Re: [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223)

[Geliang Tang <geliangtang@gmail.com>]

Paolo Abeni <pabeni@redhat.com> 于2021年8月10日周二 下午4:05写道：
>
> On Mon, 2021-08-09 at 18:15 +0800, Geliang Tang wrote:
> > Hi Mat,
> >
> > Mat Martineau <notifications@github.com> 于2021年8月5日周四 上午7:46写道：
> > > BUG: memory leak
> > > unreferenced object 0xffff88810680ea00 (size 64):
> > > comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
> > > hex dump (first 32 bytes):
> > > 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<....".......
> > > 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................
> > > backtrace:
> > > [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
> > > [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
> > > [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
> > > [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
> > > [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
> > > [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
> > > [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
> > > [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
> > > [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
> > > [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
> > > [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
> > > [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
> > > [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
> > > [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
> > > [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
> > > [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > > [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
> > > [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
> > >
> > > BUG: leak checking failed
> > >
> > > Config: config.txt
> > > Reproducer: repro.cprog.gz repro.prog.gz
> >
> > I didn't reproduce this issue yet. I don't know to use the first repro.cprog
> > file.
>
> You should just compile it and run it:
>
> mv repro.cprog repro.c
> gcc -o repro repro.c
> ./repro

Thanks Paolo, I ran ./repro and reproduced this memory leaking issue. I'll
try to fix it recently.

-Geliang

>
> > I just used the second repro.prog file like this:
> >
> > /usr/sbin/syz-execprog -executor=/usr/sbin/syz-executor -repeat=0
> > -procs=16 -cover=0 repro.prog
>
> this is different from the requested command line, which is described
> by the first (commented) line into the reproducer:
>
> # {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:1
> Slowdown:1 Sandbox: Fault:true FaultCall:5 FaultNth:9 Leak:true
> NetInjection:false NetDevices:false NetReset:false Cgroups:false
> BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false
> VhciInjection:false Wifi:false IEEE802154:false Sysctl:false
> UseTmpDir:false HandleSegv:false Repro:false Trace:false}
>
> I'm not sure how the above translates to syz-executor arguments, as the
> argoment name and list changes quite frequently with new revisions. The
> inline help could give some hints.
>
> > And I got no memory leaking.
>
> Anyhow the same here, using the c repro. Possibly it requires very high
> end system? Code inspection did not show anything relevant either.
>
> > It seems that MPTCP dosen't work in this test
> > at all, since I got no MPTCP debug output in the dmesg log.
>
> Did you double check your kernel config and did you set properly
> dynamic_debug at runtime?
>
> You can additionaly use ftrace or perf (probe) to verify some piece of
> code is actually reached by the self-test. Here I see the relevant
> pm_netlink.c function being reached.
>
> Cheers,
>
> Paolo
>