[Linux Kernel Bug] memory leak in posix_clock_open

From: Chenyuan Yang
Date: Wed Jan 24 2024 - 11:23:26 EST


Dear Linux Developers for Posix Timer,

We encountered "memory leak in posix_clock_open" when testing the
posix timer with
Syzkaller and our generated specifications.

```
BUG: memory leak
unreferenced object 0xffff888000f66fa0 (size 16):
comm "syz-executor.0", pid 21073, jiffies 4295079945 (age 8.800s)
hex dump (first 16 bytes):
00 b8 d6 0d 80 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8162788a>] kmemleak_alloc_recursive
include/linux/kmemleak.h:42 [inline]
[<ffffffff8162788a>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff8162788a>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff8162788a>] __kmem_cache_alloc_node+0x2fa/0x3e0 mm/slub.c:3517
[<ffffffff81572354>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1098
[<ffffffff81388b0e>] kmalloc include/linux/slab.h:600 [inline]
[<ffffffff81388b0e>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff81388b0e>] posix_clock_open+0x5e/0xe0
kernel/time/posix-clock.c:126
[<ffffffff81692d69>] chrdev_open+0x119/0x340 fs/char_dev.c:414
[<ffffffff81680706>] do_dentry_open+0x336/0x9e0 fs/open.c:948
[<ffffffff816a9659>] do_open fs/namei.c:3622 [inline]
[<ffffffff816a9659>] path_openat+0x1799/0x1b00 fs/namei.c:3779
[<ffffffff816aa5ce>] do_filp_open+0xce/0x1b0 fs/namei.c:3809
[<ffffffff816843ed>] do_sys_openat2+0xdd/0x130 fs/open.c:1440
[<ffffffff81684d53>] do_sys_open fs/open.c:1455 [inline]
[<ffffffff81684d53>] __do_sys_openat fs/open.c:1471 [inline]
[<ffffffff81684d53>] __se_sys_openat fs/open.c:1466 [inline]
[<ffffffff81684d53>] __x64_sys_openat+0x83/0xe0 fs/open.c:1466
[<ffffffff84ae676f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84ae676f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b

BUG: leak checking failed
```
I have attached the reproducible C program and its configuration for
this crash. Please note that the C program has not been minimized
because there were issues with syz-repro.

For this memory leak, it seems that the `pccontext` allocated by
kzalloc (https://elixir.bootlin.com/linux/v6.7/source/kernel/time/posix-clock.c#L126)
is not released correctly.

If you have any questions or require more information, please feel
free to contact us.

Reported-by: Chenyuan Yang <chenyuan0y@xxxxxxxxx>

Best,
Chenyuan

Attachment: repro.c
Description: Binary data

Attachment: report
Description: Binary data

Attachment: config
Description: Binary data