From: cheung wall <zzqq0103.hey@gmail.com>
To: Marc Zyngier <maz@kernel.org>,
Oliver Upton <oliver.upton@linux.dev>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will@kernel.org>
Cc: James Morse <james.morse@arm.com>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
Zenghui Yu <yuzenghui@huawei.com>,
linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
linux-kernel@vger.kernel.org
Subject: memory leak in kvm_init_stage2_mmu
Date: Wed, 13 Mar 2024 12:53:52 +0800 [thread overview]
Message-ID: <CAKHoSAtTA7pTi5T7oYZkNdVwt79sXbW+1=V=LZxpKdJGRSk0Eg@mail.gmail.com> (raw)
Hello,
when using Syzkaller to fuzz the latest Linux Kernel arm64 version,
the following crash
was triggered on:
HEAD commit: 0dd3ee31125508cd67f7e7172247f05b7fd1753a (tag: v6.7)
git tree: upstream
console output: https://pastebin.com/raw/MLVZbN01
kernel config: https://pastebin.com/raw/PFD96ZwE
C reproducer: https://pastebin.com/raw/rHmMzvGt
Syzlang reproducer: https://pastebin.com/raw/dAt714WD
If you fix this issue, please add the following tag to the commit:
Reported-by: Qiang Zhang <zzqq0103.hey@gmail.com>
----------------------------------------------------------
2024/03/05 18:24:34 executed programs: 0
2024/03/05 18:26:41 executed programs: 8
BUG: memory leak
unreferenced object 0xffff023ad74b8100 (size 128):
comm "syz-executor.3", pid 3911, jiffies 4295149819 (age 22.132s)
hex dump (first 32 bytes):
28 00 00 00 01 00 00 00 00 40 4e d7 3a 02 ff ff (........@N.:...
80 d9 5f a4 48 d3 ff ff c8 69 46 d7 3a 02 ff ff .._.H....iF.:...
backtrace:
[<000000008d295845>] kmemleak_alloc_recursive
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/kmemleak.h:42
[inline]
[<000000008d295845>] slab_post_alloc_hook
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab.h:740
[inline]
[<000000008d295845>] slab_alloc_node
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3398
[inline]
[<000000008d295845>] __kmem_cache_alloc_node+0x1f4/0x320
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3437
[<000000003fbdfe35>] kmalloc_trace+0x44/0x6c
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab_common.c:1045
[<00000000a94cbf84>] kmalloc
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:553
[inline]
[<00000000a94cbf84>] kzalloc
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:689
[inline]
[<00000000a94cbf84>] kvm_init_stage2_mmu+0x88/0x450
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/mmu.c:712
[<00000000d7d73550>] kvm_arch_init_vm+0x6c/0x2d0
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/arm.c:145
[<000000001e472e33>] kvm_create_vm
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1219
[inline]
[<000000001e472e33>] kvm_dev_ioctl_create_vm
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5009
[inline]
[<000000001e472e33>] kvm_dev_ioctl+0x790/0x158c
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5051
[<000000005f1541e3>] vfs_ioctl
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:51
[inline]
[<000000005f1541e3>] __do_sys_ioctl
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:870
[inline]
[<000000005f1541e3>] __se_sys_ioctl
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856
[inline]
[<000000005f1541e3>] __arm64_sys_ioctl+0x17c/0x204
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856
[<00000000721fb6b6>] __invoke_syscall
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:38
[inline]
[<00000000721fb6b6>] invoke_syscall+0x84/0x2d0
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:52
[<00000000718e28b1>] el0_svc_common.constprop.0+0xe8/0x2e4
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:142
[<000000001553392f>] do_el0_svc+0x64/0x1fc
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:206
[<00000000585b9848>] el0_svc+0x2c/0x6c
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:637
[<0000000051149d12>] el0t_64_sync_handler+0xf4/0x120
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:655
[<00000000decfe0e2>] el0t_64_sync+0x18c/0x190
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry.S:585
BUG: memory leak
unreferenced object 0xffff023ad0484d00 (size 128):
comm "syz-executor.2", pid 3935, jiffies 4295150036 (age 21.268s)
hex dump (first 32 bytes):
28 00 00 00 01 00 00 00 00 00 13 c7 3a 02 ff ff (...........:...
80 d9 5f a4 48 d3 ff ff c8 a9 c3 cd 3a 02 ff ff .._.H.......:...
backtrace:
[<000000008d295845>] kmemleak_alloc_recursive
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/kmemleak.h:42
[inline]
[<000000008d295845>] slab_post_alloc_hook
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab.h:740
[inline]
[<000000008d295845>] slab_alloc_node
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3398
[inline]
[<000000008d295845>] __kmem_cache_alloc_node+0x1f4/0x320
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slub.c:3437
[<000000003fbdfe35>] kmalloc_trace+0x44/0x6c
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/mm/slab_common.c:1045
[<00000000a94cbf84>] kmalloc
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:553
[inline]
[<00000000a94cbf84>] kzalloc
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/./include/linux/slab.h:689
[inline]
[<00000000a94cbf84>] kvm_init_stage2_mmu+0x88/0x450
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/mmu.c:712
[<00000000d7d73550>] kvm_arch_init_vm+0x6c/0x2d0
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/arm.c:145
[<000000001e472e33>] kvm_create_vm
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:1219
[inline]
[<000000001e472e33>] kvm_dev_ioctl_create_vm
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5009
[inline]
[<000000001e472e33>] kvm_dev_ioctl+0x790/0x158c
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kvm/../../../virt/kvm/kvm_main.c:5051
[<000000005f1541e3>] vfs_ioctl
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:51
[inline]
[<000000005f1541e3>] __do_sys_ioctl
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:870
[inline]
[<000000005f1541e3>] __se_sys_ioctl
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856
[inline]
[<000000005f1541e3>] __arm64_sys_ioctl+0x17c/0x204
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/fs/ioctl.c:856
[<00000000721fb6b6>] __invoke_syscall
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:38
[inline]
[<00000000721fb6b6>] invoke_syscall+0x84/0x2d0
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:52
[<00000000718e28b1>] el0_svc_common.constprop.0+0xe8/0x2e4
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:142
[<000000001553392f>] do_el0_svc+0x64/0x1fc
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/syscall.c:206
[<00000000585b9848>] el0_svc+0x2c/0x6c
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:637
[<0000000051149d12>] el0t_64_sync_handler+0xf4/0x120
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry-common.c:655
[<00000000decfe0e2>] el0t_64_sync+0x18c/0x190
data/embfuzz/emblinux/linux-4a61839152cc3e9e00ac059d73a28d148d622b30/arch/arm64/kernel/entry.S:585
next reply other threads:[~2024-03-13 4:54 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-13 4:53 cheung wall [this message]
2024-03-13 15:54 ` memory leak in kvm_init_stage2_mmu Marc Zyngier
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKHoSAtTA7pTi5T7oYZkNdVwt79sXbW+1=V=LZxpKdJGRSk0Eg@mail.gmail.com' \
--to=zzqq0103.hey@gmail.com \
--cc=catalin.marinas@arm.com \
--cc=james.morse@arm.com \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=oliver.upton@linux.dev \
--cc=suzuki.poulose@arm.com \
--cc=will@kernel.org \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).