Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rw_copy_check_uvector
BUG: memory leak
unreferenced object 0xffff888104763400 (size 1024):
comm "syz-executor.1", pid 8382, jiffies 4294943644 (age 11.260s)
hex dump (first 32 bytes):
00 01 00 20 00 00 00 00 14 00 00 00 00 00 00 00 ... ............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000006c403c8a>] kmalloc_array include/linux/slab.h:594 [inline]
[<000000006c403c8a>] rw_copy_check_uvector+0x171/0x1a0 fs/read_write.c:812
[<00000000ee5de36c>] import_iovec+0x4a/0x140 lib/iov_iter.c:1681
[<00000000f93b401f>] __io_import_iovec+0xcf/0x610 fs/io_uring.c:2855
[<0000000047afba74>] io_rw_prep_async fs/io_uring.c:2990 [inline]
[<0000000047afba74>] io_read_prep+0x84/0xe0 fs/io_uring.c:3014
[<000000000852bbf9>] io_req_defer_prep fs/io_uring.c:5428 [inline]
[<000000000852bbf9>] io_req_defer_prep+0x1c6/0x720 fs/io_uring.c:5408
[<000000005f210a4c>] io_submit_sqe fs/io_uring.c:6240 [inline]
[<000000005f210a4c>] io_submit_sqes+0x306/0xc00 fs/io_uring.c:6466
[<00000000cda933b0>] __do_sys_io_uring_enter+0x582/0x830 fs/io_uring.c:8250
[<0000000034b305b8>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000e68d9ab6>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff88810476b800 (size 1024):
comm "syz-executor.1", pid 8391, jiffies 4294943649 (age 11.210s)
hex dump (first 32 bytes):
00 01 00 20 00 00 00 00 14 00 00 00 00 00 00 00 ... ............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000006c403c8a>] kmalloc_array include/linux/slab.h:594 [inline]
[<000000006c403c8a>] rw_copy_check_uvector+0x171/0x1a0 fs/read_write.c:812
[<00000000ee5de36c>] import_iovec+0x4a/0x140 lib/iov_iter.c:1681
[<00000000f93b401f>] __io_import_iovec+0xcf/0x610 fs/io_uring.c:2855
[<0000000047afba74>] io_rw_prep_async fs/io_uring.c:2990 [inline]
[<0000000047afba74>] io_read_prep+0x84/0xe0 fs/io_uring.c:3014
[<000000000852bbf9>] io_req_defer_prep fs/io_uring.c:5428 [inline]
[<000000000852bbf9>] io_req_defer_prep+0x1c6/0x720 fs/io_uring.c:5408
[<000000005f210a4c>] io_submit_sqe fs/io_uring.c:6240 [inline]
[<000000005f210a4c>] io_submit_sqes+0x306/0xc00 fs/io_uring.c:6466
[<00000000cda933b0>] __do_sys_io_uring_enter+0x582/0x830 fs/io_uring.c:8250
[<0000000034b305b8>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000e68d9ab6>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff88810476b400 (size 1024):
comm "syz-executor.1", pid 8394, jiffies 4294943653 (age 11.170s)
hex dump (first 32 bytes):
00 01 00 20 00 00 00 00 14 00 00 00 00 00 00 00 ... ............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000006c403c8a>] kmalloc_array include/linux/slab.h:594 [inline]
[<000000006c403c8a>] rw_copy_check_uvector+0x171/0x1a0 fs/read_write.c:812
[<00000000ee5de36c>] import_iovec+0x4a/0x140 lib/iov_iter.c:1681
[<00000000f93b401f>] __io_import_iovec+0xcf/0x610 fs/io_uring.c:2855
[<0000000047afba74>] io_rw_prep_async fs/io_uring.c:2990 [inline]
[<0000000047afba74>] io_read_prep+0x84/0xe0 fs/io_uring.c:3014
[<000000000852bbf9>] io_req_defer_prep fs/io_uring.c:5428 [inline]
[<000000000852bbf9>] io_req_defer_prep+0x1c6/0x720 fs/io_uring.c:5408
[<000000005f210a4c>] io_submit_sqe fs/io_uring.c:6240 [inline]
[<000000005f210a4c>] io_submit_sqes+0x306/0xc00 fs/io_uring.c:6466
[<00000000cda933b0>] __do_sys_io_uring_enter+0x582/0x830 fs/io_uring.c:8250
[<0000000034b305b8>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000e68d9ab6>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff888104780800 (size 1024):
comm "syz-executor.1", pid 8407, jiffies 4294943670 (age 11.000s)
hex dump (first 32 bytes):
00 01 00 20 00 00 00 00 14 00 00 00 00 00 00 00 ... ............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000006c403c8a>] kmalloc_array include/linux/slab.h:594 [inline]
[<000000006c403c8a>] rw_copy_check_uvector+0x171/0x1a0 fs/read_write.c:812
[<00000000ee5de36c>] import_iovec+0x4a/0x140 lib/iov_iter.c:1681
[<00000000f93b401f>] __io_import_iovec+0xcf/0x610 fs/io_uring.c:2855
[<0000000047afba74>] io_rw_prep_async fs/io_uring.c:2990 [inline]
[<0000000047afba74>] io_read_prep+0x84/0xe0 fs/io_uring.c:3014
[<000000000852bbf9>] io_req_defer_prep fs/io_uring.c:5428 [inline]
[<000000000852bbf9>] io_req_defer_prep+0x1c6/0x720 fs/io_uring.c:5408
[<000000005f210a4c>] io_submit_sqe fs/io_uring.c:6240 [inline]
[<000000005f210a4c>] io_submit_sqes+0x306/0xc00 fs/io_uring.c:6466
[<00000000cda933b0>] __do_sys_io_uring_enter+0x582/0x830 fs/io_uring.c:8250
[<0000000034b305b8>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000e68d9ab6>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
BUG: memory leak
unreferenced object 0xffff8881038e9c00 (size 1024):
comm "syz-executor.1", pid 8414, jiffies 4294943675 (age 10.950s)
hex dump (first 32 bytes):
00 01 00 20 00 00 00 00 14 00 00 00 00 00 00 00 ... ............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000006c403c8a>] kmalloc_array include/linux/slab.h:594 [inline]
[<000000006c403c8a>] rw_copy_check_uvector+0x171/0x1a0 fs/read_write.c:812
[<00000000ee5de36c>] import_iovec+0x4a/0x140 lib/iov_iter.c:1681
[<00000000f93b401f>] __io_import_iovec+0xcf/0x610 fs/io_uring.c:2855
[<0000000047afba74>] io_rw_prep_async fs/io_uring.c:2990 [inline]
[<0000000047afba74>] io_read_prep+0x84/0xe0 fs/io_uring.c:3014
[<000000000852bbf9>] io_req_defer_prep fs/io_uring.c:5428 [inline]
[<000000000852bbf9>] io_req_defer_prep+0x1c6/0x720 fs/io_uring.c:5408
[<000000005f210a4c>] io_submit_sqe fs/io_uring.c:6240 [inline]
[<000000005f210a4c>] io_submit_sqes+0x306/0xc00 fs/io_uring.c:6466
[<00000000cda933b0>] __do_sys_io_uring_enter+0x582/0x830 fs/io_uring.c:8250
[<0000000034b305b8>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<00000000e68d9ab6>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Tested on:
commit: 9907ab37 Merge tag 'for-5.9-rc2-tag' of git://git.kernel.o..
git tree: upstream
console output:
https://syzkaller.appspot.com/x/log.txt?x=17c6c9a9900000
kernel config:
https://syzkaller.appspot.com/x/.config?x=903b9fecc3c6d231