Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes
BUG: memory leak
unreferenced object 0xffff888113562900 (size 256):
comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
hex dump (first 32 bytes):
00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00 ..P.............
00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 .........@......
backtrace:
[<ffffffff8476aaf4>] __io_alloc_req_refill+0x55/0x193 io_uring/io_uring.c:1040
[<ffffffff8476c085>] io_alloc_req_refill io_uring/io_uring.h:378 [inline]
[<ffffffff8476c085>] io_submit_sqes.cold+0x65/0x8a io_uring/io_uring.c:2384
[<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
[<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810522d080 (size 96):
comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
hex dump (first 32 bytes):
00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00 ..P.............
7b 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 { ..............
backtrace:
[<ffffffff814f94a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1062
[<ffffffff823a73ac>] kmalloc include/linux/slab.h:580 [inline]
[<ffffffff823a73ac>] io_req_alloc_apoll io_uring/poll.c:650 [inline]
[<ffffffff823a73ac>] io_arm_poll_handler+0x1fc/0x470 io_uring/poll.c:694
[<ffffffff823961cd>] io_queue_async+0x8d/0x2e0 io_uring/io_uring.c:2006
[<ffffffff82397f18>] io_queue_sqe io_uring/io_uring.c:2037 [inline]
[<ffffffff82397f18>] io_submit_sqe io_uring/io_uring.c:2286 [inline]
[<ffffffff82397f18>] io_submit_sqes+0x968/0xb70 io_uring/io_uring.c:2397
[<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
[<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff888113564f00 (size 256):
comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
hex dump (first 32 bytes):
00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00 ..P.............
00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 .........@......
backtrace:
[<ffffffff8476aaf4>] __io_alloc_req_refill+0x55/0x193 io_uring/io_uring.c:1040
[<ffffffff8476c085>] io_alloc_req_refill io_uring/io_uring.h:378 [inline]
[<ffffffff8476c085>] io_submit_sqes.cold+0x65/0x8a io_uring/io_uring.c:2384
[<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
[<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810522dc00 (size 96):
comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
hex dump (first 32 bytes):
00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00 ..P.............
7b 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 { ..............
backtrace:
[<ffffffff814f94a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1062
[<ffffffff823a73ac>] kmalloc include/linux/slab.h:580 [inline]
[<ffffffff823a73ac>] io_req_alloc_apoll io_uring/poll.c:650 [inline]
[<ffffffff823a73ac>] io_arm_poll_handler+0x1fc/0x470 io_uring/poll.c:694
[<ffffffff823961cd>] io_queue_async+0x8d/0x2e0 io_uring/io_uring.c:2006
[<ffffffff82397f18>] io_queue_sqe io_uring/io_uring.c:2037 [inline]
[<ffffffff82397f18>] io_submit_sqe io_uring/io_uring.c:2286 [inline]
[<ffffffff82397f18>] io_submit_sqes+0x968/0xb70 io_uring/io_uring.c:2397
[<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
[<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff8881135a7600 (size 256):
comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
hex dump (first 32 bytes):
00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00 ..P.............
00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 .........@......
backtrace:
[<ffffffff8476aaf4>] __io_alloc_req_refill+0x55/0x193 io_uring/io_uring.c:1040
[<ffffffff8476c085>] io_alloc_req_refill io_uring/io_uring.h:378 [inline]
[<ffffffff8476c085>] io_submit_sqes.cold+0x65/0x8a io_uring/io_uring.c:2384
[<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
[<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff888109a6d900 (size 96):
comm "syz-executor.0", pid 5682, jiffies 4294944681 (age 14.960s)
hex dump (first 32 bytes):
00 9f 50 13 81 88 ff ff 00 00 00 00 00 00 00 00 ..P.............
7b 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 { ..............
backtrace:
[<ffffffff814f94a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1062
[<ffffffff823a73ac>] kmalloc include/linux/slab.h:580 [inline]
[<ffffffff823a73ac>] io_req_alloc_apoll io_uring/poll.c:650 [inline]
[<ffffffff823a73ac>] io_arm_poll_handler+0x1fc/0x470 io_uring/poll.c:694
[<ffffffff823961cd>] io_queue_async+0x8d/0x2e0 io_uring/io_uring.c:2006
[<ffffffff82397f18>] io_queue_sqe io_uring/io_uring.c:2037 [inline]
[<ffffffff82397f18>] io_submit_sqe io_uring/io_uring.c:2286 [inline]
[<ffffffff82397f18>] io_submit_sqes+0x968/0xb70 io_uring/io_uring.c:2397
[<ffffffff82398a3d>] __do_sys_io_uring_enter+0x76d/0x1490 io_uring/io_uring.c:3345
[<ffffffff848f0745>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848f0745>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Tested on:
commit: a4b98579 Merge branch 'io_uring-6.2' into syztest
git tree: git://git.kernel.dk/linux.git syztest
console output: https://syzkaller.appspot.com/x/log.txt?x=1560579a480000
kernel config: https://syzkaller.appspot.com/x/.config?x=72a4287b7f412c8a
dashboard link: https://syzkaller.appspot.com/bug?extid=6c95df01470a47fc3af4
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
Note: no patches were applied.
