* [syzbot] [can?] memory leak in j1939_netdev_start
@ 2023-11-25 2:45 syzbot
2024-01-19 13:27 ` [syzbot] " syzbot
` (4 more replies)
0 siblings, 5 replies; 10+ messages in thread
From: syzbot @ 2023-11-25 2:45 UTC (permalink / raw)
To: davem, edumazet, kernel, kuba, linux-can, linux-kernel, mkl,
netdev, o.rempel, pabeni, robin, socketcan, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 98b1cc82c4af Linux 6.7-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1286e3d4e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1b9d95ada516af
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c8f8cce80000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6b6d520f592c/disk-98b1cc82.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c2cb6183fd56/vmlinux-98b1cc82.xz
kernel image: https://storage.googleapis.com/syzbot-assets/de520cfc8b93/bzImage-98b1cc82.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88811f324000 (size 8192):
comm "syz-executor.7", pid 5245, jiffies 4294947603 (age 10.860s)
hex dump (first 32 bytes):
00 40 32 1f 81 88 ff ff 00 40 32 1f 81 88 ff ff .@2......@2.....
00 00 00 00 00 00 00 00 00 80 0f 1b 81 88 ff ff ................
backtrace:
[<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517
[<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098
[<ffffffff8453e829>] kmalloc include/linux/slab.h:600 [inline]
[<ffffffff8453e829>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff8453e829>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff8453e829>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff8454046e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485
[<ffffffff83ec4dac>] __sys_bind+0x11c/0x130 net/socket.c:1845
[<ffffffff83ec4ddc>] __do_sys_bind net/socket.c:1856 [inline]
[<ffffffff83ec4ddc>] __se_sys_bind net/socket.c:1854 [inline]
[<ffffffff83ec4ddc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1854
[<ffffffff84b6bd8f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84b6bd8f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff88811f0bf300 (size 240):
comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
hex dump (first 32 bytes):
68 74 bb 1d 81 88 ff ff 68 74 bb 1d 81 88 ff ff ht......ht......
00 80 0f 1b 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81631427>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff81631427>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff81631427>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff81631427>] kmem_cache_alloc_node+0x2c7/0x450 mm/slub.c:3523
[<ffffffff83ed869f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
[<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline]
[<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
[<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
[<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
[<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
[<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
[<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
[<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff88811f340000 (size 131072):
comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8157e703>] __kmalloc_large_node+0xe3/0x170 mm/slab_common.c:1157
[<ffffffff8157ecbb>] __do_kmalloc_node mm/slab_common.c:995 [inline]
[<ffffffff8157ecbb>] __kmalloc_node_track_caller+0xbb/0x150 mm/slab_common.c:1027
[<ffffffff83ed49a6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
[<ffffffff83ed8585>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
[<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline]
[<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
[<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
[<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
[<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
[<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
[<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
[<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff88811dbb7400 (size 512):
comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
hex dump (first 32 bytes):
00 40 32 1f 81 88 ff ff 28 50 32 1f 81 88 ff ff .@2.....(P2.....
28 50 32 1f 81 88 ff ff 18 74 bb 1d 81 88 ff ff (P2......t......
backtrace:
[<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517
[<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098
[<ffffffff84542463>] kmalloc include/linux/slab.h:600 [inline]
[<ffffffff84542463>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff84542463>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494
[<ffffffff84547485>] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline]
[<ffffffff84547485>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff84547485>] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
[<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
[<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
[<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
[<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
[<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
[<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [syzbot] [can?] memory leak in j1939_netdev_start
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
@ 2024-01-19 13:27 ` syzbot
2024-01-23 9:12 ` Edward Adam Davis
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-01-19 13:27 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject: [syzbot] [can?] memory leak in j1939_netdev_start
Author: n.zhandarovich@fintech.ru
Test to make sure the issue is still standing.
#syz test
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
[not found] <20240119132659.3158-1-n.zhandarovich@fintech.ru>
@ 2024-01-19 14:23 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-01-19 14:23 UTC (permalink / raw)
To: linux-kernel, n.zhandarovich, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in corrupted
BUG: memory leak
unreferenced object 0xffff88812162e000 (size 8192):
comm "syz-executor.2", pid 5912, jiffies 4294946210
hex dump (first 32 bytes):
00 e0 62 21 81 88 ff ff 00 e0 62 21 81 88 ff ff ..b!......b!....
00 00 00 00 00 00 00 00 00 00 36 1c 81 88 ff ff ..........6.....
backtrace (crc bbd5015e):
[<ffffffff815fa6f3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa6f3>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa6f3>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa6f3>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff8457ddd9>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff8457ddd9>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff8457ddd9>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff8457ddd9>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff8457fa1e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485
[<ffffffff83efe59c>] __sys_bind+0x11c/0x130 net/socket.c:1847
[<ffffffff83efe5cc>] __do_sys_bind net/socket.c:1858 [inline]
[<ffffffff83efe5cc>] __se_sys_bind net/socket.c:1856 [inline]
[<ffffffff83efe5cc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1856
[<ffffffff84bb9910>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
[<ffffffff84bb9910>] do_syscall_64+0x50/0x140 arch/x86/entry/common.c:83
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff888122a49d00 (size 240):
comm "softirq", pid 0, jiffies 4294946210
hex dump (first 32 bytes):
68 4c a6 21 81 88 ff ff 68 4c a6 21 81 88 ff ff hL.!....hL.!....
00 00 36 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ..6.............
backtrace (crc d6a71e41):
[<ffffffff815f9b9a>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815f9b9a>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815f9b9a>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815f9b9a>] kmem_cache_alloc_node+0x28a/0x330 mm/slub.c:3903
[<ffffffff83f11f5f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
[<ffffffff8458699f>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458699f>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
[<ffffffff8458699f>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff8458699f>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84587455>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84587455>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8457d9a9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8456e3f4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8456e3f4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8456eab0>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8456ebf0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f4a976>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f4a9ed>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f4ad4c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f4bede>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f4c8f8>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f4c8f8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bd799d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff888122f20000 (size 131072):
comm "softirq", pid 0, jiffies 4294946210
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc f7abe560):
[<ffffffff815f313e>] __kmalloc_large_node+0xde/0x150 mm/slub.c:3935
[<ffffffff815f8f8f>] __do_kmalloc_node mm/slub.c:3969 [inline]
[<ffffffff815f8f8f>] __kmalloc_node_track_caller+0x35f/0x420 mm/slub.c:4001
[<ffffffff83f0e1b6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
[<ffffffff83f11e45>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
[<ffffffff8458699f>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458699f>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
[<ffffffff8458699f>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff8458699f>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84587455>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84587455>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8457d9a9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8456e3f4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8456e3f4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8456eab0>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8456ebf0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f4a976>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f4a9ed>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f4ad4c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f4bede>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f4c8f8>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f4c8f8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bd799d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff888121a64c00 (size 512):
comm "softirq", pid 0, jiffies 4294946210
hex dump (first 32 bytes):
00 e0 62 21 81 88 ff ff 28 f0 62 21 81 88 ff ff ..b!....(.b!....
28 f0 62 21 81 88 ff ff 18 4c a6 21 81 88 ff ff (.b!.....L.!....
backtrace (crc 5752fd94):
[<ffffffff815fa6f3>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa6f3>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa6f3>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa6f3>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff84581a13>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff84581a13>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff84581a13>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494
[<ffffffff84586a35>] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline]
[<ffffffff84586a35>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff84586a35>] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84587455>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84587455>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8457d9a9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8456e3f4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8456e3f4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8456eab0>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8456ebf0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f4a976>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f4a9ed>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f4ad4c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f4bede>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f4c8f8>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f4c8f8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bd799d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
Tested on:
commit: 9d1694dc Merge tag 'for-6.8/block-2024-01-18' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17efd763e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=447c03a4f5a8d571
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: no patches were applied.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
2024-01-19 13:27 ` [syzbot] " syzbot
@ 2024-01-23 9:12 ` Edward Adam Davis
2024-01-23 9:24 ` syzbot
2024-01-23 9:39 ` Edward Adam Davis
` (2 subsequent siblings)
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-01-23 9:12 UTC (permalink / raw)
To: syzbot+1d37bef05da87b99c5a6; +Cc: linux-kernel, syzkaller-bugs
please test memory leak in j1939_netdev_start
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 98b1cc82c4af
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 14c431663233..1d1f1348eeca 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -141,6 +141,7 @@ static void j1939_sk_queue_drop_all(struct j1939_priv *priv,
sk_session_queue_entry) {
list_del_init(&session->sk_session_queue_entry);
session->err = err;
+ printk("s: %p, %s\n", session, __func__);
j1939_session_put(session);
}
spin_unlock_bh(&jsk->sk_session_queue_lock);
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index fe3df23a2595..0b09bf60b08b 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -278,6 +278,7 @@ static void j1939_session_destroy(struct j1939_session *session)
while ((skb = skb_dequeue(&session->skb_queue)) != NULL) {
/* drop ref taken in j1939_session_skb_queue() */
+ printk("s: %p, skb: %p, %s\n", session, skb, __func__);
skb_unref(skb);
kfree_skb(skb);
}
@@ -1552,6 +1553,7 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv,
/* alloc data area */
skb_put(skb, size);
/* skb is recounted in j1939_session_new() */
+ printk("s: %p, skb: %p, %s\n", session, skb, __func__);
return session;
}
@@ -1758,6 +1760,7 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb,
j1939_tp_set_rxtimeout(session, 1250);
}
+ printk("s: %p, %s\n", session, __func__);
j1939_session_put(session);
}
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2024-01-23 9:12 ` Edward Adam Davis
@ 2024-01-23 9:24 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-01-23 9:24 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to checkout kernel repo https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git on commit 98b1cc82c4af: failed to run ["git" "fetch" "--force" "--tags" "4d52a57a3858a6eee0d0b25cc3a0c9533f747d8f" "98b1cc82c4af"]: exit status 128
fatal: couldn't find remote ref 98b1cc82c4af
Tested on:
commit: [unknown
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 98b1cc82c4af
kernel config: https://syzkaller.appspot.com/x/.config?x=f1b9d95ada516af
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=1401d2d7e80000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
2024-01-19 13:27 ` [syzbot] " syzbot
2024-01-23 9:12 ` Edward Adam Davis
@ 2024-01-23 9:39 ` Edward Adam Davis
2024-01-23 10:05 ` syzbot
2024-01-24 1:24 ` Edward Adam Davis
2025-12-21 7:58 ` syzbot
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-01-23 9:39 UTC (permalink / raw)
To: syzbot+1d37bef05da87b99c5a6; +Cc: linux-kernel, syzkaller-bugs
please test memory leak in j1939_netdev_start
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 14c431663233..1d1f1348eeca 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -141,6 +141,7 @@ static void j1939_sk_queue_drop_all(struct j1939_priv *priv,
sk_session_queue_entry) {
list_del_init(&session->sk_session_queue_entry);
session->err = err;
+ printk("s: %p, %s\n", session, __func__);
j1939_session_put(session);
}
spin_unlock_bh(&jsk->sk_session_queue_lock);
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index fe3df23a2595..0b09bf60b08b 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -278,6 +278,7 @@ static void j1939_session_destroy(struct j1939_session *session)
while ((skb = skb_dequeue(&session->skb_queue)) != NULL) {
/* drop ref taken in j1939_session_skb_queue() */
+ printk("s: %p, skb: %p, %s\n", session, skb, __func__);
skb_unref(skb);
kfree_skb(skb);
}
@@ -1552,6 +1553,7 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv,
/* alloc data area */
skb_put(skb, size);
/* skb is recounted in j1939_session_new() */
+ printk("s: %p, skb: %p, %s\n", session, skb, __func__);
return session;
}
@@ -1758,6 +1760,7 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb,
j1939_tp_set_rxtimeout(session, 1250);
}
+ printk("s: %p, %s\n", session, __func__);
j1939_session_put(session);
}
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2024-01-23 9:39 ` Edward Adam Davis
@ 2024-01-23 10:05 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-01-23 10:05 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in corrupted
BUG: memory leak
unreferenced object 0xffff888122468000 (size 8192):
comm "syz-executor.3", pid 5871, jiffies 4294945607
hex dump (first 32 bytes):
00 80 46 22 81 88 ff ff 00 80 46 22 81 88 ff ff ..F"......F"....
00 00 00 00 00 00 00 00 00 80 03 1b 81 88 ff ff ................
backtrace (crc aa0f28f1):
[<ffffffff815fa713>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa713>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa713>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa713>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff84584249>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff84584249>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff84584249>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff84584249>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff84585eae>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:486
[<ffffffff83f04a0c>] __sys_bind+0x11c/0x130 net/socket.c:1847
[<ffffffff83f04a3c>] __do_sys_bind net/socket.c:1858 [inline]
[<ffffffff83f04a3c>] __se_sys_bind net/socket.c:1856 [inline]
[<ffffffff83f04a3c>] __x64_sys_bind+0x1c/0x20 net/socket.c:1856
[<ffffffff84bc08c0>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
[<ffffffff84bc08c0>] do_syscall_64+0x50/0x140 arch/x86/entry/common.c:83
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff888122b02200 (size 240):
comm "softirq", pid 0, jiffies 4294945607
hex dump (first 32 bytes):
68 ac 2a 22 81 88 ff ff 68 ac 2a 22 81 88 ff ff h.*"....h.*"....
00 80 03 1b 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace (crc 54b3c139):
[<ffffffff815f9bba>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815f9bba>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815f9bba>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815f9bba>] kmem_cache_alloc_node+0x28a/0x330 mm/slub.c:3903
[<ffffffff83f183cf>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
[<ffffffff8458ce6a>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458ce6a>] j1939_session_fresh_new net/can/j1939/transport.c:1536 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1633 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts+0x4ba/0xa70 net/can/j1939/transport.c:1737
[<ffffffff8458d925>] j1939_tp_cmd_recv net/can/j1939/transport.c:2060 [inline]
[<ffffffff8458d925>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2147
[<ffffffff84583e19>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff84574864>] deliver net/can/af_can.c:572 [inline]
[<ffffffff84574864>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574f20>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff84575060>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50de6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50e5d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f511bc>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f5234e>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52d68>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52d68>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff888122b40000 (size 131072):
comm "softirq", pid 0, jiffies 4294945607
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc f7abe560):
[<ffffffff815f315e>] __kmalloc_large_node+0xde/0x150 mm/slub.c:3935
[<ffffffff815f8faf>] __do_kmalloc_node mm/slub.c:3969 [inline]
[<ffffffff815f8faf>] __kmalloc_node_track_caller+0x35f/0x420 mm/slub.c:4001
[<ffffffff83f14626>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
[<ffffffff83f182b5>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
[<ffffffff8458ce6a>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458ce6a>] j1939_session_fresh_new net/can/j1939/transport.c:1536 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1633 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts+0x4ba/0xa70 net/can/j1939/transport.c:1737
[<ffffffff8458d925>] j1939_tp_cmd_recv net/can/j1939/transport.c:2060 [inline]
[<ffffffff8458d925>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2147
[<ffffffff84583e19>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff84574864>] deliver net/can/af_can.c:572 [inline]
[<ffffffff84574864>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574f20>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff84575060>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50de6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50e5d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f511bc>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f5234e>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52d68>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52d68>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff8881222aac00 (size 512):
comm "softirq", pid 0, jiffies 4294945607
hex dump (first 32 bytes):
00 80 46 22 81 88 ff ff 28 90 46 22 81 88 ff ff ..F"....(.F"....
28 90 46 22 81 88 ff ff 18 ac 2a 22 81 88 ff ff (.F"......*"....
backtrace (crc 32877ad9):
[<ffffffff815fa713>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa713>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa713>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa713>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff84587ea3>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff84587ea3>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff84587ea3>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1495
[<ffffffff8458cefc>] j1939_session_fresh_new net/can/j1939/transport.c:1547 [inline]
[<ffffffff8458cefc>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1633 [inline]
[<ffffffff8458cefc>] j1939_xtp_rx_rts+0x54c/0xa70 net/can/j1939/transport.c:1737
[<ffffffff8458d925>] j1939_tp_cmd_recv net/can/j1939/transport.c:2060 [inline]
[<ffffffff8458d925>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2147
[<ffffffff84583e19>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff84574864>] deliver net/can/af_can.c:572 [inline]
[<ffffffff84574864>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574f20>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff84575060>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50de6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50e5d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f511bc>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f5234e>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52d68>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52d68>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
Tested on:
commit: 7ed2632e drm/ttm: fix ttm pool initialization for no-d..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1681d2d7e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9f6b64adeddd3dbc
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1770fa6be80000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
` (2 preceding siblings ...)
2024-01-23 9:39 ` Edward Adam Davis
@ 2024-01-24 1:24 ` Edward Adam Davis
2024-01-24 2:51 ` syzbot
2025-12-21 7:58 ` syzbot
4 siblings, 1 reply; 10+ messages in thread
From: Edward Adam Davis @ 2024-01-24 1:24 UTC (permalink / raw)
To: syzbot+1d37bef05da87b99c5a6; +Cc: linux-kernel, syzkaller-bugs
please test memory leak in j1939_netdev_start
#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c
index 14c431663233..1d1f1348eeca 100644
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -141,6 +141,7 @@ static void j1939_sk_queue_drop_all(struct j1939_priv *priv,
sk_session_queue_entry) {
list_del_init(&session->sk_session_queue_entry);
session->err = err;
+ printk("s: %p, %s\n", session, __func__);
j1939_session_put(session);
}
spin_unlock_bh(&jsk->sk_session_queue_lock);
diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c
index fe3df23a2595..4e5f6037db46 100644
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -283,6 +283,7 @@ static void j1939_session_destroy(struct j1939_session *session)
}
__j1939_session_drop(session);
j1939_priv_put(session->priv);
+ printk("free session: %p, %s\n", session, __func__);
kfree(session);
}
@@ -1552,6 +1553,8 @@ j1939_session *j1939_session_fresh_new(struct j1939_priv *priv,
/* alloc data area */
skb_put(skb, size);
/* skb is recounted in j1939_session_new() */
+ printk("s: %p, skb: %p, size: %d, csk: %d, %s\n",
+ session, skb, size, sizeof(struct can_skb_priv), __func__);
return session;
}
@@ -1758,6 +1761,7 @@ static void j1939_xtp_rx_rts(struct j1939_priv *priv, struct sk_buff *skb,
j1939_tp_set_rxtimeout(session, 1250);
}
+ printk("s: %p, %s\n", session, __func__);
j1939_session_put(session);
}
@@ -2005,6 +2009,8 @@ struct j1939_session *j1939_tp_send(struct j1939_priv *priv,
if (!session)
return ERR_PTR(-ENOMEM);
+ printk("s: %p, size: %d, %s\n", session, size, __func__);
+
/* skb is recounted in j1939_session_new() */
sock_hold(skb->sk);
session->sk = skb->sk;
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2024-01-24 1:24 ` Edward Adam Davis
@ 2024-01-24 2:51 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2024-01-24 2:51 UTC (permalink / raw)
To: eadavis, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in corrupted
BUG: memory leak
unreferenced object 0xffff88810e94a000 (size 8192):
comm "syz-executor.4", pid 5915, jiffies 4294946150
hex dump (first 32 bytes):
00 a0 94 0e 81 88 ff ff 00 a0 94 0e 81 88 ff ff ................
00 00 00 00 00 00 00 00 00 00 70 10 81 88 ff ff ..........p.....
backtrace (crc 77c14305):
[<ffffffff815fa713>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa713>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa713>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa713>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff845842c9>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff845842c9>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff845842c9>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff845842c9>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff84585f2e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:486
[<ffffffff83f04a8c>] __sys_bind+0x11c/0x130 net/socket.c:1847
[<ffffffff83f04abc>] __do_sys_bind net/socket.c:1858 [inline]
[<ffffffff83f04abc>] __se_sys_bind net/socket.c:1856 [inline]
[<ffffffff83f04abc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1856
[<ffffffff84bc08c0>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
[<ffffffff84bc08c0>] do_syscall_64+0x50/0x140 arch/x86/entry/common.c:83
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff888122f26000 (size 8192):
comm "syz-executor.1", pid 5923, jiffies 4294946164
hex dump (first 32 bytes):
00 60 f2 22 81 88 ff ff 00 60 f2 22 81 88 ff ff .`.".....`."....
00 00 00 00 00 00 00 00 00 80 60 10 81 88 ff ff ..........`.....
backtrace (crc c2cb0355):
[<ffffffff815fa713>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa713>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa713>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa713>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff845842c9>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff845842c9>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff845842c9>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff845842c9>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff84585f2e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:486
[<ffffffff83f04a8c>] __sys_bind+0x11c/0x130 net/socket.c:1847
[<ffffffff83f04abc>] __do_sys_bind net/socket.c:1858 [inline]
[<ffffffff83f04abc>] __se_sys_bind net/socket.c:1856 [inline]
[<ffffffff83f04abc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1856
[<ffffffff84bc08c0>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
[<ffffffff84bc08c0>] do_syscall_64+0x50/0x140 arch/x86/entry/common.c:83
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff888122c06700 (size 240):
comm "softirq", pid 0, jiffies 4294946164
hex dump (first 32 bytes):
68 42 2f 22 81 88 ff ff 68 42 2f 22 81 88 ff ff hB/"....hB/"....
00 80 60 10 81 88 ff ff 00 00 00 00 00 00 00 00 ..`.............
backtrace (crc 205e59a3):
[<ffffffff815f9bba>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815f9bba>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815f9bba>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815f9bba>] kmem_cache_alloc_node+0x28a/0x330 mm/slub.c:3903
[<ffffffff83f1844f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
[<ffffffff8458ceea>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458ceea>] j1939_session_fresh_new net/can/j1939/transport.c:1536 [inline]
[<ffffffff8458ceea>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1634 [inline]
[<ffffffff8458ceea>] j1939_xtp_rx_rts+0x4ba/0xa70 net/can/j1939/transport.c:1738
[<ffffffff8458d9d5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2063 [inline]
[<ffffffff8458d9d5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2150
[<ffffffff84583e99>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff845748e4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff845748e4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574fa0>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff845750e0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50e66>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50edd>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f5123c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f523ce>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52de8>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52de8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff8881231e0000 (size 131072):
comm "softirq", pid 0, jiffies 4294946164
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc f7abe560):
[<ffffffff815f315e>] __kmalloc_large_node+0xde/0x150 mm/slub.c:3935
[<ffffffff815f8faf>] __do_kmalloc_node mm/slub.c:3969 [inline]
[<ffffffff815f8faf>] __kmalloc_node_track_caller+0x35f/0x420 mm/slub.c:4001
[<ffffffff83f146a6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
[<ffffffff83f18335>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
[<ffffffff8458ceea>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458ceea>] j1939_session_fresh_new net/can/j1939/transport.c:1536 [inline]
[<ffffffff8458ceea>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1634 [inline]
[<ffffffff8458ceea>] j1939_xtp_rx_rts+0x4ba/0xa70 net/can/j1939/transport.c:1738
[<ffffffff8458d9d5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2063 [inline]
[<ffffffff8458d9d5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2150
[<ffffffff84583e99>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff845748e4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff845748e4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574fa0>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff845750e0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50e66>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50edd>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f5123c>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f523ce>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52de8>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52de8>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
Tested on:
commit: 615d3006 Merge tag 'trace-v6.8-rc1' of git://git.kerne..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=100e8b3be80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9f6b64adeddd3dbc
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=17d2a6f7e80000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [can?] memory leak in j1939_netdev_start
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
` (3 preceding siblings ...)
2024-01-24 1:24 ` Edward Adam Davis
@ 2025-12-21 7:58 ` syzbot
4 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2025-12-21 7:58 UTC (permalink / raw)
To: davem, eadavis, edumazet, kernel, kuba, linux-can, linux-kernel,
mkl, n.zhandarovich, netdev, o.rempel, pabeni, robin, socketcan,
syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: d8ba32c5a460 Merge tag 'block-6.19-20251218' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13989392580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d60836e327fd6756
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155c4358580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d1777c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/075f0ee95918/disk-d8ba32c5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8219d2472799/vmlinux-d8ba32c5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d07c95aef4d/bzImage-d8ba32c5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2fd2ba265dd2/mount_9.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=105f562a580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88812437e000 (size 8192):
comm "syz.3.27", pid 6191, jiffies 4294942739
hex dump (first 32 bytes):
00 e0 37 24 81 88 ff ff 00 e0 37 24 81 88 ff ff ..7$......7$....
00 00 00 00 00 00 00 00 00 80 67 14 81 88 ff ff ..........g.....
backtrace (crc 9710eadb):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
j1939_priv_create net/can/j1939/main.c:131 [inline]
j1939_netdev_start+0x160/0x6f0 net/can/j1939/main.c:268
j1939_sk_bind+0x247/0x590 net/can/j1939/socket.c:504
__sys_bind_socket net/socket.c:1874 [inline]
__sys_bind_socket net/socket.c:1866 [inline]
__sys_bind+0x132/0x160 net/socket.c:1905
__do_sys_bind net/socket.c:1910 [inline]
__se_sys_bind net/socket.c:1908 [inline]
__x64_sys_bind+0x1c/0x30 net/socket.c:1908
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810cc00e00 (size 240):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
68 8a 63 24 81 88 ff ff 68 8a 63 24 81 88 ff ff h.c$....h.c$....
00 80 67 14 81 88 ff ff 00 00 00 00 00 00 00 00 ..g.............
backtrace (crc 467a0d54):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
__alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
alloc_skb include/linux/skbuff.h:1383 [inline]
j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056
BUG: memory leak
unreferenced object 0xffff88810a549e40 (size 704):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc fd324075):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
__alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
alloc_skb include/linux/skbuff.h:1383 [inline]
j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
BUG: memory leak
unreferenced object 0xffff888124638a00 (size 512):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
00 e0 37 24 81 88 ff ff 28 f0 37 24 81 88 ff ff ..7$....(.7$....
28 f0 37 24 81 88 ff ff 18 8a 63 24 81 88 ff ff (.7$......c$....
backtrace (crc 965e5f06):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
j1939_session_new+0x55/0x1d0 net/can/j1939/transport.c:1495
j1939_session_fresh_new net/can/j1939/transport.c:1543 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x47a/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2025-12-21 7:58 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
2024-01-19 13:27 ` [syzbot] " syzbot
2024-01-23 9:12 ` Edward Adam Davis
2024-01-23 9:24 ` syzbot
2024-01-23 9:39 ` Edward Adam Davis
2024-01-23 10:05 ` syzbot
2024-01-24 1:24 ` Edward Adam Davis
2024-01-24 2:51 ` syzbot
2025-12-21 7:58 ` syzbot
[not found] <20240119132659.3158-1-n.zhandarovich@fintech.ru>
2024-01-19 14:23 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox