Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   qiang.zhang@windriver.com
To:     axboe@kernel.dk, asml.silence@gmail.com
Cc:     io-uring@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH] io-wq: fix memory leak in create_io_worker()
Date:   Thu,  9 Sep 2021 19:58:22 +0800
Message-Id: <20210909115822.181188-1-qiang.zhang@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?wgCzcN3ieepT4Yh+VkPttWbCP6SJQDpBsE1FBYJThwUgNR4e0CD0ysJWl2p0?=
 =?us-ascii?Q?k3mfUYmoNlA6aNOA6093Tn/0QNYO9hoYcVP6f7lsMV6FuFHDtpm2XXX2zI99?=
 =?us-ascii?Q?3t3iMuNAks+UtTV0Z7ZHIJP1ejS3PiczSD3h08GBbHWmw1QQ1hTFc17/47QP?=
 =?us-ascii?Q?m6HsAorXYnbD6rcEasR+SHVgP2DsCBdaLB0hWy+MpfjQyf5CwJQqLydEQGnu?=
 =?us-ascii?Q?ChWdgs6lt90qQmJBfT9lXJsnB7Bd/iz1OxSIp392GUWx2CIQQ3iBNRDP+YXw?=
 =?us-ascii?Q?AaZezMkSu7/ywXdnJuUdHZmC3cEMfZvcYCMYdlU9FZNJwTNtaEUV55v1P6/D?=
 =?us-ascii?Q?pL/L+fmhr/1RF2lU7ceQmJqxhmb06Cr+r4Mt+4TNPw23goyhu95oLAlqaNGT?=
 =?us-ascii?Q?wMoTzblf19zakId1Y2tXszw4m7DFzaeWSXXi2SqdXpPQ0OdlXpjrd1/hCqHe?=
 =?us-ascii?Q?75kcHGlNMtvLLohE8NYqcmotbQbWctbtipQLKpeEdTMomfZ/LLgA0q0dfG9/?=
 =?us-ascii?Q?+TsLY5ZrrWfm6BNKhUluFMwz72BGMyuhkYJeu5i9l2p2Wwm2aABXSAIVy48/?=
 =?us-ascii?Q?4fd4IjZxQzVbJzond+wFUboJC0LkMuroB6l4i+wuZFknRPKqhJW5cGadeauE?=
 =?us-ascii?Q?DIxEwvPDNxvY7eSS6pCBSXG3wxlYeA/Jny6XMfLrhx3Z+v4RcEabwe46vjx8?=
 =?us-ascii?Q?3tqHf9tzStJKZzDIXZunq074tE58IaJD3VShLG6fHIMUBG5ExosVGynsY4BS?=
 =?us-ascii?Q?FT7G1UxL6ME76iwQOmwNrBBYuKzYwhhfE8N34+IjGZVhTAgkxlNBpJhhyw9/?=
 =?us-ascii?Q?Zsz7SQba+Cp54dPcbUvY8AYYISXalwxKYWE4p7pMy7KQbZL34nHhLCzr3wkD?=
 =?us-ascii?Q?7URiLwe65MuSq1Hn35pH1W7vpAleTwVn4q3BJC+LqqJdmgel8Gm0P6WVmlkV?=
 =?us-ascii?Q?dAWTAYDzZz37cefDnV/147/L/laTBW77+JBrEI5sjRPMvx0I59eqgiUW/DYg?=
 =?us-ascii?Q?EGSKz4LgN9IFTmLXHRvnaaBFUmq7EFjYJBagylPuKXFY+ObSAHrSrkJtQFnd?=
 =?us-ascii?Q?BlLNykModo28fMDeG/oWVDowP5S3v+ABduJwBaDt9n0ySH+xf4JN91GsrNra?=
 =?us-ascii?Q?9KFj/d2AleBnfkfysXIoUcNQm+0RPlkt70e7yiXWmCzuS/fVif4/X20w5OCW?=
 =?us-ascii?Q?6GcltvryffX3lTNU9rT4EkoQvpjqlwnjXzms9yXkqg55r0h+7+ah+7PEo4PR?=
 =?us-ascii?Q?JmRnd066QaCbB7DKABA2t/xGtLkrPZiUh5kmK/TaBxLfiZOsj95/FUn8ejry?=
 =?us-ascii?Q?+n8MEDWr4E171FjjvIl3LWhuNBAtlsFTB+Hm/4W4MmLzpBz2/Tlf2a0UiA6r?=
 =?us-ascii?Q?hJg/HX/krow+A9axxoU6A8vo3zJd?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d55fcfa4-b23e-4222-eedd-08d973892a94
X-MS-Exchange-CrossTenant-AuthSource: BL1PR11MB5478.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Sep 2021 11:58:41.5476
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: iuNjuWOzIUllfJbv9xZOwAjgfocuR2OVaEJyNEWaDY2oXNeugMZFzC9Byrw1l2QIVkE7FkduKJ8AT7spdeR+BzchuclDGQy86DXzvGpYsQM=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4598
X-Proofpoint-GUID: qlTZxRVfmKrNzgPr6wZM_osuCONTXvn9
X-Proofpoint-ORIG-GUID: qlTZxRVfmKrNzgPr6wZM_osuCONTXvn9
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.182.1,Aquarius:18.0.790,Hydra:6.0.391,FMLib:17.0.607.475
 definitions=2021-09-09_04,2021-09-09_01,2020-04-07_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=909
 impostorscore=0 bulkscore=0 malwarescore=0 suspectscore=0 spamscore=0
 lowpriorityscore=0 mlxscore=0 adultscore=0 phishscore=0 priorityscore=1501
 clxscore=1015 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2109030001 definitions=main-2109090073
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: "Qiang.zhang" <qiang.zhang@windriver.com>

BUG: memory leak
unreferenced object 0xffff888126fcd6c0 (size 192):
  comm "syz-executor.1", pid 11934, jiffies 4294983026 (age 15.690s)
  backtrace:
    [<ffffffff81632c91>] kmalloc_node include/linux/slab.h:609 [inline]
    [<ffffffff81632c91>] kzalloc_node include/linux/slab.h:732 [inline]
    [<ffffffff81632c91>] create_io_worker+0x41/0x1e0 fs/io-wq.c:739
    [<ffffffff8163311e>] io_wqe_create_worker fs/io-wq.c:267 [inline]
    [<ffffffff8163311e>] io_wqe_enqueue+0x1fe/0x330 fs/io-wq.c:866
    [<ffffffff81620b64>] io_queue_async_work+0xc4/0x200 fs/io_uring.c:1473
    [<ffffffff8162c59c>] __io_queue_sqe+0x34c/0x510 fs/io_uring.c:6933
    [<ffffffff8162c7ab>] io_req_task_submit+0x4b/0xa0 fs/io_uring.c:2233
    [<ffffffff8162cb48>] io_async_task_func+0x108/0x1c0 fs/io_uring.c:5462
    [<ffffffff816259e3>] tctx_task_work+0x1b3/0x3a0 fs/io_uring.c:2158
    [<ffffffff81269b43>] task_work_run+0x73/0xb0 kernel/task_work.c:164
    [<ffffffff812dcdd1>] tracehook_notify_signal include/linux/tracehook.h:212 [inline]
    [<ffffffff812dcdd1>] handle_signal_work kernel/entry/common.c:146 [inline]
    [<ffffffff812dcdd1>] exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
    [<ffffffff812dcdd1>] exit_to_user_mode_prepare+0x151/0x180 kernel/entry/common.c:209
    [<ffffffff843ff25d>] __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
    [<ffffffff843ff25d>] syscall_exit_to_user_mode+0x1d/0x40 kernel/entry/common.c:302
    [<ffffffff843fa4a2>] do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
    [<ffffffff84600068>] entry_SYSCALL_64_after_hwframe+0x44/0xae

when create_io_thread() return error, and not retry, the worker object
need to be freed.

Reported-by: syzbot+65454c239241d3d647da@syzkaller.appspotmail.com
Signed-off-by: Qiang.zhang <qiang.zhang@windriver.com>
---
 fs/io-wq.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/io-wq.c b/fs/io-wq.c
index 35e7ee26f7ea..27fa0506c1a6 100644
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -709,6 +709,7 @@ static void create_worker_cont(struct callback_head *cb)
 		}
 		raw_spin_unlock(&wqe->lock);
 		io_worker_ref_put(wqe->wq);
+		kfree(worker);
 		return;
 	}
 
@@ -725,6 +726,7 @@ static void io_workqueue_create(struct work_struct *work)
 	if (!io_queue_worker_create(worker, acct, create_worker_cont)) {
 		clear_bit_unlock(0, &worker->create_state);
 		io_worker_release(worker);
+		kfree(worker);
 	}
 }
 
@@ -759,6 +761,7 @@ static bool create_io_worker(struct io_wq *wq, struct io_wqe *wqe, int index)
 	if (!IS_ERR(tsk)) {
 		io_init_new_worker(wqe, worker, tsk);
 	} else if (!io_should_retry_thread(PTR_ERR(tsk))) {
+		kfree(worker);
 		goto fail;
 	} else {
 		INIT_WORK(&worker->work, io_workqueue_create);
-- 
2.25.1