[Linux Kernel Bug] memory leak in ubi_attach

[Chenyuan Yang]

Hi Zhihao,

Thanks for your prompt reply! Here are the files related to this memory leak.

Best,
Chenyuan

On Mon, Jan 22, 2024 at 10:55 PM Zhihao Cheng <chengzhihao1 at huawei.com> wrote:
>
> 在 2024/1/23 11:53, Chenyuan Yang 写道:
> > Dear Linux Kernel Developers for UBI,
> >
> > We encountered "memory leak in ubi_attach" when testing UBI with
> > Syzkaller and our generated specifications.
> >
> > syz repro: https://drive.google.com/file/d/17FoGw6akfufz05U-oRBP2wXmOiFF1VUq/view?usp=drive_link
> > C reproducer: https://drive.google.com/file/d/1ayd3lmHPvqNoI01pQEdU832EktpTUnZ_/view?usp=drive_link
> > report: https://drive.google.com/file/d/1hC2arY3FbQt-6L5rbDfY-DQ2oH82IIGq/view?usp=drive_link
> > stats: https://drive.google.com/file/d/1REig9fV0H1fYPWaiicc-JVLlCpo7TTw4/view?usp=drive_link
>
> I can't open above links in company, may you post these files in attachment?
>
> >
> > This memory leak is triggered by `ioctl$UBI_IOCATT`, where
> > `ubi_attach_info` invokes `kmem_cache_create`
> > (https://elixir.bootlin.com/linux/v6.7/source/drivers/mtd/ubi/attach.c#L1464).
> > It seems that the memory leak occurs when the slab cache is
> > successfully created. I apologize for not being able to conduct a
> > deeper analysis of the root cause, as my expertise in UBI drivers is
> > limited.
> >
> > If you have any questions or require more information, please feel
> > free to contact us.
> >
> > Reported-by: Chenyuan Yang <chenyuan0y at gmail.com>
> >
> > Best,
> > Chenyuan
> >
> >
> > ______________________________________________________
> > Linux MTD discussion mailing list
> > http://lists.infradead.org/mailman/listinfo/linux-mtd/
> >
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: repro.report
Type: application/octet-stream
Size: 2206 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20240122/47bb8883/attachment-0004.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: repro.cprog
Type: application/octet-stream
Size: 41955 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20240122/47bb8883/attachment-0005.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: repro.prog
Type: application/octet-stream
Size: 632 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20240122/47bb8883/attachment-0006.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: repro.stats
Type: application/octet-stream
Size: 17330227 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/linux-mtd/attachments/20240122/47bb8883/attachment-0007.obj>