mptcp.lists.linux.dev archive mirror
 help / color / mirror / Atom feed
* Re: [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223)
       [not found] <multipath-tcp/mptcp_net-next/issues/223@github.com>
@ 2021-08-09 10:15 ` Geliang Tang
  2021-08-10  8:05   ` Paolo Abeni
  0 siblings, 1 reply; 3+ messages in thread
From: Geliang Tang @ 2021-08-09 10:15 UTC (permalink / raw)
  To: Mat Martineau; +Cc: MPTCP Upstream

Hi Mat,

Mat Martineau <notifications@github.com> 于2021年8月5日周四 上午7:46写道:
>
> BUG: memory leak
> unreferenced object 0xffff88810680ea00 (size 64):
> comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
> hex dump (first 32 bytes):
> 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<....".......
> 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................
> backtrace:
> [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
> [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
> [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
> [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
> [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
> [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
> [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
> [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
> [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
> [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
> [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
> [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
> [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
> [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
> [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
> [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
> [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> BUG: leak checking failed
>
> Config: config.txt
> Reproducer: repro.cprog.gz repro.prog.gz

I didn't reproduce this issue yet. I don't know to use the first repro.cprog
file. I just used the second repro.prog file like this:

/usr/sbin/syz-execprog -executor=/usr/sbin/syz-executor -repeat=0
-procs=16 -cover=0 repro.prog

And I got no memory leaking. It seems that MPTCP dosen't work in this test
at all, since I got no MPTCP debug output in the dmesg log.

I think maybe I used it in the wrong way. Could you give me some help about
how to use these reproducers?

Thanks,
-Geliang

>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub, or unsubscribe.
> Triage notifications on the go with GitHub Mobile for iOS or Android.

^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223)
  2021-08-09 10:15 ` [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223) Geliang Tang
@ 2021-08-10  8:05   ` Paolo Abeni
  2021-08-10 11:36     ` Geliang Tang
  0 siblings, 1 reply; 3+ messages in thread
From: Paolo Abeni @ 2021-08-10  8:05 UTC (permalink / raw)
  To: Geliang Tang, Mat Martineau; +Cc: MPTCP Upstream

On Mon, 2021-08-09 at 18:15 +0800, Geliang Tang wrote:
> Hi Mat,
> 
> Mat Martineau <notifications@github.com> 于2021年8月5日周四 上午7:46写道:
> > BUG: memory leak
> > unreferenced object 0xffff88810680ea00 (size 64):
> > comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
> > hex dump (first 32 bytes):
> > 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<....".......
> > 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................
> > backtrace:
> > [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
> > [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
> > [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
> > [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
> > [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
> > [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
> > [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
> > [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
> > [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
> > [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
> > [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
> > [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
> > [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
> > [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
> > [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
> > [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
> > [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
> > 
> > BUG: leak checking failed
> > 
> > Config: config.txt
> > Reproducer: repro.cprog.gz repro.prog.gz
> 
> I didn't reproduce this issue yet. I don't know to use the first repro.cprog
> file. 

You should just compile it and run it:

mv repro.cprog repro.c
gcc -o repro repro.c
./repro

> I just used the second repro.prog file like this:
> 
> /usr/sbin/syz-execprog -executor=/usr/sbin/syz-executor -repeat=0
> -procs=16 -cover=0 repro.prog

this is different from the requested command line, which is described
by the first (commented) line into the reproducer:

# {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:1
Slowdown:1 Sandbox: Fault:true FaultCall:5 FaultNth:9 Leak:true
NetInjection:false NetDevices:false NetReset:false Cgroups:false
BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false
VhciInjection:false Wifi:false IEEE802154:false Sysctl:false
UseTmpDir:false HandleSegv:false Repro:false Trace:false}

I'm not sure how the above translates to syz-executor arguments, as the
argoment name and list changes quite frequently with new revisions. The
inline help could give some hints.

> And I got no memory leaking. 

Anyhow the same here, using the c repro. Possibly it requires very high
end system? Code inspection did not show anything relevant either.

> It seems that MPTCP dosen't work in this test
> at all, since I got no MPTCP debug output in the dmesg log.

Did you double check your kernel config and did you set properly
dynamic_debug at runtime?

You can additionaly use ftrace or perf (probe) to verify some piece of
code is actually reached by the self-test. Here I see the relevant
pm_netlink.c function being reached.

Cheers,

Paolo


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223)
  2021-08-10  8:05   ` Paolo Abeni
@ 2021-08-10 11:36     ` Geliang Tang
  0 siblings, 0 replies; 3+ messages in thread
From: Geliang Tang @ 2021-08-10 11:36 UTC (permalink / raw)
  To: Paolo Abeni; +Cc: Mat Martineau, MPTCP Upstream

Paolo Abeni <pabeni@redhat.com> 于2021年8月10日周二 下午4:05写道:
>
> On Mon, 2021-08-09 at 18:15 +0800, Geliang Tang wrote:
> > Hi Mat,
> >
> > Mat Martineau <notifications@github.com> 于2021年8月5日周四 上午7:46写道:
> > > BUG: memory leak
> > > unreferenced object 0xffff88810680ea00 (size 64):
> > > comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
> > > hex dump (first 32 bytes):
> > > 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<....".......
> > > 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................
> > > backtrace:
> > > [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
> > > [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
> > > [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
> > > [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
> > > [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
> > > [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
> > > [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
> > > [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
> > > [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
> > > [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
> > > [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
> > > [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
> > > [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
> > > [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
> > > [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
> > > [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> > > [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
> > > [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
> > >
> > > BUG: leak checking failed
> > >
> > > Config: config.txt
> > > Reproducer: repro.cprog.gz repro.prog.gz
> >
> > I didn't reproduce this issue yet. I don't know to use the first repro.cprog
> > file.
>
> You should just compile it and run it:
>
> mv repro.cprog repro.c
> gcc -o repro repro.c
> ./repro

Thanks Paolo, I ran ./repro and reproduced this memory leaking issue. I'll
try to fix it recently.

-Geliang

>
> > I just used the second repro.prog file like this:
> >
> > /usr/sbin/syz-execprog -executor=/usr/sbin/syz-executor -repeat=0
> > -procs=16 -cover=0 repro.prog
>
> this is different from the requested command line, which is described
> by the first (commented) line into the reproducer:
>
> # {Threaded:false Collide:false Repeat:true RepeatTimes:0 Procs:1
> Slowdown:1 Sandbox: Fault:true FaultCall:5 FaultNth:9 Leak:true
> NetInjection:false NetDevices:false NetReset:false Cgroups:false
> BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false USB:false
> VhciInjection:false Wifi:false IEEE802154:false Sysctl:false
> UseTmpDir:false HandleSegv:false Repro:false Trace:false}
>
> I'm not sure how the above translates to syz-executor arguments, as the
> argoment name and list changes quite frequently with new revisions. The
> inline help could give some hints.
>
> > And I got no memory leaking.
>
> Anyhow the same here, using the c repro. Possibly it requires very high
> end system? Code inspection did not show anything relevant either.
>
> > It seems that MPTCP dosen't work in this test
> > at all, since I got no MPTCP debug output in the dmesg log.
>
> Did you double check your kernel config and did you set properly
> dynamic_debug at runtime?
>
> You can additionaly use ftrace or perf (probe) to verify some piece of
> code is actually reached by the self-test. Here I see the relevant
> pm_netlink.c function being reached.
>
> Cheers,
>
> Paolo
>

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-08-10 11:36 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <multipath-tcp/mptcp_net-next/issues/223@github.com>
2021-08-09 10:15 ` [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223) Geliang Tang
2021-08-10  8:05   ` Paolo Abeni
2021-08-10 11:36     ` Geliang Tang

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).