[syzbot] [nfc?] memory leak in skb_copy (2)

[syzbot] [nfc?] memory leak in skb_copy (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    3f01e9fed845 Merge tag 'linux-watchdog-6.5-rc2' of git://w..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15fe3ef8a80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=75da4f0a455bdbd3
dashboard link: https://syzkaller.appspot.com/bug?extid=6eb09d75211863f15e3e
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=162f1cbca80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/441fb7ea58b8/disk-3f01e9fe.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8fa7790ba0c3/vmlinux-3f01e9fe.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5e7a6471dadf/bzImage-3f01e9fe.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6eb09d75211863f15e3e@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88811fff5e00 (size 240):
  comm "kworker/u4:0", pid 10, jiffies 4294989700 (age 28.220s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83e1c0bd>] __alloc_skb+0x1fd/0x230 net/core/skbuff.c:634
    [<ffffffff83e1efcf>] skb_copy+0x6f/0x180 net/core/skbuff.c:1925
    [<ffffffff82c3526f>] virtual_nci_send+0x3f/0xb0 drivers/nfc/virtual_ncidev.c:58
    [<ffffffff84990da9>] nci_send_frame+0x69/0xb0 net/nfc/nci/core.c:1347
    [<ffffffff84990e82>] nci_cmd_work+0x92/0xc0 net/nfc/nci/core.c:1567
    [<ffffffff812b19e4>] process_one_work+0x2c4/0x620 kernel/workqueue.c:2597
    [<ffffffff812b233d>] worker_thread+0x5d/0x5c0 kernel/workqueue.c:2748
    [<ffffffff812bbde3>] kthread+0x133/0x180 kernel/kthread.c:389
    [<ffffffff81002b5f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308

BUG: memory leak
unreferenced object 0xffff88810d74e500 (size 640):
  comm "kworker/u4:0", pid 10, jiffies 4294989700 (age 28.220s)
  hex dump (first 32 bytes):
    20 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00   ...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83e18976>] kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:559
    [<ffffffff83e1bf95>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:644
    [<ffffffff83e1efcf>] skb_copy+0x6f/0x180 net/core/skbuff.c:1925
    [<ffffffff82c3526f>] virtual_nci_send+0x3f/0xb0 drivers/nfc/virtual_ncidev.c:58
    [<ffffffff84990da9>] nci_send_frame+0x69/0xb0 net/nfc/nci/core.c:1347
    [<ffffffff84990e82>] nci_cmd_work+0x92/0xc0 net/nfc/nci/core.c:1567
    [<ffffffff812b19e4>] process_one_work+0x2c4/0x620 kernel/workqueue.c:2597
    [<ffffffff812b233d>] worker_thread+0x5d/0x5c0 kernel/workqueue.c:2748
    [<ffffffff812bbde3>] kthread+0x133/0x180 kernel/kthread.c:389
    [<ffffffff81002b5f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] Private message regarding: [syzbot] [nfc?] memory leak in skb_copy (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Private message regarding: [syzbot] [nfc?] memory leak in skb_copy (2)
Author: phind.uet@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
 master
diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c
index b027be0b0b6f..ac8226db54e2 100644
--- a/drivers/nfc/virtual_ncidev.c
+++ b/drivers/nfc/virtual_ncidev.c
@@ -20,26 +20,31 @@
                                 NFC_PROTO_ISO14443_MASK | \
                                 NFC_PROTO_ISO14443_B_MASK | \
                                 NFC_PROTO_ISO15693_MASK)
+#define NCIDEV_RUNNING 0

 struct virtual_nci_dev {
        struct nci_dev *ndev;
        struct mutex mtx;
        struct sk_buff *send_buff;
        struct wait_queue_head wq;
+       bool running;
 };

 static int virtual_nci_open(struct nci_dev *ndev)
 {
+       struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);
+
+       vdev->running = true;
        return 0;
 }

 static int virtual_nci_close(struct nci_dev *ndev)
 {
        struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);
-
        mutex_lock(&vdev->mtx);
        kfree_skb(vdev->send_buff);
        vdev->send_buff = NULL;
+       vdev->running = false;
        mutex_unlock(&vdev->mtx);

        return 0;
@@ -50,7 +55,7 @@ static int virtual_nci_send(struct nci_dev *ndev, struct 
sk_buff *skb)
        struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);

        mutex_lock(&vdev->mtx);
-       if (vdev->send_buff) {
+       if (vdev->send_buff || !vdev->running) {
                mutex_unlock(&vdev->mtx);
                kfree_skb(skb);
                return -1;

Re: [syzbot] Re: [syzbot] [nfc?] memory leak in skb_copy (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [nfc?] memory leak in skb_copy (2)
Author: phind.uet@gmail.com


#syz test: 
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

diff --git a/drivers/nfc/virtual_ncidev.c b/drivers/nfc/virtual_ncidev.c
index b027be0b0b6f..ac8226db54e2 100644
--- a/drivers/nfc/virtual_ncidev.c
+++ b/drivers/nfc/virtual_ncidev.c
@@ -20,26 +20,31 @@
  				 NFC_PROTO_ISO14443_MASK | \
  				 NFC_PROTO_ISO14443_B_MASK | \
  				 NFC_PROTO_ISO15693_MASK)
+#define NCIDEV_RUNNING 0

  struct virtual_nci_dev {
  	struct nci_dev *ndev;
  	struct mutex mtx;
  	struct sk_buff *send_buff;
  	struct wait_queue_head wq;
+	bool running;
  };

  static int virtual_nci_open(struct nci_dev *ndev)
  {
+	struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);
+
+	vdev->running = true;
  	return 0;
  }

  static int virtual_nci_close(struct nci_dev *ndev)
  {
  	struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);
-
  	mutex_lock(&vdev->mtx);
  	kfree_skb(vdev->send_buff);
  	vdev->send_buff = NULL;
+	vdev->running = false;
  	mutex_unlock(&vdev->mtx);

  	return 0;
@@ -50,7 +55,7 @@ static int virtual_nci_send(struct nci_dev *ndev, 
struct sk_buff *skb)
  	struct virtual_nci_dev *vdev = nci_get_drvdata(ndev);

  	mutex_lock(&vdev->mtx);
-	if (vdev->send_buff) {
+	if (vdev->send_buff || !vdev->running) {
  		mutex_unlock(&vdev->mtx);
  		kfree_skb(skb);
  		return -1;

Re: [syzbot] Re: [syzbot] [nfc?] memory leak in skb_copy (2)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [nfc?] memory leak in skb_copy (2)
Author: phind.uet@gmail.com

#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master

Re: [syzbot] Re: [syzbot] [nfc?] memory leak in skb_copy (2)(test updated patch)

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: Re: [syzbot] [nfc?] memory leak in skb_copy (2)(test updated patch)
Author: phind.uet@gmail.com


#syz test:
git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master