netdev - [syzbot] memory leak in ath9k_hif_usb_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date:   Sun, 18 Dec 2022 19:40:45 -0800
From:   syzbot <syzbot+e9632e3eb038d93d6bc6@...kaller.appspotmail.com>
To:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        kvalo@...nel.org, linux-kernel@...r.kernel.org,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        pabeni@...hat.com, syzkaller-bugs@...glegroups.com, toke@...e.dk
Subject: [syzbot] memory leak in ath9k_hif_usb_rx_cb

Hello,

syzbot found the following issue on:

HEAD commit:    6f1f5caed5bf Merge tag 'for-linus-6.2-ofs1' of git://git.k..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11a5aa57880000
kernel config:  https://syzkaller.appspot.com/x/.config?x=aa9d05fc5567240b
dashboard link: https://syzkaller.appspot.com/bug?extid=e9632e3eb038d93d6bc6
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1138a5c0480000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10d07e77880000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e0b09490fc5c/disk-6f1f5cae.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2f00e5ef8dce/vmlinux-6f1f5cae.xz
kernel image: https://storage.googleapis.com/syzbot-assets/78f4c439075f/bzImage-6f1f5cae.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e9632e3eb038d93d6bc6@...kaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888101f97700 (size 240):
  comm "softirq", pid 0, jiffies 4294945988 (age 15.200s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83ac0212>] __alloc_skb+0x202/0x270 net/core/skbuff.c:552
    [<ffffffff83ac396a>] __netdev_alloc_skb+0x6a/0x220 net/core/skbuff.c:630
    [<ffffffff82df70d0>] __dev_alloc_skb include/linux/skbuff.h:3165 [inline]
    [<ffffffff82df70d0>] ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline]
    [<ffffffff82df70d0>] ath9k_hif_usb_rx_cb+0x1d0/0x660 drivers/net/wireless/ath/ath9k/hif_usb.c:686
    [<ffffffff82fd9d89>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1671
    [<ffffffff82fda06b>] usb_hcd_giveback_urb+0x1ab/0x1c0 drivers/usb/core/hcd.c:1754
    [<ffffffff8318c0b4>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
    [<ffffffff81328243>] call_timer_fn+0x33/0x1f0 kernel/time/timer.c:1700
    [<ffffffff813284ff>] expire_timers+0xff/0x1d0 kernel/time/timer.c:1751
    [<ffffffff813286f9>] __run_timers kernel/time/timer.c:2022 [inline]
    [<ffffffff813286f9>] __run_timers kernel/time/timer.c:1995 [inline]
    [<ffffffff813286f9>] run_timer_softirq+0x129/0x2f0 kernel/time/timer.c:2035
    [<ffffffff84c000eb>] __do_softirq+0xeb/0x2ef kernel/softirq.c:571
    [<ffffffff8126a086>] invoke_softirq kernel/softirq.c:445 [inline]
    [<ffffffff8126a086>] __irq_exit_rcu+0xc6/0x110 kernel/softirq.c:650
    [<ffffffff848a7742>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1107
    [<ffffffff84a00cc6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
    [<ffffffff848bd6e9>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
    [<ffffffff848bd6e9>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
    [<ffffffff848bd6e9>] acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
    [<ffffffff848bd6e9>] acpi_idle_do_entry+0xc9/0xe0 drivers/acpi/processor_idle.c:570
    [<ffffffff848bdc00>] acpi_idle_enter+0x150/0x230 drivers/acpi/processor_idle.c:707
    [<ffffffff83699eb4>] cpuidle_enter_state+0xc4/0x740 drivers/cpuidle/cpuidle.c:239

BUG: memory leak
unreferenced object 0xffff88810c312800 (size 1024):
  comm "softirq", pid 0, jiffies 4294945988 (age 15.200s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff814f6467>] __do_kmalloc_node mm/slab_common.c:967 [inline]
    [<ffffffff814f6467>] __kmalloc_node_track_caller+0x47/0x120 mm/slab_common.c:988
    [<ffffffff83ac00f1>] kmalloc_reserve net/core/skbuff.c:492 [inline]
    [<ffffffff83ac00f1>] __alloc_skb+0xe1/0x270 net/core/skbuff.c:565
    [<ffffffff83ac396a>] __netdev_alloc_skb+0x6a/0x220 net/core/skbuff.c:630
    [<ffffffff82df70d0>] __dev_alloc_skb include/linux/skbuff.h:3165 [inline]
    [<ffffffff82df70d0>] ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline]
    [<ffffffff82df70d0>] ath9k_hif_usb_rx_cb+0x1d0/0x660 drivers/net/wireless/ath/ath9k/hif_usb.c:686
    [<ffffffff82fd9d89>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1671
    [<ffffffff82fda06b>] usb_hcd_giveback_urb+0x1ab/0x1c0 drivers/usb/core/hcd.c:1754
    [<ffffffff8318c0b4>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
    [<ffffffff81328243>] call_timer_fn+0x33/0x1f0 kernel/time/timer.c:1700
    [<ffffffff813284ff>] expire_timers+0xff/0x1d0 kernel/time/timer.c:1751
    [<ffffffff813286f9>] __run_timers kernel/time/timer.c:2022 [inline]
    [<ffffffff813286f9>] __run_timers kernel/time/timer.c:1995 [inline]
    [<ffffffff813286f9>] run_timer_softirq+0x129/0x2f0 kernel/time/timer.c:2035
    [<ffffffff84c000eb>] __do_softirq+0xeb/0x2ef kernel/softirq.c:571
    [<ffffffff8126a086>] invoke_softirq kernel/softirq.c:445 [inline]
    [<ffffffff8126a086>] __irq_exit_rcu+0xc6/0x110 kernel/softirq.c:650
    [<ffffffff848a7742>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1107
    [<ffffffff84a00cc6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
    [<ffffffff848bd6e9>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
    [<ffffffff848bd6e9>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
    [<ffffffff848bd6e9>] acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
    [<ffffffff848bd6e9>] acpi_idle_do_entry+0xc9/0xe0 drivers/acpi/processor_idle.c:570
    [<ffffffff848bdc00>] acpi_idle_enter+0x150/0x230 drivers/acpi/processor_idle.c:707

BUG: memory leak
unreferenced object 0xffff888101f97500 (size 240):
  comm "softirq", pid 0, jiffies 4294945988 (age 15.200s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83ac0212>] __alloc_skb+0x202/0x270 net/core/skbuff.c:552
    [<ffffffff83ac396a>] __netdev_alloc_skb+0x6a/0x220 net/core/skbuff.c:630
    [<ffffffff82df70d0>] __dev_alloc_skb include/linux/skbuff.h:3165 [inline]
    [<ffffffff82df70d0>] ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline]
    [<ffffffff82df70d0>] ath9k_hif_usb_rx_cb+0x1d0/0x660 drivers/net/wireless/ath/ath9k/hif_usb.c:686
    [<ffffffff82fd9d89>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1671
    [<ffffffff82fda06b>] usb_hcd_giveback_urb+0x1ab/0x1c0 drivers/usb/core/hcd.c:1754
    [<ffffffff8318c0b4>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988
    [<ffffffff81328243>] call_timer_fn+0x33/0x1f0 kernel/time/timer.c:1700
    [<ffffffff813284ff>] expire_timers+0xff/0x1d0 kernel/time/timer.c:1751
    [<ffffffff813286f9>] __run_timers kernel/time/timer.c:2022 [inline]
    [<ffffffff813286f9>] __run_timers kernel/time/timer.c:1995 [inline]
    [<ffffffff813286f9>] run_timer_softirq+0x129/0x2f0 kernel/time/timer.c:2035
    [<ffffffff84c000eb>] __do_softirq+0xeb/0x2ef kernel/softirq.c:571
    [<ffffffff8126a086>] invoke_softirq kernel/softirq.c:445 [inline]
    [<ffffffff8126a086>] __irq_exit_rcu+0xc6/0x110 kernel/softirq.c:650
    [<ffffffff848a7742>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1107
    [<ffffffff84a00cc6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
    [<ffffffff848bd6e9>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
    [<ffffffff848bd6e9>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
    [<ffffffff848bd6e9>] acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
    [<ffffffff848bd6e9>] acpi_idle_do_entry+0xc9/0xe0 drivers/acpi/processor_idle.c:570
    [<ffffffff848bdc00>] acpi_idle_enter+0x150/0x230 drivers/acpi/processor_idle.c:707
    [<ffffffff83699eb4>] cpuidle_enter_state+0xc4/0x740 drivers/cpuidle/cpuidle.c:239



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches