Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
From: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
To: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@amacapital.net>,
Will Drewry <wad@chromium.org>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>,
Yonghong Song <yhs@fb.com>,
John Fastabend <john.fastabend@gmail.com>,
KP Singh <kpsingh@kernel.org>,
linux-kernel <linux-kernel@vger.kernel.org>,
netdev <netdev@vger.kernel.org>,
bpf@vger.kernel.org, alaaemadhossney.ae@gmail.com,
syzkaller <syzkaller@googlegroups.com>,
Jann Horn <jannh@google.com>, Tycho Andersen <tycho@tycho.pizza>,
Sargun Dhillon <sargun@sargun.me>,
Christian Brauner <christian.brauner@ubuntu.com>
Subject: Re: memory leak in do_seccomp
Date: Sun, 1 Aug 2021 22:10:03 +0100 [thread overview]
Message-ID: <CADVatmOt6Xy+is=1CBZFqExBT63EKhO37eCJ9hsvS5jy+-PMVg@mail.gmail.com> (raw)
In-Reply-To: <202107311901.8CDF235F65@keescook>
Hi Kees,
On Sun, Aug 1, 2021 at 4:26 AM Kees Cook <keescook@chromium.org> wrote:
>
> On Sat, Jul 31, 2021 at 08:20:29PM +0100, Sudip Mukherjee wrote:
> > Hi All,
> >
> > We had been running syzkaller on v5.10.y and a "memory leak in
> > do_seccomp" was being reported on it. I got some time to check that
> > today and have managed to get a syzkaller
> > reproducer. I dont have a C reproducer which I can share but I can use
> > the syz-reproducer to reproduce this with next-20210730.
> > The old report on v5.10.y is at
> > https://elisa-builder-00.iol.unh.edu/syzkaller/report?id=f6ddd3b592f00e95f9cbd2e74f70a5b04b015c6f
>
> Thanks for the details!
>
> Is this the same as what syzbot saw here (with a C reproducer)?
> https://syzkaller.appspot.com/bug?id=2809bb0ac77ad9aa3f4afe42d6a610aba594a987
Looks similar but it says its fixed and I still get it with the
reproducer I have.
>
> I can't figure out what happened with the "Patch testing request" that
> was made; there's no link?
Looks like it has been merged with a566a9012acd ("seccomp: don't leak
memory when filter install races")
>
> >
> > BUG: memory leak
> > unreferenced object 0xffff888019282c00 (size 512):
> > comm "syz-executor.1", pid 7389, jiffies 4294761829 (age 17.841s)
> > hex dump (first 32 bytes):
> > 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
> > 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> > backtrace:
> > [<00000000762c0963>] do_seccomp+0x2d5/0x27d0
>
> Can you run "./scripts/faddr2line do_seccomp+0x2d5/0x27d0" for this? I
> expect it'll be:
> sfilter = kzalloc(sizeof(*sfilter), GFP_KERNEL | __GFP_NOWARN);
Yes, it is from "(inlined by) seccomp_prepare_filter at kernel/seccomp.c:661".
I did:
$ scripts/faddr2line vmlinux do_seccomp+0x2d5/0x27d0
do_seccomp+0x2d5/0x27d0:
kmalloc at include/linux/slab.h:591
(inlined by) kzalloc at include/linux/slab.h:721
(inlined by) seccomp_prepare_filter at kernel/seccomp.c:661
(inlined by) seccomp_prepare_user_filter at kernel/seccomp.c:703
(inlined by) seccomp_set_mode_filter at kernel/seccomp.c:1852
(inlined by) do_seccomp at kernel/seccomp.c:1972
>
> > [<0000000006e512d1>] do_syscall_64+0x3b/0x90
> > [<0000000094ae9ff8>] entry_SYSCALL_64_after_hwframe+0x44/0xae
>
<snip>
>
> My best guess is there is some LISTENER refcount state we can get into
> where all the processes die, but a reference is left alive.
Will be happy to run any debug patch if you need.
--
Regards
Sudip
next prev parent reply other threads:[~2021-08-01 21:11 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-07-31 19:20 Sudip Mukherjee
2021-08-01 3:25 ` Kees Cook
2021-08-01 21:10 ` Sudip Mukherjee [this message]
-- strict thread matches above, loose matches on Subject: below --
2020-08-11 17:06 syzbot
2020-08-31 3:50 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CADVatmOt6Xy+is=1CBZFqExBT63EKhO37eCJ9hsvS5jy+-PMVg@mail.gmail.com' \
--to=sudipm.mukherjee@gmail.com \
--cc=alaaemadhossney.ae@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=christian.brauner@ubuntu.com \
--cc=daniel@iogearbox.net \
--cc=jannh@google.com \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=keescook@chromium.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@amacapital.net \
--cc=netdev@vger.kernel.org \
--cc=sargun@sargun.me \
--cc=songliubraving@fb.com \
--cc=syzkaller@googlegroups.com \
--cc=tycho@tycho.pizza \
--cc=wad@chromium.org \
--cc=yhs@fb.com \
--subject='Re: memory leak in do_seccomp' \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).