Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38;
MIME-Version: 1.0
Date:   Sat, 09 Dec 2023 22:58:21 -0800
In-Reply-To: <000000000000bfba3a060bf4ffcf@google.com>
Message-ID: <000000000000c9c707060c2257fc@google.com>
Subject: Re: [syzbot] [arm-msm?] [net?] memory leak in radix_tree_insert
From:   syzbot <syzbot+006987d1be3586e13555@syzkaller.appspotmail.com>
To:     linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: [arm-msm?] [net?] memory leak in radix_tree_insert
Author: eadavis@qq.com

please test memory leak in radix_tree_insert

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 33cc938e65a9

diff --git a/include/linux/radix-tree.h b/include/linux/radix-tree.h
index eae67015ce51..cc3e9fc7bae0 100644
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -254,6 +254,7 @@ unsigned int radix_tree_gang_lookup_tag_slot(const struct radix_tree_root *,
 		void __rcu ***results, unsigned long first_index,
 		unsigned int max_items, unsigned int tag);
 int radix_tree_tagged(const struct radix_tree_root *, unsigned int tag);
+unsigned long radix_tree_maxindex(const struct radix_tree_root *root);
 
 static inline void radix_tree_preload_end(void)
 {
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index b98e9f2c24ac..a89df8afa510 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -404,6 +404,18 @@ static unsigned radix_tree_load_root(const struct radix_tree_root *root,
 	return 0;
 }
 
+unsigned long radix_tree_maxindex(const struct radix_tree_root *root)
+{
+	struct radix_tree_node *node = rcu_dereference_raw(root->xa_head);
+
+	if (likely(radix_tree_is_internal_node(node))) {
+		node = entry_to_node(node);
+		return node_maxindex(node);
+	}
+
+	return 0;
+}
+
 /*
  *	Extend a radix tree so it can store key @index.
  */
diff --git a/net/qrtr/af_qrtr.c b/net/qrtr/af_qrtr.c
index 41ece61eb57a..abdae567a370 100644
--- a/net/qrtr/af_qrtr.c
+++ b/net/qrtr/af_qrtr.c
@@ -274,7 +274,8 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port,
 		flow = kzalloc(sizeof(*flow), GFP_KERNEL);
 		if (flow) {
 			init_waitqueue_head(&flow->resume_tx);
-			if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
+			if (ret = radix_tree_insert(&node->qrtr_tx_flow, key, flow)) {
+				printk("r: %d, k: %llu, f: %p, %s\n", ret, key, flow, __func__);
 				kfree(flow);
 				flow = NULL;
 			}
@@ -344,6 +344,13 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb,
 	struct qrtr_hdr_v1 *hdr;
 	size_t len = skb->len;
 	int rc, confirm_rx;
+	unsigned long maxidx;
+
+	if (to->sq_node == QRTR_NODE_BCAST) {
+		maxidx = radix_tree_maxindex(&node->qrtr_tx_flow);
+		to->sq_node = maxidx + 1;
+		printk("mi: %llu, sn: %llu, %s\n", maxidx, to->sq_node, __func__);
+	}
 
 	confirm_rx = qrtr_tx_wait(node, to->sq_node, to->sq_port, type);
 	if (confirm_rx < 0) {