linux-kernel - Re: [syzbot] [can?] memory leak in j1939_netdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 19 Jan 2024 06:23:04 -0800
From: syzbot <syzbot+1d37bef05da87b99c5a6@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, n.zhandarovich@...tech.ru, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [can?] memory leak in j1939_netdev_start

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in corrupted

BUG: memory leak
unreferenced object 0xffff88812162e000 (size 8192):
  comm "syz-executor.2", pid 5912, jiffies 4294946210
  hex dump (first 32 bytes):
    00 e0 62 21 81 88 ff ff 00 e0 62 21 81 88 ff ff  ..b!......b!....
    00 00 00 00 00 00 00 00 00 00 36 1c 81 88 ff ff  ..........6.....
  backtrace (crc bbd5015e):
    [<ffffffff815fa6f3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff815fa6f3>] slab_post_alloc_hook mm/slub.c:3817 [inline]
    [<ffffffff815fa6f3>] slab_alloc_node mm/slub.c:3860 [inline]
    [<ffffffff815fa6f3>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
    [<ffffffff8457ddd9>] kmalloc include/linux/slab.h:590 [inline]
    [<ffffffff8457ddd9>] kzalloc include/linux/slab.h:711 [inline]
    [<ffffffff8457ddd9>] j1939_priv_create net/can/j1939/main.c:135 [inline]
    [<ffffffff8457ddd9>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
    [<ffffffff8457fa1e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485
    [<ffffffff83efe59c>] __sys_bind+0x11c/0x130 net/socket.c:1847
    [<ffffffff83efe5cc>] __do_sys_bind net/socket.c:1858 [inline]
    [<ffffffff83efe5cc>] __se_sys_bind net/socket.c:1856 [inline]
    [<ffffffff83efe5cc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1856
    [<ffffffff84bb9910>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
    [<ffffffff84bb9910>] do_syscall_64+0x50/0x140 arch/x86/entry/common.c:83
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b

BUG: memory leak
unreferenced object 0xffff888122a49d00 (size 240):
  comm "softirq", pid 0, jiffies 4294946210
  hex dump (first 32 bytes):
    68 4c a6 21 81 88 ff ff 68 4c a6 21 81 88 ff ff  hL.!....hL.!....
    00 00 36 1c 81 88 ff ff 00 00 00 00 00 00 00 00  ..6.............
  backtrace (crc d6a71e41):
    [<ffffffff815f9b9a>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff815f9b9a>] slab_post_alloc_hook mm/slub.c:3817 [inline]
    [<ffffffff815f9b9a>] slab_alloc_node mm/slub.c:3860 [inline]
    [<ffffffff815f9b9a>] kmem_cache_alloc_node+0x28a/0x330 mm/slub.c:3903
    [<ffffffff83f11f5f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
    [<ffffffff8458699f>] alloc_skb include/linux/skbuff.h:1296 [inline]
    [<ffffffff8458699f>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
    [<ffffffff8458699f>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
    [<ffffffff8458699f>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
    [<ffffffff84587455>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
    [<ffffffff84587455>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
    [<ffffffff8457d9a9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
    [<ffffffff8456e3f4>] deliver net/can/af_can.c:572 [inline]
    [<ffffffff8456e3f4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
    [<ffffffff8456eab0>] can_receive+0xf0/0x140 net/can/af_can.c:663
    [<ffffffff8456ebf0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
    [<ffffffff83f4a976>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
    [<ffffffff83f4a9ed>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
    [<ffffffff83f4ad4c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
    [<ffffffff83f4bede>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
    [<ffffffff83f4c8f8>] napi_poll net/core/dev.c:6645 [inline]
    [<ffffffff83f4c8f8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
    [<ffffffff84bd799d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553

BUG: memory leak
unreferenced object 0xffff888122f20000 (size 131072):
  comm "softirq", pid 0, jiffies 4294946210
  hex dump (first 32 bytes):
    0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc f7abe560):
    [<ffffffff815f313e>] __kmalloc_large_node+0xde/0x150 mm/slub.c:3935
    [<ffffffff815f8f8f>] __do_kmalloc_node mm/slub.c:3969 [inline]
    [<ffffffff815f8f8f>] __kmalloc_node_track_caller+0x35f/0x420 mm/slub.c:4001
    [<ffffffff83f0e1b6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
    [<ffffffff83f11e45>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
    [<ffffffff8458699f>] alloc_skb include/linux/skbuff.h:1296 [inline]
    [<ffffffff8458699f>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
    [<ffffffff8458699f>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
    [<ffffffff8458699f>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
    [<ffffffff84587455>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
    [<ffffffff84587455>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
    [<ffffffff8457d9a9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
    [<ffffffff8456e3f4>] deliver net/can/af_can.c:572 [inline]
    [<ffffffff8456e3f4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
    [<ffffffff8456eab0>] can_receive+0xf0/0x140 net/can/af_can.c:663
    [<ffffffff8456ebf0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
    [<ffffffff83f4a976>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
    [<ffffffff83f4a9ed>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
    [<ffffffff83f4ad4c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
    [<ffffffff83f4bede>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
    [<ffffffff83f4c8f8>] napi_poll net/core/dev.c:6645 [inline]
    [<ffffffff83f4c8f8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
    [<ffffffff84bd799d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553

BUG: memory leak
unreferenced object 0xffff888121a64c00 (size 512):
  comm "softirq", pid 0, jiffies 4294946210
  hex dump (first 32 bytes):
    00 e0 62 21 81 88 ff ff 28 f0 62 21 81 88 ff ff  ..b!....(.b!....
    28 f0 62 21 81 88 ff ff 18 4c a6 21 81 88 ff ff  (.b!.....L.!....
  backtrace (crc 5752fd94):
    [<ffffffff815fa6f3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff815fa6f3>] slab_post_alloc_hook mm/slub.c:3817 [inline]
    [<ffffffff815fa6f3>] slab_alloc_node mm/slub.c:3860 [inline]
    [<ffffffff815fa6f3>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
    [<ffffffff84581a13>] kmalloc include/linux/slab.h:590 [inline]
    [<ffffffff84581a13>] kzalloc include/linux/slab.h:711 [inline]
    [<ffffffff84581a13>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494
    [<ffffffff84586a35>] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline]
    [<ffffffff84586a35>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
    [<ffffffff84586a35>] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735
    [<ffffffff84587455>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
    [<ffffffff84587455>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
    [<ffffffff8457d9a9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
    [<ffffffff8456e3f4>] deliver net/can/af_can.c:572 [inline]
    [<ffffffff8456e3f4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
    [<ffffffff8456eab0>] can_receive+0xf0/0x140 net/can/af_can.c:663
    [<ffffffff8456ebf0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
    [<ffffffff83f4a976>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
    [<ffffffff83f4a9ed>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
    [<ffffffff83f4ad4c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
    [<ffffffff83f4bede>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
    [<ffffffff83f4c8f8>] napi_poll net/core/dev.c:6645 [inline]
    [<ffffffff83f4c8f8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
    [<ffffffff84bd799d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553



Tested on:

commit:         9d1694dc Merge tag 'for-6.8/block-2024-01-18' of git:/..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17efd763e80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=447c03a4f5a8d571
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

Note: no patches were applied.