[PATCH] audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe_worker()

[Peilin Ye]

Hi,

On Wed, Aug 03, 2022 at 03:28:19PM -0400, Paul Moore wrote:
> On Wed, Aug 3, 2022 at 9:16 AM Paul Moore <paul at paul-moore.com> wrote:
> > On Wed, Aug 3, 2022 at 1:03 AM Peilin Ye <yepeilin.cs at gmail.com> wrote:
> > > Hi all,
> > >
> > > A better way to fix this memleak would probably be checking
> > > @args->io_thread in copy_process()?  Something like:
> > >
> > >     if (args->io_thread)
> > >         retval = audit_alloc_kernel();
> > >     else
> > >         retval = audit_alloc();
> > >
> > > But I didn't want to add another if to copy_process() for this bugfix.
> > > Please suggest, thanks!
> >
> > Thanks for the report and patch!  I'll take a closer look at this
> > today and get back to you.
> 
> I think the best solution to this is simply to remove the calls to
> audit_alloc_kernel() in the io_uring and io-wq code, as well as the
> audit_alloc_kernel() function itself.  As long as create_io_thread()
> ends up calling copy_process to create the new kernel thread the
> audit_context should be allocated correctly.  Peilin Ye, are you able
> to draft a patch to do that and give it a test?

Sure, I will write a v2 today.  Thanks for the suggestion!

> For those that may be wondering how this happened (I definitely was!),
> it looks like when I first started working on the LSM/audit support
> for io_uring it was before the v5.12-rc1 release when
> create_io_thread() was introduced.  Prior to create_io_thread() it
> appears that io_uring/io-wq wasn't calling into copy_process() and
> thus was not getting an audit_context allocated in the kernel thread's
> task_struct; the solution for those original development drafts was to
> add a call to a new audit_alloc_kernel() which would handle the
> audit_context allocation.  Unfortunately, I didn't notice the move to
> create_io_thread() during development and the redundant
> audit_alloc_kernel() calls remained :/

Thanks,
Peilin Ye