* [syzbot] [net?] memory leak in build_skb
@ 2026-10-30 3:34 syzbot
2026-10-30 8:25 ` Eric Dumazet
0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2026-10-30 3:34 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, jasowangio, kuba, linux-kernel,
netdev, pabeni, syzkaller-bugs, willemdebruijn.kernel
Hello,
syzbot found the following issue on:
HEAD commit: 65ba8f34ec88 Merge tag 'xtensa-20261027' of https://github..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1592353e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=fbf447a1375a1948
dashboard link: https://syzkaller.appspot.com/bug?extid=a3f21220cbbb6e14ee2e
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=142ee469580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b4e738ce5f2b/disk-65ba8f34.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1de9d1ecbbb6/vmlinux-65ba8f34.xz
kernel image: https://storage.googleapis.com/syzbot-assets/8a3d79b65181/bzImage-65ba8f34.xz
AI-generated root cause summary:
In IPsec IP-TFS (XFRM_MODE_IPTFS) processing, when inner packets (including the
reused outer skb) are parsed and added to a temporary local 'sublist' during
__input_process_payload(), any error encountering invalid header data or
truncated payload jumps to 'done:'. At 'done:', packets on 'sublist' are neither
delivered nor freed, and the reused outer skb is neither placed in 'defer' nor
freed by kfree_skb(), permanently leaking the sk_buff and its attached sec_path
extension.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=a3f21220cbbb6e14ee2e
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com
2026/10/28 09:56:01 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888104c73c00 (size 240):
comm "syz.0.17", pid 5970, jiffies 4294947974
hex dump (first 32 bytes):
90 38 1f 02 00 c9 ff ff 90 38 1f 02 00 c9 ff ff .8.......8......
00 00 6a 24 81 88 ff ff 00 00 00 00 00 00 00 00 ..j$............
backtrace (crc 84fdfeb5):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047
__build_skb net/core/skbuff.c:495 [inline]
build_skb+0x25/0x120 net/core/skbuff.c:511
__tun_build_skb drivers/net/tun.c:1631 [inline]
tun_build_skb+0x489/0x770 drivers/net/tun.c:1726
tun_get_user+0xd2e/0x2040 drivers/net/tun.c:1860
tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:2100
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x3ae/0x720 fs/read_write.c:687
ksys_write+0xa5/0x170 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888104d139c0 (size 192):
comm "syz.0.17", pid 5970, jiffies 4294947974
hex dump (first 32 bytes):
01 00 00 00 00 02 00 00 00 00 0b 00 00 00 00 00 ................
80 9f 7b 24 81 88 ff ff 00 00 00 00 00 00 00 00 ..{$............
backtrace (crc 420634a7):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047
__skb_ext_alloc+0x1a/0x50 net/core/skbuff.c:7246
skb_ext_add+0x1a6/0x280 net/core/skbuff.c:7350
secpath_set+0x7c/0xc0 net/xfrm/xfrm_input.c:127
xfrm_input+0x381/0x28a0 net/xfrm/xfrm_input.c:571
vti_input+0xf4/0x160 net/ipv4/ip_vti.c:69
xfrm4_esp_rcv+0x46/0xb0 net/ipv4/xfrm4_protocol.c:104
ip_protocol_deliver_rcu+0x259/0x260 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x115/0x1e0 net/ipv4/ip_input.c:241
NF_HOOK include/linux/netfilter.h:325 [inline]
NF_HOOK include/linux/netfilter.h:319 [inline]
ip_local_deliver+0x97/0x140 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:481 [inline]
ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
NF_HOOK include/linux/netfilter.h:319 [inline]
ip_rcv+0x212/0x230 net/ipv4/ip_input.c:612
__netif_receive_skb_one_core+0xce/0x100 net/core/dev.c:6405
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6518
netif_receive_skb_internal net/core/dev.c:6604 [inline]
netif_receive_skb+0x49/0x200 net/core/dev.c:6663
tun_rx_batched drivers/net/tun.c:1575 [inline]
tun_get_user+0x1ccc/0x2040 drivers/net/tun.c:2053
tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:2100
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [syzbot] [net?] memory leak in build_skb 2026-10-30 3:34 [syzbot] [net?] memory leak in build_skb syzbot @ 2026-10-30 8:25 ` Eric Dumazet 2026-10-30 8:49 ` syzbot 0 siblings, 1 reply; 3+ messages in thread From: Eric Dumazet @ 2026-10-30 8:25 UTC (permalink / raw) To: syzbot, Steffen Klassert Cc: andrew+netdev, davem, jasowangio, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs, willemdebruijn.kernel Le ven. 30 oct. 2026 à 04:34, syzbot <syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com> a écrit : > > Hello, > > syzbot found the following issue on: > > HEAD commit: 65ba8f34ec88 Merge tag 'xtensa-20261027' of https://github.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=1592353e580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=fbf447a1375a1948 > dashboard link: https://syzkaller.appspot.com/bug?extid=a3f21220cbbb6e14ee2e > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=142ee469580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/b4e738ce5f2b/disk-65ba8f34.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/1de9d1ecbbb6/vmlinux-65ba8f34.xz > kernel image: https://storage.googleapis.com/syzbot-assets/8a3d79b65181/bzImage-65ba8f34.xz > > AI-generated root cause summary: > In IPsec IP-TFS (XFRM_MODE_IPTFS) processing, when inner packets (including the > reused outer skb) are parsed and added to a temporary local 'sublist' during > __input_process_payload(), any error encountering invalid header data or > truncated payload jumps to 'done:'. At 'done:', packets on 'sublist' are neither > delivered nor freed, and the reused outer skb is neither placed in 'defer' nor > freed by kfree_skb(), permanently leaking the sk_buff and its attached sec_path > extension. > > full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=a3f21220cbbb6e14ee2e > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+a3f21220cbbb6e14ee2e@syzkaller.appspotmail.com > > 2026/10/28 09:56:01 executed programs: 5 > BUG: memory leak > unreferenced object 0xffff888104c73c00 (size 240): > comm "syz.0.17", pid 5970, jiffies 4294947974 > hex dump (first 32 bytes): > 90 38 1f 02 00 c9 ff ff 90 38 1f 02 00 c9 ff ff .8.......8...... > 00 00 6a 24 81 88 ff ff 00 00 00 00 00 00 00 00 ..j$............ > backtrace (crc 84fdfeb5): > kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] > slab_post_alloc_hook mm/slub.c:4733 [inline] > slab_alloc_node mm/slub.c:5033 [inline] > kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047 > __build_skb net/core/skbuff.c:495 [inline] > build_skb+0x25/0x120 net/core/skbuff.c:511 > __tun_build_skb drivers/net/tun.c:1631 [inline] > tun_build_skb+0x489/0x770 drivers/net/tun.c:1726 > tun_get_user+0xd2e/0x2040 drivers/net/tun.c:1860 > tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:2100 > new_sync_write fs/read_write.c:595 [inline] > vfs_write+0x3ae/0x720 fs/read_write.c:687 > ksys_write+0xa5/0x170 fs/read_write.c:739 > do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] > do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84 > entry_SYSCALL_64_after_hwframe+0x77/0x7f > > BUG: memory leak > unreferenced object 0xffff888104d139c0 (size 192): > comm "syz.0.17", pid 5970, jiffies 4294947974 > hex dump (first 32 bytes): > 01 00 00 00 00 02 00 00 00 00 0b 00 00 00 00 00 ................ > 80 9f 7b 24 81 88 ff ff 00 00 00 00 00 00 00 00 ..{$............ > backtrace (crc 420634a7): > kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] > slab_post_alloc_hook mm/slub.c:4733 [inline] > slab_alloc_node mm/slub.c:5033 [inline] > kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047 > __skb_ext_alloc+0x1a/0x50 net/core/skbuff.c:7246 > skb_ext_add+0x1a6/0x280 net/core/skbuff.c:7350 > secpath_set+0x7c/0xc0 net/xfrm/xfrm_input.c:127 > xfrm_input+0x381/0x28a0 net/xfrm/xfrm_input.c:571 > vti_input+0xf4/0x160 net/ipv4/ip_vti.c:69 > xfrm4_esp_rcv+0x46/0xb0 net/ipv4/xfrm4_protocol.c:104 > ip_protocol_deliver_rcu+0x259/0x260 net/ipv4/ip_input.c:207 > ip_local_deliver_finish+0x115/0x1e0 net/ipv4/ip_input.c:241 > NF_HOOK include/linux/netfilter.h:325 [inline] > NF_HOOK include/linux/netfilter.h:319 [inline] > ip_local_deliver+0x97/0x140 net/ipv4/ip_input.c:262 > dst_input include/net/dst.h:481 [inline] > ip_rcv_finish net/ipv4/ip_input.c:492 [inline] > NF_HOOK include/linux/netfilter.h:325 [inline] > NF_HOOK include/linux/netfilter.h:319 [inline] > ip_rcv+0x212/0x230 net/ipv4/ip_input.c:612 > __netif_receive_skb_one_core+0xce/0x100 net/core/dev.c:6405 > __netif_receive_skb+0x1d/0x80 net/core/dev.c:6518 > netif_receive_skb_internal net/core/dev.c:6604 [inline] > netif_receive_skb+0x49/0x200 net/core/dev.c:6663 > tun_rx_batched drivers/net/tun.c:1575 [inline] > tun_get_user+0x1ccc/0x2040 drivers/net/tun.c:2053 > tun_chr_write_iter+0x71/0x120 drivers/net/tun.c:2100 > > connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF > > > --- > This report is generated by a bot. It may contain errors. > See https://goo.gl/tpsmEJ for more information about syzbot. > syzbot engineers can be reached at syzkaller@googlegroups.com. > > syzbot will keep track of this issue. See: > https://goo.gl/tpsmEJ#status for how to communicate with syzbot. > > If the report is already addressed, let syzbot know by replying with: > #syz fix: exact-commit-title > > If you want syzbot to run the reproducer, reply with: > #syz test: git://repo/address.git branch-or-commit-hash > If you attach or paste a git patch, syzbot will apply it before testing. > > If you want to overwrite report's subsystems, reply with: > #syz set subsystems: new-subsystem > (See the list of subsystem names on the web dashboard) > > If the report is a duplicate of another one, reply with: > #syz dup: exact-subject-of-another-report > > If you want to undo deduplication, reply with: > #syz undup #syz test diff --git a/net/xfrm/xfrm_iptfs.c b/net/xfrm/xfrm_iptfs.c index 103cf7c5dbfb..0313a43aa8a9 100644 --- a/net/xfrm/xfrm_iptfs.c +++ b/net/xfrm/xfrm_iptfs.c @@ -1182,6 +1182,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data, /* this should not happen from the above code */ XFRM_INC_STATS(net, LINUX_MIB_XFRMINIPTFSERROR); +done: if (first_skb && first_iplen && !defer && !first_skb_partial) { /* first_skb is queued b/c !defer and not partial */ if (pskb_trim(first_skb, first_iplen)) { @@ -1198,7 +1199,7 @@ static bool __input_process_payload(struct xfrm_state *x, u32 data, if (xfrm_input(skb, 0, 0, -2)) kfree_skb(skb); } -done: + skb = skbseq->root_skb; skb_abort_seq_read(skbseq); ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [syzbot] [net?] memory leak in build_skb 2026-10-30 8:25 ` Eric Dumazet @ 2026-10-30 8:49 ` syzbot 0 siblings, 0 replies; 3+ messages in thread From: syzbot @ 2026-10-30 8:49 UTC (permalink / raw) To: andrew, davem, edumazet, jasowangio, kuba, linux-kernel, netdev, pabeni, steffen.klassert, syzkaller-bugs, willemdebruijn.kernel Hello, syzbot tried to test the proposed patch but the build/boot failed: failed to apply patch: error: corrupt patch at line 6 Tested on: commit: d89e1d18 Merge tag 'fscrypt-for-linus' of git://git.ke.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=fbf447a1375a1948 dashboard link: https://syzkaller.appspot.com/bug?extid=a3f21220cbbb6e14ee2e compiler: patch: https://syzkaller.appspot.com/x/patch.diff?x=124fcef1580000 ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-30 8:49 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-10-30 3:34 [syzbot] [net?] memory leak in build_skb syzbot 2026-10-30 8:25 ` Eric Dumazet 2026-10-30 8:49 ` syzbot
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.