Re: [PATCH] audit, io_uring, io-wq: Fix memory leak in io_sq_thread() and io_wqe_worker()

On Wed, Aug 3, 2022 at 9:16 AM Paul Moore <paul(a)paul-moore.com&gt; wrote: > On Wed, Aug 3, 2022 at 1:03 AM Peilin Ye <yepeilin.cs(a)gmail.com&gt; wrote: > > Hi all, > > > > A better way to fix this memleak would probably be checking > > @args->io_thread in copy_process()? Something like: > > > > if (args->io_thread) > > retval = audit_alloc_kernel(); > > else > > retval = audit_alloc(); > > > > But I didn't want to add another if to copy_process() for this bugfix. > > Please suggest, thanks! > > Thanks for the report and patch! I'll take a closer look at this > today and get back to you. I think the best solution to this is simply to remove the calls to audit_alloc_kernel() in the io_uring and io-wq code, as well as the audit_alloc_kernel() function itself. As long as create_io_thread() ends up calling copy_process to create the new kernel thread the audit_context should be allocated correctly. Peilin Ye, are you able to draft a patch to do that and give it a test?

For those that may be wondering how this happened (I definitely was!), it looks like when I first started working on the LSM/audit support for io_uring it was before the v5.12-rc1 release when create_io_thread() was introduced. Prior to create_io_thread() it appears that io_uring/io-wq wasn't calling into copy_process() and thus was not getting an audit_context allocated in the kernel thread's task_struct; the solution for those original development drafts was to add a call to a new audit_alloc_kernel() which would handle the audit_context allocation. Unfortunately, I didn't notice the move to create_io_thread() during development and the redundant audit_alloc_kernel() calls remained :/