linux-kernel - Re: [syzbot] [can?] memory leak in j1939_netdev

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <6947a89e.a70a0220.25eec0.006f.GAE@google.com>
Date: Sat, 20 Dec 2025 23:58:22 -0800
From: syzbot <syzbot+1d37bef05da87b99c5a6@...kaller.appspotmail.com>
To: davem@...emloft.net, eadavis@...com, edumazet@...gle.com, 
	kernel@...gutronix.de, kuba@...nel.org, linux-can@...r.kernel.org, 
	linux-kernel@...r.kernel.org, mkl@...gutronix.de, n.zhandarovich@...tech.ru, 
	netdev@...r.kernel.org, o.rempel@...gutronix.de, pabeni@...hat.com, 
	robin@...tonic.nl, socketcan@...tkopp.net, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [can?] memory leak in j1939_netdev_start

syzbot has found a reproducer for the following issue on:

HEAD commit:    d8ba32c5a460 Merge tag 'block-6.19-20251218' of git://git...
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13989392580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=d60836e327fd6756
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=155c4358580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10d1777c580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/075f0ee95918/disk-d8ba32c5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8219d2472799/vmlinux-d8ba32c5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d07c95aef4d/bzImage-d8ba32c5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2fd2ba265dd2/mount_9.gz
  fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=105f562a580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d37bef05da87b99c5a6@...kaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88812437e000 (size 8192):
  comm "syz.3.27", pid 6191, jiffies 4294942739
  hex dump (first 32 bytes):
    00 e0 37 24 81 88 ff ff 00 e0 37 24 81 88 ff ff  ..7$......7$....
    00 00 00 00 00 00 00 00 00 80 67 14 81 88 ff ff  ..........g.....
  backtrace (crc 9710eadb):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x160/0x6f0 net/can/j1939/main.c:268
    j1939_sk_bind+0x247/0x590 net/can/j1939/socket.c:504
    __sys_bind_socket net/socket.c:1874 [inline]
    __sys_bind_socket net/socket.c:1866 [inline]
    __sys_bind+0x132/0x160 net/socket.c:1905
    __do_sys_bind net/socket.c:1910 [inline]
    __se_sys_bind net/socket.c:1908 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1908
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810cc00e00 (size 240):
  comm "softirq", pid 0, jiffies 4294942739
  hex dump (first 32 bytes):
    68 8a 63 24 81 88 ff ff 68 8a 63 24 81 88 ff ff  h.c$....h.c$....
    00 80 67 14 81 88 ff ff 00 00 00 00 00 00 00 00  ..g.............
  backtrace (crc 467a0d54):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    __alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
    alloc_skb include/linux/skbuff.h:1383 [inline]
    j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
    j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
    j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
    j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
    j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
    j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
    deliver net/can/af_can.c:575 [inline]
    can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
    can_receive+0xf0/0x140 net/can/af_can.c:666
    can_rcv+0xf6/0x130 net/can/af_can.c:690
    __netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
    __netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
    process_backlog+0xd5/0x1e0 net/core/dev.c:6602
    __napi_poll+0x44/0x3a0 net/core/dev.c:7666
    napi_poll net/core/dev.c:7729 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7881
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
    sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056

BUG: memory leak
unreferenced object 0xffff88810a549e40 (size 704):
  comm "softirq", pid 0, jiffies 4294942739
  hex dump (first 32 bytes):
    0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc fd324075):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
    j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
    j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
    j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
    j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
    j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
    deliver net/can/af_can.c:575 [inline]
    can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
    can_receive+0xf0/0x140 net/can/af_can.c:666
    can_rcv+0xf6/0x130 net/can/af_can.c:690
    __netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
    __netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
    process_backlog+0xd5/0x1e0 net/core/dev.c:6602
    __napi_poll+0x44/0x3a0 net/core/dev.c:7666
    napi_poll net/core/dev.c:7729 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7881
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723

BUG: memory leak
unreferenced object 0xffff888124638a00 (size 512):
  comm "softirq", pid 0, jiffies 4294942739
  hex dump (first 32 bytes):
    00 e0 37 24 81 88 ff ff 28 f0 37 24 81 88 ff ff  ..7$....(.7$....
    28 f0 37 24 81 88 ff ff 18 8a 63 24 81 88 ff ff  (.7$......c$....
  backtrace (crc 965e5f06):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    j1939_session_new+0x55/0x1d0 net/can/j1939/transport.c:1495
    j1939_session_fresh_new net/can/j1939/transport.c:1543 [inline]
    j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
    j1939_xtp_rx_rts+0x47a/0xb30 net/can/j1939/transport.c:1751
    j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
    j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
    j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
    deliver net/can/af_can.c:575 [inline]
    can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
    can_receive+0xf0/0x140 net/can/af_can.c:666
    can_rcv+0xf6/0x130 net/can/af_can.c:690
    __netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
    __netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
    process_backlog+0xd5/0x1e0 net/core/dev.c:6602
    __napi_poll+0x44/0x3a0 net/core/dev.c:7666
    napi_poll net/core/dev.c:7729 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7881
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
    sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.