linux-kernel - [syzbot] [batman?] memory leak in skb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <0000000000007caf3b0603f28d71@google.com>
Date:   Sun, 27 Aug 2023 19:35:50 -0700
From:   syzbot <syzbot+92f9b5fba2df252a3569@...kaller.appspotmail.com>
To:     a@...table.cc, b.a.t.m.a.n@...ts.open-mesh.org,
        davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        linux-kernel@...r.kernel.org, mareklindner@...mailbox.ch,
        netdev@...r.kernel.org, pabeni@...hat.com, sven@...fation.org,
        sw@...onwunderlich.de, syzkaller-bugs@...glegroups.com
Subject: [syzbot] [batman?] memory leak in skb_clone (2)

Hello,

syzbot found the following issue on:

HEAD commit:    a5e505a99ca7 Merge tag 'platform-drivers-x86-v6.5-5' of gi..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15eea3e3a80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f3c65e06397a9d58
dashboard link: https://syzkaller.appspot.com/bug?extid=92f9b5fba2df252a3569
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=13597f90680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c534ce48946f/disk-a5e505a9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/724bbdaa3992/vmlinux-a5e505a9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/47fba0663891/bzImage-a5e505a9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+92f9b5fba2df252a3569@...kaller.appspotmail.com

2023/08/24 02:03:48 executed programs: 322
2023/08/24 02:03:54 executed programs: 337
BUG: memory leak
unreferenced object 0xffff888120ea2600 (size 240):
  comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
  hex dump (first 32 bytes):
    00 22 e3 20 81 88 ff ff 00 00 00 00 00 00 00 00  .". ............
    00 80 ed 1c 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860
    [<ffffffff8499f31f>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline]
    [<ffffffff8499f31f>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
    [<ffffffff8499f31f>] batadv_iv_send_outstanding_bat_ogm_packet+0x2ef/0x370 net/batman-adv/bat_iv_ogm.c:1700
    [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
    [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
    [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
    [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
    [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

BUG: memory leak
unreferenced object 0xffff888120f36c00 (size 1024):
  comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81554a79>] __do_kmalloc_node mm/slab_common.c:984 [inline]
    [<ffffffff81554a79>] __kmalloc_node_track_caller+0x49/0x140 mm/slab_common.c:1005
    [<ffffffff83e54735>] kmalloc_reserve+0x95/0x180 net/core/skbuff.c:575
    [<ffffffff83e5c6c8>] pskb_expand_head+0xd8/0x5f0 net/core/skbuff.c:2042
    [<ffffffff849ccbef>] __skb_cow include/linux/skbuff.h:3571 [inline]
    [<ffffffff849ccbef>] skb_cow_head include/linux/skbuff.h:3605 [inline]
    [<ffffffff849ccbef>] batadv_skb_head_push+0x8f/0x110 net/batman-adv/soft-interface.c:72
    [<ffffffff849ca643>] batadv_send_skb_packet+0x83/0x1c0 net/batman-adv/send.c:86
    [<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
    [<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
    [<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700
    [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
    [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
    [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
    [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
    [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

BUG: memory leak
unreferenced object 0xffff888120ea2000 (size 240):
  comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
  hex dump (first 32 bytes):
    00 28 ea 20 81 88 ff ff 00 00 00 00 00 00 00 00  .(. ............
    00 80 ec 1c 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860
    [<ffffffff83f88552>] netem_enqueue+0xc62/0x1430 net/sched/sch_netem.c:479
    [<ffffffff83e80975>] dev_qdisc_enqueue+0x25/0xf0 net/core/dev.c:3732
    [<ffffffff83e8b217>] __dev_xmit_skb net/core/dev.c:3821 [inline]
    [<ffffffff83e8b217>] __dev_queue_xmit+0xdc7/0x17d0 net/core/dev.c:4169
    [<ffffffff849ca710>] dev_queue_xmit include/linux/netdevice.h:3088 [inline]
    [<ffffffff849ca710>] batadv_send_skb_packet+0x150/0x1c0 net/batman-adv/send.c:108
    [<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
    [<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
    [<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700
    [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
    [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
    [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
    [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
    [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup