Re: [syzbot] memory leak in xas_create

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    2f5065a0bc9d Merge tag 'acpi-6.1-rc4' of git://git.kernel...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12351e76880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=7da85296f1024c6a
dashboard link: https://syzkaller.appspot.com/bug?extid=a785d07959bc94837d51
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=110bbf39880000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12fff099880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2e34093711ff/disk-2f5065a0.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/73117023c3a9/vmlinux-2f5065a0.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c708621825f8/bzImage-2f5065a0.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a785d07959bc94837d51@xxxxxxxxxxxxxxxxxxxxxxxxx

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
BUG: memory leak
unreferenced object 0xffff88810fd216c0 (size 576):
  comm "syz-executor159", pid 3686, jiffies 4295064650 (age 50.150s)
  hex dump (first 32 bytes):
    06 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    20 85 98 0f 81 88 ff ff d8 16 d2 0f 81 88 ff ff   ...............
  backtrace:
    [<ffffffff844153c6>] xas_alloc+0xf6/0x120 lib/xarray.c:377
    [<ffffffff84418039>] xas_create+0x3b9/0x800 lib/xarray.c:679
    [<ffffffff84418520>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
    [<ffffffff8159f11c>] collapse_file+0x13c/0x2730 mm/khugepaged.c:1725
    [<ffffffff815a1b28>] hpage_collapse_scan_file+0x418/0x9a0 mm/khugepaged.c:2156
    [<ffffffff815a4001>] madvise_collapse+0x211/0x5e0 mm/khugepaged.c:2611
    [<ffffffff8153ba2d>] madvise_vma_behavior+0x5dd/0x1030 mm/madvise.c:1076
    [<ffffffff81537257>] madvise_walk_vmas+0x127/0x1d0 mm/madvise.c:1250
    [<ffffffff81537eb0>] do_madvise.part.0+0x1c0/0x2b0 mm/madvise.c:1429
    [<ffffffff8153c6e8>] do_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __do_sys_madvise mm/madvise.c:1442 [inline]
    [<ffffffff8153c6e8>] __se_sys_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __x64_sys_madvise+0x98/0xa0 mm/madvise.c:1440
    [<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84608225>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810fd21480 (size 576):
  comm "syz-executor159", pid 3686, jiffies 4295064650 (age 50.150s)
  hex dump (first 32 bytes):
    00 07 00 00 00 00 00 00 c0 16 d2 0f 81 88 ff ff  ................
    20 85 98 0f 81 88 ff ff 98 14 d2 0f 81 88 ff ff   ...............
  backtrace:
    [<ffffffff844153c6>] xas_alloc+0xf6/0x120 lib/xarray.c:377
    [<ffffffff84418039>] xas_create+0x3b9/0x800 lib/xarray.c:679
    [<ffffffff84418520>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
    [<ffffffff8159f11c>] collapse_file+0x13c/0x2730 mm/khugepaged.c:1725
    [<ffffffff815a1b28>] hpage_collapse_scan_file+0x418/0x9a0 mm/khugepaged.c:2156
    [<ffffffff815a4001>] madvise_collapse+0x211/0x5e0 mm/khugepaged.c:2611
    [<ffffffff8153ba2d>] madvise_vma_behavior+0x5dd/0x1030 mm/madvise.c:1076
    [<ffffffff81537257>] madvise_walk_vmas+0x127/0x1d0 mm/madvise.c:1250
    [<ffffffff81537eb0>] do_madvise.part.0+0x1c0/0x2b0 mm/madvise.c:1429
    [<ffffffff8153c6e8>] do_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __do_sys_madvise mm/madvise.c:1442 [inline]
    [<ffffffff8153c6e8>] __se_sys_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __x64_sys_madvise+0x98/0xa0 mm/madvise.c:1440
    [<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84608225>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810fd21240 (size 576):
  comm "syz-executor159", pid 3686, jiffies 4295064650 (age 50.150s)
  hex dump (first 32 bytes):
    00 06 00 00 00 00 00 00 c0 16 d2 0f 81 88 ff ff  ................
    20 85 98 0f 81 88 ff ff 58 12 d2 0f 81 88 ff ff   .......X.......
  backtrace:
    [<ffffffff844153c6>] xas_alloc+0xf6/0x120 lib/xarray.c:377
    [<ffffffff84418039>] xas_create+0x3b9/0x800 lib/xarray.c:679
    [<ffffffff84418520>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
    [<ffffffff8159f11c>] collapse_file+0x13c/0x2730 mm/khugepaged.c:1725
    [<ffffffff815a1b28>] hpage_collapse_scan_file+0x418/0x9a0 mm/khugepaged.c:2156
    [<ffffffff815a4001>] madvise_collapse+0x211/0x5e0 mm/khugepaged.c:2611
    [<ffffffff8153ba2d>] madvise_vma_behavior+0x5dd/0x1030 mm/madvise.c:1076
    [<ffffffff81537257>] madvise_walk_vmas+0x127/0x1d0 mm/madvise.c:1250
    [<ffffffff81537eb0>] do_madvise.part.0+0x1c0/0x2b0 mm/madvise.c:1429
    [<ffffffff8153c6e8>] do_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __do_sys_madvise mm/madvise.c:1442 [inline]
    [<ffffffff8153c6e8>] __se_sys_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __x64_sys_madvise+0x98/0xa0 mm/madvise.c:1440
    [<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84608225>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810fd24d80 (size 576):
  comm "syz-executor159", pid 3686, jiffies 4295064650 (age 50.150s)
  hex dump (first 32 bytes):
    00 05 00 00 00 00 00 00 c0 16 d2 0f 81 88 ff ff  ................
    20 85 98 0f 81 88 ff ff 98 4d d2 0f 81 88 ff ff   ........M......
  backtrace:
    [<ffffffff844153c6>] xas_alloc+0xf6/0x120 lib/xarray.c:377
    [<ffffffff84418039>] xas_create+0x3b9/0x800 lib/xarray.c:679
    [<ffffffff84418520>] xas_create_range+0xa0/0x1c0 lib/xarray.c:719
    [<ffffffff8159f11c>] collapse_file+0x13c/0x2730 mm/khugepaged.c:1725
    [<ffffffff815a1b28>] hpage_collapse_scan_file+0x418/0x9a0 mm/khugepaged.c:2156
    [<ffffffff815a4001>] madvise_collapse+0x211/0x5e0 mm/khugepaged.c:2611
    [<ffffffff8153ba2d>] madvise_vma_behavior+0x5dd/0x1030 mm/madvise.c:1076
    [<ffffffff81537257>] madvise_walk_vmas+0x127/0x1d0 mm/madvise.c:1250
    [<ffffffff81537eb0>] do_madvise.part.0+0x1c0/0x2b0 mm/madvise.c:1429
    [<ffffffff8153c6e8>] do_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __do_sys_madvise mm/madvise.c:1442 [inline]
    [<ffffffff8153c6e8>] __se_sys_madvise mm/madvise.c:1440 [inline]
    [<ffffffff8153c6e8>] __x64_sys_madvise+0x98/0xa0 mm/madvise.c:1440
    [<ffffffff84608225>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84608225>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory