netdev - tipc: memory leak in tipc_nl_node_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Tue, 9 Jan 2018 19:01:39 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Jon Maloy <jon.maloy@...csson.com>,
        Ying Xue <ying.xue@...driver.com>,
        David Miller <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>,
        tipc-discussion@...ts.sourceforge.net,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller <syzkaller@...glegroups.com>
Subject: tipc: memory leak in tipc_nl_node_get_link

Hello,

syzkaller has hit the following memory leak on 4.15-rc7.
It seems that tipc_nl_node_get_link() fails to free the skb when
tipc_node_find_by_name() fails.

5:58:28 KMEMLEAK READ1 1071
[  386.810943] kmemleak: 2 new suspected memory leaks, 0 unleaked (see
/sys/kernel/debug/kmemleak)
2018/01/09 15:58:31 KMEMLEAK READ2 2225
2018/01/09 15:58:31 BUG: memory leak
eferenced object 0xffff88002a782280 (size 232):
  comm "syz-executor2", pid 6844, jiffies 4295044059 (age 10.220s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000c914c2d7>] kmemleak_alloc_recursive
include/linux/kmemleak.h:55 [inline]
    [<00000000c914c2d7>] slab_post_alloc_hook mm/slab.h:440 [inline]
    [<00000000c914c2d7>] slab_alloc_node mm/slub.c:2725 [inline]
    [<00000000c914c2d7>] kmem_cache_alloc_node+0x12d/0x2a0 mm/slub.c:2761
    [<000000007ed8c8b5>] __alloc_skb+0x103/0x7c0 net/core/skbuff.c:193
    [<0000000023449dd8>] nlmsg_new include/linux/skbuff.h:983 [inline]
    [<0000000023449dd8>] tipc_nl_node_get_link+0x1d4/0x6b0 net/tipc/node.c:1877
    [<0000000019b652e1>] genl_family_rcv_msg+0x881/0x1110
net/netlink/genetlink.c:599
    [<000000009c0a85f1>] genl_rcv_msg+0xc6/0x170 net/netlink/genetlink.c:624
    [<00000000052c4d51>] netlink_rcv_skb+0x275/0x550
net/netlink/af_netlink.c:2408
    [<00000000d5ae339c>] genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
    [<000000004cb4e55b>] netlink_unicast_kernel
net/netlink/af_netlink.c:1275 [inline]
    [<000000004cb4e55b>] netlink_unicast+0x567/0x710
net/netlink/af_netlink.c:1301
    [<00000000bc52e4f5>] netlink_sendmsg+0x9c4/0xf60
net/netlink/af_netlink.c:1864
    [<00000000cc6816f5>] sock_sendmsg_nosec net/socket.c:636 [inline]
    [<00000000cc6816f5>] sock_sendmsg+0xd2/0x120 net/socket.c:646
    [<00000000db8490cd>] ___sys_sendmsg+0x7f6/0x930 net/socket.c:2026
    [<0000000097919974>] __sys_sendmsg+0xe6/0x220 net/socket.c:2060
    [<000000000334a861>] SYSC_sendmsg net/socket.c:2071 [inline]
    [<000000000334a861>] SyS_sendmsg+0x36/0x60 net/socket.c:2067
    [<0000000008a3e08e>] entry_SYSCALL_64_fastpath+0x23/0x9a
    [<0000000094cce38d>] 0xffffffffffffffff

2018/01/09 15:58:31 BUG: memory leak
unreferenced object 0xffff880017894200 (size 8192):
  comm "syz-executor2", pid 6844, jiffies 4295044059 (age 10.233s)
  hex dump (first 32 bytes):
    00 21 89 17 00 88 ff ff 00 00 00 00 00 00 00 00  .!..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000b0c26949>] kmemleak_alloc_recursive
include/linux/kmemleak.h:55 [inline]
    [<00000000b0c26949>] slab_post_alloc_hook mm/slab.h:440 [inline]
    [<00000000b0c26949>] slab_alloc_node mm/slub.c:2725 [inline]
    [<00000000b0c26949>] __kmalloc_node_track_caller+0x19f/0x360 mm/slub.c:4320
    [<0000000061c65883>] __kmalloc_reserve.isra.39+0x3a/0xe0
net/core/skbuff.c:137
    [<00000000dba6a120>] __alloc_skb+0x144/0x7c0 net/core/skbuff.c:205
    [<0000000023449dd8>] nlmsg_new include/linux/skbuff.h:983 [inline]
    [<0000000023449dd8>] tipc_nl_node_get_link+0x1d4/0x6b0 net/tipc/node.c:1877
    [<0000000019b652e1>] genl_family_rcv_msg+0x881/0x1110
net/netlink/genetlink.c:599
    [<000000009c0a85f1>] genl_rcv_msg+0xc6/0x170 net/netlink/genetlink.c:624
    [<00000000052c4d51>] netlink_rcv_skb+0x275/0x550
net/netlink/af_netlink.c:2408
    [<00000000d5ae339c>] genl_rcv+0x28/0x40 net/netlink/genetlink.c:635
    [<000000004cb4e55b>] netlink_unicast_kernel
net/netlink/af_netlink.c:1275 [inline]
    [<000000004cb4e55b>] netlink_unicast+0x567/0x710
net/netlink/af_netlink.c:1301
    [<00000000bc52e4f5>] netlink_sendmsg+0x9c4/0xf60
net/netlink/af_netlink.c:1864
    [<00000000cc6816f5>] sock_sendmsg_nosec net/socket.c:636 [inline]
    [<00000000cc6816f5>] sock_sendmsg+0xd2/0x120 net/socket.c:646
    [<00000000db8490cd>] ___sys_sendmsg+0x7f6/0x930 net/socket.c:2026
    [<0000000097919974>] __sys_sendmsg+0xe6/0x220 net/socket.c:2060
    [<000000000334a861>] SYSC_sendmsg net/socket.c:2071 [inline]
    [<000000000334a861>] SyS_sendmsg+0x36/0x60 net/socket.c:2067
    [<0000000008a3e08e>] entry_SYSCALL_64_fastpath+0x23/0x9a
    [<0000000094cce38d>] 0xffffffffffffffff