Hello I found a bug in net/af_unix in the lastest upstream linux 6.7.rc5 and comfired in lastest net/net-next/bpf/bpf-next tree. Titled "TITLE: memory leak in unix_create1” and I also upload the repro.c and repro.txt. If you fix this issue, please add the following tag to the commit: Reported-by: xingwei Lee <xrivendell7@xxxxxxxxx> lastest net tree: 979e90173af8d2f52f671d988189aab98c6d1be6 Kernel config: https://syzkaller.appspot.com/text?tag=KernelConfig&x=8c4e4700f1727d30 in the lastest net tree, the crash like: Linux syzkaller 6.7.0-rc5-00172-g979e90173af8 #4 SMP PREEMPT_DYNAMIC Tue Dec 19 11:03:58 HKT 2023 x86_4 TITLE: memory leak in security_prepare_creds [<ffffffff8129291a>] copy_process+0x6aa/0x25c0 kernel/fork.c:2366 [<ffffffff812949db>] kernel_clone+0x11b/0x690 kernel/fork.c:2907 [<ffffffff81294fcc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:3050 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff8881408b9390 (size 16): comm "cd01", pid 8363, jiffies 4296754700 (age 12.260s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 4b 99 00 81 88 ff ff .........K...... backtrace: [<ffffffff816340fd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff816340fd>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff816340fd>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff816340fd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [<ffffffff8157f42b>] __do_kmalloc_node mm/slab_common.c:1006 [inline] [<ffffffff8157f42b>] __kmalloc+0x4b/0x150 mm/slab_common.c:1020 [<ffffffff823695b1>] kmalloc include/linux/slab.h:604 [inline] [<ffffffff823695b1>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff823695b1>] lsm_cred_alloc security/security.c:577 [inline] [<ffffffff823695b1>] security_prepare_creds+0x121/0x140 security/security.c:2950 [<ffffffff812e1189>] prepare_creds+0x329/0x4e0 kernel/cred.c:300 [<ffffffff812e18f4>] copy_creds+0x44/0x280 kernel/cred.c:373 [<ffffffff8129291a>] copy_process+0x6aa/0x25c0 kernel/fork.c:2366 [<ffffffff812949db>] kernel_clone+0x11b/0x690 kernel/fork.c:2907 [<ffffffff81294fcc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:3050 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff888147c26b40 (size 112): comm "cd01", pid 8363, jiffies 4296754700 (age 12.260s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81631578>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81631578>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81631578>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff81631578>] slab_alloc mm/slub.c:3486 [inline] [<ffffffff81631578>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] [<ffffffff81631578>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502 [<ffffffff812d30ca>] alloc_pid+0x6a/0x570 kernel/pid.c:183 [<ffffffff81293ab8>] copy_process+0x1848/0x25c0 kernel/fork.c:2518 [<ffffffff812949db>] kernel_clone+0x11b/0x690 kernel/fork.c:2907 [<ffffffff81294fcc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:3050 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88810813d040 (size 1088): comm "cd01", pid 8365, jiffies 4296754700 (age 12.260s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 8a 00 00 00 00 00 00 00 ................ 01 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<ffffffff81631578>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81631578>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81631578>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff81631578>] slab_alloc mm/slub.c:3486 [inline] [<ffffffff81631578>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] [<ffffffff81631578>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502 [<ffffffff83ecc0ce>] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:2069 [<ffffffff83ecf506>] sk_alloc+0x36/0x2f0 net/core/sock.c:2128 [<ffffffff84371e34>] unix_create1+0x84/0x320 net/unix/af_unix.c:982 [<ffffffff84372168>] unix_create+0x98/0x130 net/unix/af_unix.c:1049 [<ffffffff83ec493f>] __sock_create+0x19f/0x2e0 net/socket.c:1569 [<ffffffff83ec8440>] sock_create net/socket.c:1620 [inline] [<ffffffff83ec8440>] __sys_socketpair+0x160/0x370 net/socket.c:1771 [<ffffffff83ec866f>] __do_sys_socketpair net/socket.c:1820 [inline] [<ffffffff83ec866f>] __se_sys_socketpair net/socket.c:1817 [inline] [<ffffffff83ec866f>] __x64_sys_socketpair+0x1f/0x30 net/socket.c:1817 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88811701bd10 (size 16): comm "cd01", pid 8365, jiffies 4296754700 (age 12.260s) hex dump (first 16 bytes): 00 4b 99 00 81 88 ff ff 00 00 00 00 00 00 00 00 .K.............. backtrace: [<ffffffff816340fd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff816340fd>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff816340fd>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff816340fd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [<ffffffff8157ed85>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [<ffffffff823a75c2>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff823a75c2>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff823a75c2>] apparmor_sk_alloc_security+0x52/0xd0 security/apparmor/lsm.c:997 [<ffffffff8236b407>] security_sk_alloc+0x47/0x80 security/security.c:4411 [<ffffffff83ecc11f>] sk_prot_alloc+0x8f/0x1b0 net/core/sock.c:2078 [<ffffffff83ecf506>] sk_alloc+0x36/0x2f0 net/core/sock.c:2128 [<ffffffff84371e34>] unix_create1+0x84/0x320 net/unix/af_unix.c:982 [<ffffffff84372168>] unix_create+0x98/0x130 net/unix/af_unix.c:1049 [<ffffffff83ec493f>] __sock_create+0x19f/0x2e0 net/socket.c:1569 [<ffffffff83ec8440>] sock_create net/socket.c:1620 [inline] [<ffffffff83ec8440>] __sys_socketpair+0x160/0x370 net/socket.c:1771 [<ffffffff83ec866f>] __do_sys_socketpair net/socket.c:1820 [inline] [<ffffffff83ec866f>] __se_sys_socketpair net/socket.c:1817 [inline] [<ffffffff83ec866f>] __x64_sys_socketpair+0x1f/0x30 net/socket.c:1817 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b TITLE: memory leak in copy_process [<ffffffff8129291a>] copy_process+0x6aa/0x25c0 kernel/fork.c:2366 [<ffffffff812949db>] kernel_clone+0x11b/0x690 kernel/fork.c:2907 [<ffffffff81294fcc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:3050 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff888147c26b40 (size 112): comm "cd01", pid 8363, jiffies 4296754700 (age 12.260s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81631578>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81631578>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81631578>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff81631578>] slab_alloc mm/slub.c:3486 [inline] [<ffffffff81631578>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] [<ffffffff81631578>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502 [<ffffffff812d30ca>] alloc_pid+0x6a/0x570 kernel/pid.c:183 [<ffffffff81293ab8>] copy_process+0x1848/0x25c0 kernel/fork.c:2518 [<ffffffff812949db>] kernel_clone+0x11b/0x690 kernel/fork.c:2907 [<ffffffff81294fcc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:3050 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88810813d040 (size 1088): comm "cd01", pid 8365, jiffies 4296754700 (age 12.260s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 8a 00 00 00 00 00 00 00 ................ 01 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<ffffffff81631578>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81631578>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81631578>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff81631578>] slab_alloc mm/slub.c:3486 [inline] [<ffffffff81631578>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] [<ffffffff81631578>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502 [<ffffffff83ecc0ce>] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:2069 [<ffffffff83ecf506>] sk_alloc+0x36/0x2f0 net/core/sock.c:2128 [<ffffffff84371e34>] unix_create1+0x84/0x320 net/unix/af_unix.c:982 [<ffffffff84372168>] unix_create+0x98/0x130 net/unix/af_unix.c:1049 [<ffffffff83ec493f>] __sock_create+0x19f/0x2e0 net/socket.c:1569 [<ffffffff83ec8440>] sock_create net/socket.c:1620 [inline] [<ffffffff83ec8440>] __sys_socketpair+0x160/0x370 net/socket.c:1771 [<ffffffff83ec866f>] __do_sys_socketpair net/socket.c:1820 [inline] [<ffffffff83ec866f>] __se_sys_socketpair net/socket.c:1817 [inline] [<ffffffff83ec866f>] __x64_sys_socketpair+0x1f/0x30 net/socket.c:1817 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88811701bd10 (size 16): comm "cd01", pid 8365, jiffies 4296754700 (age 12.260s) hex dump (first 16 bytes): 00 4b 99 00 81 88 ff ff 00 00 00 00 00 00 00 00 .K.............. backtrace: [<ffffffff816340fd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff816340fd>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff816340fd>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff816340fd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [<ffffffff8157ed85>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [<ffffffff823a75c2>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff823a75c2>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff823a75c2>] apparmor_sk_alloc_security+0x52/0xd0 security/apparmor/lsm.c:997 [<ffffffff8236b407>] security_sk_alloc+0x47/0x80 security/security.c:4411 [<ffffffff83ecc11f>] sk_prot_alloc+0x8f/0x1b0 net/core/sock.c:2078 [<ffffffff83ecf506>] sk_alloc+0x36/0x2f0 net/core/sock.c:2128 [<ffffffff84371e34>] unix_create1+0x84/0x320 net/unix/af_unix.c:982 [<ffffffff84372168>] unix_create+0x98/0x130 net/unix/af_unix.c:1049 [<ffffffff83ec493f>] __sock_create+0x19f/0x2e0 net/socket.c:1569 [<ffffffff83ec8440>] sock_create net/socket.c:1620 [inline] [<ffffffff83ec8440>] __sys_socketpair+0x160/0x370 net/socket.c:1771 [<ffffffff83ec866f>] __do_sys_socketpair net/socket.c:1820 [inline] [<ffffffff83ec866f>] __se_sys_socketpair net/socket.c:1817 [inline] [<ffffffff83ec866f>] __x64_sys_socketpair+0x1f/0x30 net/socket.c:1817 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b TITLE: memory leak in unix_create1 [<ffffffff81293ab8>] copy_process+0x1848/0x25c0 kernel/fork.c:2518 [<ffffffff812949db>] kernel_clone+0x11b/0x690 kernel/fork.c:2907 [<ffffffff81294fcc>] __do_sys_clone+0x7c/0xb0 kernel/fork.c:3050 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88810813d040 (size 1088): comm "cd01", pid 8365, jiffies 4296754700 (age 12.260s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 8a 00 00 00 00 00 00 00 ................ 01 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<ffffffff81631578>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81631578>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81631578>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff81631578>] slab_alloc mm/slub.c:3486 [inline] [<ffffffff81631578>] __kmem_cache_alloc_lru mm/slub.c:3493 [inline] [<ffffffff81631578>] kmem_cache_alloc+0x298/0x430 mm/slub.c:3502 [<ffffffff83ecc0ce>] sk_prot_alloc+0x3e/0x1b0 net/core/sock.c:2069 [<ffffffff83ecf506>] sk_alloc+0x36/0x2f0 net/core/sock.c:2128 [<ffffffff84371e34>] unix_create1+0x84/0x320 net/unix/af_unix.c:982 [<ffffffff84372168>] unix_create+0x98/0x130 net/unix/af_unix.c:1049 [<ffffffff83ec493f>] __sock_create+0x19f/0x2e0 net/socket.c:1569 [<ffffffff83ec8440>] sock_create net/socket.c:1620 [inline] [<ffffffff83ec8440>] __sys_socketpair+0x160/0x370 net/socket.c:1771 [<ffffffff83ec866f>] __do_sys_socketpair net/socket.c:1820 [inline] [<ffffffff83ec866f>] __se_sys_socketpair net/socket.c:1817 [inline] [<ffffffff83ec866f>] __x64_sys_socketpair+0x1f/0x30 net/socket.c:1817 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88811701bd10 (size 16): comm "cd01", pid 8365, jiffies 4296754700 (age 12.260s) hex dump (first 16 bytes): 00 4b 99 00 81 88 ff ff 00 00 00 00 00 00 00 00 .K.............. backtrace: [<ffffffff816340fd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff816340fd>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff816340fd>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff816340fd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [<ffffffff8157ed85>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [<ffffffff823a75c2>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff823a75c2>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff823a75c2>] apparmor_sk_alloc_security+0x52/0xd0 security/apparmor/lsm.c:997 [<ffffffff8236b407>] security_sk_alloc+0x47/0x80 security/security.c:4411 [<ffffffff83ecc11f>] sk_prot_alloc+0x8f/0x1b0 net/core/sock.c:2078 [<ffffffff83ecf506>] sk_alloc+0x36/0x2f0 net/core/sock.c:2128 [<ffffffff84371e34>] unix_create1+0x84/0x320 net/unix/af_unix.c:982 [<ffffffff84372168>] unix_create+0x98/0x130 net/unix/af_unix.c:1049 [<ffffffff83ec493f>] __sock_create+0x19f/0x2e0 net/socket.c:1569 [<ffffffff83ec8440>] sock_create net/socket.c:1620 [inline] [<ffffffff83ec8440>] __sys_socketpair+0x160/0x370 net/socket.c:1771 [<ffffffff83ec866f>] __do_sys_socketpair net/socket.c:1820 [inline] [<ffffffff83ec866f>] __se_sys_socketpair net/socket.c:1817 [inline] [<ffffffff83ec866f>] __x64_sys_socketpair+0x1f/0x30 net/socket.c:1817 [<ffffffff84b70dcf>] do_syscall_x64 arch/x86/entry/common.c:52 [inline] [<ffffffff84b70dcf>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b =* repro.c =* // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include <dirent.h> #include <endian.h> #include <errno.h> #include <fcntl.h> #include <signal.h> #include <stdarg.h> #include <stdbool.h> #include <stdint.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/prctl.h> #include <sys/stat.h> #include <sys/syscall.h> #include <sys/types.h> #include <sys/wait.h> #include <time.h> #include <unistd.h> #ifndef __NR_bpf #define __NR_bpf 321 #endif static void sleep_ms(uint64_t ms) { usleep(ms * 1000); } static uint64_t current_time_ms(void) { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) exit(1); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static bool write_file(const char* file, const char* what, ...) { char buf[1024]; va_list args; va_start(args, what); vsnprintf(buf, sizeof(buf), what, args); va_end(args); buf[sizeof(buf) - 1] = 0; int len = strlen(buf); int fd = open(file, O_WRONLY | O_CLOEXEC); if (fd == -1) return false; if (write(fd, buf, len) != len) { int err = errno; close(fd); errno = err; return false; } close(fd); return true; } static void kill_and_wait(int pid, int* status) { kill(-pid, SIGKILL); kill(pid, SIGKILL); for (int i = 0; i < 100; i++) { if (waitpid(-1, status, WNOHANG | __WALL) == pid) return; usleep(1000); } DIR* dir = opendir("/sys/fs/fuse/connections"); if (dir) { for (;;) { struct dirent* ent = readdir(dir); if (!ent) break; if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0) continue; char abort[300]; snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name); int fd = open(abort, O_WRONLY); if (fd == -1) { continue; } if (write(fd, abort, 1) < 0) { } close(fd); } closedir(dir); } else { } while (waitpid(-1, status, __WALL) != pid) { } } static void setup_test() { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); write_file("/proc/self/oom_score_adj", "1000"); } #define KMEMLEAK_FILE "/sys/kernel/debug/kmemleak" static void setup_leak() { if (!write_file(KMEMLEAK_FILE, "scan")) exit(1); sleep(5); if (!write_file(KMEMLEAK_FILE, "scan")) exit(1); if (!write_file(KMEMLEAK_FILE, "clear")) exit(1); } static void check_leaks(void) { int fd = open(KMEMLEAK_FILE, O_RDWR); if (fd == -1) exit(1); uint64_t start = current_time_ms(); if (write(fd, "scan", 4) != 4) exit(1); sleep(1); while (current_time_ms() - start < 4 * 1000) sleep(1); if (write(fd, "scan", 4) != 4) exit(1); static char buf[128 << 10]; ssize_t n = read(fd, buf, sizeof(buf) - 1); if (n < 0) exit(1); int nleaks = 0; if (n != 0) { sleep(1); if (write(fd, "scan", 4) != 4) exit(1); if (lseek(fd, 0, SEEK_SET) < 0) exit(1); n = read(fd, buf, sizeof(buf) - 1); if (n < 0) exit(1); buf[n] = 0; char* pos = buf; char* end = buf + n; while (pos < end) { char* next = strstr(pos + 1, "unreferenced object"); if (!next) next = end; char prev = *next; *next = 0; fprintf(stderr, "BUG: memory leak\n%s\n", pos); *next = prev; pos = next; nleaks++; } } if (write(fd, "clear", 5) != 5) exit(1); close(fd); if (nleaks) exit(1); } static void execute_one(void); #define WAIT_FLAGS __WALL static void loop(void) { int iter = 0; for (;; iter++) { int pid = fork(); if (pid < 0) exit(1); if (pid == 0) { setup_test(); execute_one(); exit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid) break; sleep_ms(1); if (current_time_ms() - start < 5000) continue; kill_and_wait(pid, &status); break; } check_leaks(); } } uint64_t r[1] = {0xffffffffffffffff}; void execute_one(void) { intptr_t res = 0; syscall(__NR_socketpair, /*domain=*/1ul, /*type=*/1ul, /*proto=*/0, /*fds=*/0x20000000ul); *(uint32_t*)0x200000c0 = 0x12; *(uint32_t*)0x200000c4 = 2; *(uint32_t*)0x200000c8 = 4; *(uint32_t*)0x200000cc = 1; *(uint32_t*)0x200000d0 = 0; *(uint32_t*)0x200000d4 = -1; *(uint32_t*)0x200000d8 = 0; memset((void*)0x200000dc, 0, 16); *(uint32_t*)0x200000ec = 0; *(uint32_t*)0x200000f0 = -1; *(uint32_t*)0x200000f4 = 0; *(uint32_t*)0x200000f8 = 0; *(uint32_t*)0x200000fc = 0; *(uint64_t*)0x20000100 = 0; res = syscall(__NR_bpf, /*cmd=*/0ul, /*arg=*/0x200000c0ul, /*size=*/0x48ul); if (res != -1) r[0] = res; *(uint32_t*)0x200003c0 = r[0]; *(uint64_t*)0x200003c8 = 0x20000040; *(uint64_t*)0x200003d0 = 0x20000000; *(uint64_t*)0x200003d8 = 0; syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x200003c0ul, /*size=*/0x20ul); *(uint32_t*)0x200003c0 = r[0]; *(uint64_t*)0x200003c8 = 0x20000040; *(uint64_t*)0x200003d0 = 0x20000000; *(uint64_t*)0x200003d8 = 0; syscall(__NR_bpf, /*cmd=*/2ul, /*arg=*/0x200003c0ul, /*size=*/0x20ul); } int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); setup_leak(); loop(); return 0; } =* repro.txt =* socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0x2, 0x4, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000040), 0x20000000}, 0x20) bpf$MAP_DELETE_ELEM(0x2, &(0x7f00000003c0)={r0, &(0x7f0000000040), 0x20000000}, 0x20) Please see also https://gist.github.com/xrivendell7/80fc686da1e9223cf49ec87ad8e2ebfc I do not analysis it deeply but looks like it might be related to the bpf module so I aslo CC bpf maintainers. Hope it helps. Best regards. xingwei Lee
