From: syzbot <syzbot+92f9b5fba2df252a3569@syzkaller.appspotmail.com>
To: a@unstable.cc, b.a.t.m.a.n@lists.open-mesh.org,
davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
linux-kernel@vger.kernel.org, mareklindner@neomailbox.ch,
netdev@vger.kernel.org, pabeni@redhat.com, sven@narfation.org,
sw@simonwunderlich.de, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [batman?] memory leak in skb_clone (2)
Date: Sun, 27 Aug 2023 19:35:50 -0700 [thread overview]
Message-ID: <0000000000007caf3b0603f28d71@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: a5e505a99ca7 Merge tag 'platform-drivers-x86-v6.5-5' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15eea3e3a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3c65e06397a9d58
dashboard link: https://syzkaller.appspot.com/bug?extid=92f9b5fba2df252a3569
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13597f90680000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c534ce48946f/disk-a5e505a9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/724bbdaa3992/vmlinux-a5e505a9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/47fba0663891/bzImage-a5e505a9.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+92f9b5fba2df252a3569@syzkaller.appspotmail.com
2023/08/24 02:03:48 executed programs: 322
2023/08/24 02:03:54 executed programs: 337
BUG: memory leak
unreferenced object 0xffff888120ea2600 (size 240):
comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
hex dump (first 32 bytes):
00 22 e3 20 81 88 ff ff 00 00 00 00 00 00 00 00 .". ............
00 80 ed 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860
[<ffffffff8499f31f>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline]
[<ffffffff8499f31f>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
[<ffffffff8499f31f>] batadv_iv_send_outstanding_bat_ogm_packet+0x2ef/0x370 net/batman-adv/bat_iv_ogm.c:1700
[<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
[<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
[<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
[<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
BUG: memory leak
unreferenced object 0xffff888120f36c00 (size 1024):
comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81554a79>] __do_kmalloc_node mm/slab_common.c:984 [inline]
[<ffffffff81554a79>] __kmalloc_node_track_caller+0x49/0x140 mm/slab_common.c:1005
[<ffffffff83e54735>] kmalloc_reserve+0x95/0x180 net/core/skbuff.c:575
[<ffffffff83e5c6c8>] pskb_expand_head+0xd8/0x5f0 net/core/skbuff.c:2042
[<ffffffff849ccbef>] __skb_cow include/linux/skbuff.h:3571 [inline]
[<ffffffff849ccbef>] skb_cow_head include/linux/skbuff.h:3605 [inline]
[<ffffffff849ccbef>] batadv_skb_head_push+0x8f/0x110 net/batman-adv/soft-interface.c:72
[<ffffffff849ca643>] batadv_send_skb_packet+0x83/0x1c0 net/batman-adv/send.c:86
[<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
[<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
[<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700
[<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
[<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
[<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
[<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
BUG: memory leak
unreferenced object 0xffff888120ea2000 (size 240):
comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
hex dump (first 32 bytes):
00 28 ea 20 81 88 ff ff 00 00 00 00 00 00 00 00 .(. ............
00 80 ec 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860
[<ffffffff83f88552>] netem_enqueue+0xc62/0x1430 net/sched/sch_netem.c:479
[<ffffffff83e80975>] dev_qdisc_enqueue+0x25/0xf0 net/core/dev.c:3732
[<ffffffff83e8b217>] __dev_xmit_skb net/core/dev.c:3821 [inline]
[<ffffffff83e8b217>] __dev_queue_xmit+0xdc7/0x17d0 net/core/dev.c:4169
[<ffffffff849ca710>] dev_queue_xmit include/linux/netdevice.h:3088 [inline]
[<ffffffff849ca710>] batadv_send_skb_packet+0x150/0x1c0 net/batman-adv/send.c:108
[<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
[<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
[<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700
[<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
[<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
[<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
[<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2023-08-28 2:36 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0000000000007caf3b0603f28d71@google.com \
--to=syzbot+92f9b5fba2df252a3569@syzkaller.appspotmail.com \
--cc=a@unstable.cc \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mareklindner@neomailbox.ch \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=sven@narfation.org \
--cc=sw@simonwunderlich.de \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).