Messages in this thread | | | From | cheung wall <> | Date | Wed, 13 Mar 2024 12:53:52 +0800 | Subject | memory leak in kvm_init_stage2_mmu |
| |
Hello,
when using Syzkaller to fuzz the latest Linux Kernel arm64 version, the following crash
was triggered on:
HEAD commit: 0dd3ee31125508cd67f7e7172247f05b7fd1753a (tag: v6.7)
git tree: upstream
console output: https://pastebin.com/raw/MLVZbN01
kernel config: https://pastebin.com/raw/PFD96ZwE
C reproducer: https://pastebin.com/raw/rHmMzvGt
Syzlang reproducer: https://pastebin.com/raw/dAt714WD
If you fix this issue, please add the following tag to the commit:
Reported-by: Qiang Zhang <zzqq0103.hey@gmail.com>
----------------------------------------------------------
2024/03/05 18:24:34 executed programs: 0 2024/03/05 18:26:41 executed programs: 8 BUG: memory leak unreferenced object 0xffff023ad74b8100 (size 128): comm "syz-executor.3", pid 3911, jiffies 4295149819 (age 22.132s) hex dump (first 32 bytes): 28 00 00 00 01 00 00 00 00 40 4e d7 3a 02 ff ff (........@N.:... 80 d9 5f a4 48 d3 ff ff c8 69 46 d7 3a 02 ff ff .._.H....iF.:... backtrace: [<000000008d295845>] kmemleak_alloc_recursive data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/kmemleak.h:42 [inline] [<000000008d295845>] slab_post_alloc_hook data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab.h:740 [inline] [<000000008d295845>] slab_alloc_node data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3398 [inline] [<000000008d295845>] __kmem_cache_alloc_node+0x1f4/0x320 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3437 [<000000003fbdfe35>] kmalloc_trace+0x44/0x6c data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab_common.c:1045 [<00000000a94cbf84>] kmalloc data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:553 [inline] [<00000000a94cbf84>] kzalloc data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:689 [inline] [<00000000a94cbf84>] kvm_init_stage2_mmu+0x88/0x450 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/mmu.c:712 [<00000000d7d73550>] kvm_arch_init_vm+0x6c/0x2d0 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/arm.c:145 [<000000001e472e33>] kvm_create_vm data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1219 [inline] [<000000001e472e33>] kvm_dev_ioctl_create_vm data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5009 [inline] [<000000001e472e33>] kvm_dev_ioctl+0x790/0x158c data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5051 [<000000005f1541e3>] vfs_ioctl data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:51 [inline] [<000000005f1541e3>] __do_sys_ioctl data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:870 [inline] [<000000005f1541e3>] __se_sys_ioctl data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856 [inline] [<000000005f1541e3>] __arm64_sys_ioctl+0x17c/0x204 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856 [<00000000721fb6b6>] __invoke_syscall data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:38 [inline] [<00000000721fb6b6>] invoke_syscall+0x84/0x2d0 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:52 [<00000000718e28b1>] el0_svc_common.constprop.0+0xe8/0x2e4 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:142 [<000000001553392f>] do_el0_svc+0x64/0x1fc data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:206 [<00000000585b9848>] el0_svc+0x2c/0x6c data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:637 [<0000000051149d12>] el0t_64_sync_handler+0xf4/0x120 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:655 [<00000000decfe0e2>] el0t_64_sync+0x18c/0x190 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry.S:585
BUG: memory leak unreferenced object 0xffff023ad0484d00 (size 128): comm "syz-executor.2", pid 3935, jiffies 4295150036 (age 21.268s) hex dump (first 32 bytes): 28 00 00 00 01 00 00 00 00 00 13 c7 3a 02 ff ff (...........:... 80 d9 5f a4 48 d3 ff ff c8 a9 c3 cd 3a 02 ff ff .._.H.......:... backtrace: [<000000008d295845>] kmemleak_alloc_recursive data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/kmemleak.h:42 [inline] [<000000008d295845>] slab_post_alloc_hook data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab.h:740 [inline] [<000000008d295845>] slab_alloc_node data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3398 [inline] [<000000008d295845>] __kmem_cache_alloc_node+0x1f4/0x320 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3437 [<000000003fbdfe35>] kmalloc_trace+0x44/0x6c data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab_common.c:1045 [<00000000a94cbf84>] kmalloc data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:553 [inline] [<00000000a94cbf84>] kzalloc data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:689 [inline] [<00000000a94cbf84>] kvm_init_stage2_mmu+0x88/0x450 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/mmu.c:712 [<00000000d7d73550>] kvm_arch_init_vm+0x6c/0x2d0 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/arm.c:145 [<000000001e472e33>] kvm_create_vm data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1219 [inline] [<000000001e472e33>] kvm_dev_ioctl_create_vm data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5009 [inline] [<000000001e472e33>] kvm_dev_ioctl+0x790/0x158c data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5051 [<000000005f1541e3>] vfs_ioctl data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:51 [inline] [<000000005f1541e3>] __do_sys_ioctl data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:870 [inline] [<000000005f1541e3>] __se_sys_ioctl data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856 [inline] [<000000005f1541e3>] __arm64_sys_ioctl+0x17c/0x204 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856 [<00000000721fb6b6>] __invoke_syscall data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:38 [inline] [<00000000721fb6b6>] invoke_syscall+0x84/0x2d0 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:52 [<00000000718e28b1>] el0_svc_common.constprop.0+0xe8/0x2e4 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:142 [<000000001553392f>] do_el0_svc+0x64/0x1fc data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:206 [<00000000585b9848>] el0_svc+0x2c/0x6c data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:637 [<0000000051149d12>] el0t_64_sync_handler+0xf4/0x120 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:655 [<00000000decfe0e2>] el0t_64_sync+0x18c/0x190 data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry.S:585
| |