    [<0000000094ae9ff8>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888014dddac0 (size 16):
  comm "syz-executor.1", pid 7389, jiffies 4294761829 (age 17.842s)
  hex dump (first 16 bytes):
    01 00 ca 08 80 88 ff ff c8 ef df 14 80 88 ff ff  ................
  backtrace:
    [<00000000c5d4ed93>] bpf_prog_store_orig_filter+0x7b/0x1e0
    [<000000007cb21c2a>] bpf_prog_create_from_user+0x1c6/0x2e0
    [<000000000c70eb02>] do_seccomp+0x325/0x27d0
    [<0000000006e512d1>] do_syscall_64+0x3b/0x90
    [<0000000094ae9ff8>] entry_SYSCALL_64_after_hwframe+0x44/0xae

BUG: memory leak
unreferenced object 0xffff888014dfefc8 (size 8):
  comm "syz-executor.1", pid 7389, jiffies 4294761829 (age 17.842s)
  hex dump (first 8 bytes):
    06 00 00 00 ff ff ff 7f                          ........
  backtrace:
    [<00000000ee5550f8>] kmemdup+0x23/0x50
    [<00000000f1acd067>] bpf_prog_store_orig_filter+0x103/0x1e0
    [<000000007cb21c2a>] bpf_prog_create_from_user+0x1c6/0x2e0
    [<000000000c70eb02>] do_seccomp+0x325/0x27d0
    [<0000000006e512d1>] do_syscall_64+0x3b/0x90
    [<0000000094ae9ff8>] entry_SYSCALL_64_after_hwframe+0x44/0xae

Not sure if this has been already reported or not, but I will be happy
to test if you have a fix for this.


-- 
Regards
Sudip

             reply	other threads:[~2021-07-31 19:21 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-31 19:20 Sudip Mukherjee [this message]
2021-08-01  3:25 ` Kees Cook
2021-08-01 21:10   ` Sudip Mukherjee
  -- strict thread matches above, loose matches on Subject: below --
2020-08-11 17:06 syzbot
2020-08-31  3:50 ` syzbot
2020-08-31 23:25   ` Kees Cook
2020-09-01  0:09     ` Tycho Andersen
2020-09-01  1:14       ` Tycho Andersen
2020-09-01 10:07         ` Christian Brauner
2020-09-01 15:08         ` Kees Cook
2020-09-01 15:26           ` Tycho Andersen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CADVatmPShADZ0F133eS3KjeKj1ZjTNAQfy_QOoJVBan02wuR+Q@mail.gmail.com \
    --to=sudipm.mukherjee@gmail.com \
    --cc=andrii@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=john.fastabend@gmail.com \
    --cc=kafai@fb.com \
    --cc=keescook@chromium.org \
    --cc=kpsingh@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=netdev@vger.kernel.org \
    --cc=songliubraving@fb.com \
    --cc=wad@chromium.org \
    --cc=yhs@fb.com \
    --subject='Re: memory leak in do_seccomp' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).