2020-07-10 06:16:59

by Yang Yingliang

Subject: [PATCH] io_uring: fix memleak in io_sqe_files_register()

I got a memleak report when doing some fuzz test:

BUG: memory leak
unreferenced object 0x607eeac06e78 (size 8):
comm "test", pid 295, jiffies 4294735835 (age 31.745s)
hex dump (first 8 bytes):
00 00 00 00 00 00 00 00 ........
backtrace:
[<00000000932632e6>] percpu_ref_init+0x2a/0x1b0
[<0000000092ddb796>] __io_uring_register+0x111d/0x22a0
[<00000000eadd6c77>] __x64_sys_io_uring_register+0x17b/0x480
[<00000000591b89a6>] do_syscall_64+0x56/0xa0
[<00000000864a281d>] entry_SYSCALL_64_after_hwframe+0x44/0xa9


Call percpu_ref_exit() on error path to avoid
refcount memleak.

Fixes: 05f3fb3c5397 ("io_uring: avoid ring quiesce for fixed file set unregister and update")
Reported-by: Hulk Robot <[email protected]>
Signed-off-by: Yang Yingliang <[email protected]>
---
fs/io_uring.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index d37d7ea5ebe5..ea81be3c14af 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6693,6 +6693,7 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
for (i = 0; i < nr_tables; i++)
kfree(ctx->file_data->table[i].files);

+ percpu_ref_exit(&ctx->file_data->refs);
kfree(ctx->file_data->table);
kfree(ctx->file_data);
ctx->file_data = NULL;
--
2.25.1

2020-07-10 13:51:53

by Jens Axboe

Subject: Re: [PATCH] io_uring: fix memleak in io_sqe_files_register()

On 7/10/20 8:14 AM, Yang Yingliang wrote:
> I got a memleak report when doing some fuzz test:
>
> BUG: memory leak
> unreferenced object 0x607eeac06e78 (size 8):
> comm "test", pid 295, jiffies 4294735835 (age 31.745s)
> hex dump (first 8 bytes):
> 00 00 00 00 00 00 00 00 ........
> backtrace:
> [<00000000932632e6>] percpu_ref_init+0x2a/0x1b0
> [<0000000092ddb796>] __io_uring_register+0x111d/0x22a0
> [<00000000eadd6c77>] __x64_sys_io_uring_register+0x17b/0x480
> [<00000000591b89a6>] do_syscall_64+0x56/0xa0
> [<00000000864a281d>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
>
> Call percpu_ref_exit() on error path to avoid
> refcount memleak.

Applied, thanks.

--
Jens Axboe