From: syzbot <syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com>
To: eadavis@qq.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [can?] memory leak in j1939_netdev_start
Date: Tue, 23 Jan 2024 02:05:06 -0800 [thread overview]
Message-ID: <000000000000a80f14060f9a1430@google.com> (raw)
In-Reply-To: <tencent_EA9AECE6CEAC79FA6CAC2DDD6D0095E8EA0A@qq.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in corrupted
BUG: memory leak
unreferenced object 0xffff888122468000 (size 8192):
comm "syz-executor.3", pid 5871, jiffies 4294945607
hex dump (first 32 bytes):
00 80 46 22 81 88 ff ff 00 80 46 22 81 88 ff ff ..F"......F"....
00 00 00 00 00 00 00 00 00 80 03 1b 81 88 ff ff ................
backtrace (crc aa0f28f1):
[<ffffffff815fa713>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa713>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa713>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa713>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff84584249>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff84584249>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff84584249>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff84584249>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff84585eae>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:486
[<ffffffff83f04a0c>] __sys_bind+0x11c/0x130 net/socket.c:1847
[<ffffffff83f04a3c>] __do_sys_bind net/socket.c:1858 [inline]
[<ffffffff83f04a3c>] __se_sys_bind net/socket.c:1856 [inline]
[<ffffffff83f04a3c>] __x64_sys_bind+0x1c/0x20 net/socket.c:1856
[<ffffffff84bc08c0>] do_syscall_x64 arch/x86/entry/common.c:52 [inline]
[<ffffffff84bc08c0>] do_syscall_64+0x50/0x140 arch/x86/entry/common.c:83
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b
BUG: memory leak
unreferenced object 0xffff888122b02200 (size 240):
comm "softirq", pid 0, jiffies 4294945607
hex dump (first 32 bytes):
68 ac 2a 22 81 88 ff ff 68 ac 2a 22 81 88 ff ff h.*"....h.*"....
00 80 03 1b 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace (crc 54b3c139):
[<ffffffff815f9bba>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815f9bba>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815f9bba>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815f9bba>] kmem_cache_alloc_node+0x28a/0x330 mm/slub.c:3903
[<ffffffff83f183cf>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
[<ffffffff8458ce6a>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458ce6a>] j1939_session_fresh_new net/can/j1939/transport.c:1536 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1633 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts+0x4ba/0xa70 net/can/j1939/transport.c:1737
[<ffffffff8458d925>] j1939_tp_cmd_recv net/can/j1939/transport.c:2060 [inline]
[<ffffffff8458d925>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2147
[<ffffffff84583e19>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff84574864>] deliver net/can/af_can.c:572 [inline]
[<ffffffff84574864>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574f20>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff84575060>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50de6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50e5d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f511bc>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f5234e>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52d68>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52d68>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff888122b40000 (size 131072):
comm "softirq", pid 0, jiffies 4294945607
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc f7abe560):
[<ffffffff815f315e>] __kmalloc_large_node+0xde/0x150 mm/slub.c:3935
[<ffffffff815f8faf>] __do_kmalloc_node mm/slub.c:3969 [inline]
[<ffffffff815f8faf>] __kmalloc_node_track_caller+0x35f/0x420 mm/slub.c:4001
[<ffffffff83f14626>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
[<ffffffff83f182b5>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
[<ffffffff8458ce6a>] alloc_skb include/linux/skbuff.h:1296 [inline]
[<ffffffff8458ce6a>] j1939_session_fresh_new net/can/j1939/transport.c:1536 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1633 [inline]
[<ffffffff8458ce6a>] j1939_xtp_rx_rts+0x4ba/0xa70 net/can/j1939/transport.c:1737
[<ffffffff8458d925>] j1939_tp_cmd_recv net/can/j1939/transport.c:2060 [inline]
[<ffffffff8458d925>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2147
[<ffffffff84583e19>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff84574864>] deliver net/can/af_can.c:572 [inline]
[<ffffffff84574864>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574f20>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff84575060>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50de6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50e5d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f511bc>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f5234e>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52d68>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52d68>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
BUG: memory leak
unreferenced object 0xffff8881222aac00 (size 512):
comm "softirq", pid 0, jiffies 4294945607
hex dump (first 32 bytes):
00 80 46 22 81 88 ff ff 28 90 46 22 81 88 ff ff ..F"....(.F"....
28 90 46 22 81 88 ff ff 18 ac 2a 22 81 88 ff ff (.F"......*"....
backtrace (crc 32877ad9):
[<ffffffff815fa713>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff815fa713>] slab_post_alloc_hook mm/slub.c:3817 [inline]
[<ffffffff815fa713>] slab_alloc_node mm/slub.c:3860 [inline]
[<ffffffff815fa713>] kmalloc_trace+0x283/0x330 mm/slub.c:4007
[<ffffffff84587ea3>] kmalloc include/linux/slab.h:590 [inline]
[<ffffffff84587ea3>] kzalloc include/linux/slab.h:711 [inline]
[<ffffffff84587ea3>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1495
[<ffffffff8458cefc>] j1939_session_fresh_new net/can/j1939/transport.c:1547 [inline]
[<ffffffff8458cefc>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1633 [inline]
[<ffffffff8458cefc>] j1939_xtp_rx_rts+0x54c/0xa70 net/can/j1939/transport.c:1737
[<ffffffff8458d925>] j1939_tp_cmd_recv net/can/j1939/transport.c:2060 [inline]
[<ffffffff8458d925>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2147
[<ffffffff84583e19>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff84574864>] deliver net/can/af_can.c:572 [inline]
[<ffffffff84574864>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff84574f20>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff84575060>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f50de6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5534
[<ffffffff83f50e5d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5648
[<ffffffff83f511bc>] process_backlog+0xbc/0x190 net/core/dev.c:5976
[<ffffffff83f5234e>] __napi_poll+0x3e/0x310 net/core/dev.c:6576
[<ffffffff83f52d68>] napi_poll net/core/dev.c:6645 [inline]
[<ffffffff83f52d68>] net_rx_action+0x3d8/0x510 net/core/dev.c:6778
[<ffffffff84bde94d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553
Tested on:
commit: 7ed2632e drm/ttm: fix ttm pool initialization for no-d..
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
console output: https://syzkaller.appspot.com/x/log.txt?x=1681d2d7e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=9f6b64adeddd3dbc
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=1770fa6be80000
next prev parent reply other threads:[~2024-01-23 10:05 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
2024-01-19 13:27 ` [syzbot] " syzbot
2024-01-23 9:12 ` Edward Adam Davis
2024-01-23 9:24 ` syzbot
2024-01-23 9:39 ` Edward Adam Davis
2024-01-23 10:05 ` syzbot [this message]
2024-01-24 1:24 ` Edward Adam Davis
2024-01-24 2:51 ` syzbot
2025-12-21 7:58 ` syzbot
[not found] <20240119132659.3158-1-n.zhandarovich@fintech.ru>
2024-01-19 14:23 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000a80f14060f9a1430@google.com \
--to=syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com \
--cc=eadavis@qq.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox