[PATCH syzbot] xdp: Fix memory leak in xp_destroy()

[Peilin Ye]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

I think this is correct, let's see what syzbot thinks.

Commit message draft:

<TODO: improve English...>
xp_destroy() doesn't free `pool->fq` and `pool->cq`, causing a memory leak
e.g. in xsk_bind():

xs->pool = xp_create_and_assign_umem(xs,
[...]
if (err) {
xp_destroy(xs->pool);

xs->pool = xp_create_and_assign_umem(xs, xs->umem);
[...]
if (err) {
xp_destroy(xs->pool);

Move `xskq_destroy(pool->{f,c}q)` from xp_release_deferred to
xp_destroy(). Also, xskq_destroy() does null check, so there's no need to
check again.

Signed-off-by: Peilin Ye <yepei...@gmail.com>

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local

BUG: memory leak
unreferenced object 0xffff8881183d2d00 (size 256):
comm "syz-executor.0", pid 8885, jiffies 4294944030 (age 432.410s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 40 43 19 81 88 ff ff .........@C.....
backtrace:
[<0000000035cd7893>] kmalloc include/linux/slab.h:552 [inline]
[<0000000035cd7893>] kzalloc include/linux/slab.h:682 [inline]
[<0000000035cd7893>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000035cd7893>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000952b4fb3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a7be6bb3>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e816ded3>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000076881f9c>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000673b971a>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
[<000000007db3373b>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
[<00000000aa413d24>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<00000000b8d05fa9>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
[<00000000ad34ae05>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
[<0000000055caeb5e>] __do_sys_unshare kernel/fork.c:3025 [inline]
[<0000000055caeb5e>] __se_sys_unshare kernel/fork.c:3023 [inline]
[<0000000055caeb5e>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
[<00000000cba5d663>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000002f0f2184>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881187c1b00 (size 256):
comm "syz-executor.3", pid 8886, jiffies 4294944034 (age 432.370s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 c0 28 18 81 88 ff ff ..........(.....
backtrace:
[<0000000035cd7893>] kmalloc include/linux/slab.h:552 [inline]
[<0000000035cd7893>] kzalloc include/linux/slab.h:682 [inline]
[<0000000035cd7893>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000035cd7893>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000952b4fb3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a7be6bb3>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e816ded3>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000076881f9c>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000673b971a>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
[<000000007db3373b>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
[<00000000aa413d24>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<00000000b8d05fa9>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
[<00000000ad34ae05>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
[<0000000055caeb5e>] __do_sys_unshare kernel/fork.c:3025 [inline]
[<0000000055caeb5e>] __se_sys_unshare kernel/fork.c:3023 [inline]
[<0000000055caeb5e>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
[<00000000cba5d663>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000002f0f2184>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88810cfaef00 (size 256):
comm "syz-executor.4", pid 8882, jiffies 4294944040 (age 432.310s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 80 d7 13 81 88 ff ff ................
backtrace:
[<0000000035cd7893>] kmalloc include/linux/slab.h:552 [inline]
[<0000000035cd7893>] kzalloc include/linux/slab.h:682 [inline]
[<0000000035cd7893>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000035cd7893>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000952b4fb3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a7be6bb3>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e816ded3>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000076881f9c>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000673b971a>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
[<000000007db3373b>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
[<00000000aa413d24>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<00000000b8d05fa9>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
[<00000000ad34ae05>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
[<0000000055caeb5e>] __do_sys_unshare kernel/fork.c:3025 [inline]
[<0000000055caeb5e>] __se_sys_unshare kernel/fork.c:3023 [inline]
[<0000000055caeb5e>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
[<00000000cba5d663>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000002f0f2184>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881118f2a00 (size 256):
comm "syz-executor.5", pid 8891, jiffies 4294944042 (age 432.290s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 0a 00 00 00 00 80 44 18 81 88 ff ff ..........D.....
backtrace:
[<0000000035cd7893>] kmalloc include/linux/slab.h:552 [inline]
[<0000000035cd7893>] kzalloc include/linux/slab.h:682 [inline]
[<0000000035cd7893>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
[<0000000035cd7893>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
[<00000000952b4fb3>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
[<00000000a7be6bb3>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
[<00000000e816ded3>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
[<0000000076881f9c>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
[<00000000673b971a>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
[<000000007db3373b>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
[<00000000aa413d24>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<00000000b8d05fa9>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
[<00000000ad34ae05>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
[<0000000055caeb5e>] __do_sys_unshare kernel/fork.c:3025 [inline]
[<0000000055caeb5e>] __se_sys_unshare kernel/fork.c:3023 [inline]
[<0000000055caeb5e>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
[<00000000cba5d663>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
[<000000002f0f2184>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



Tested on:

commit: 5ee863be Merge branch 'parisc-5.11-1' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12fa5745500000
kernel config: https://syzkaller.appspot.com/x/.config?x=54b36b2cf69b2e91
dashboard link: https://syzkaller.appspot.com/bug?extid=cfa88ddd0655afa88763
compiler: gcc (GCC) 10.1.0-syz 20200507
patch: https://syzkaller.appspot.com/x/patch.diff?x=105f58c5500000