From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; dkim=none Received: from mail-pl1-f205.google.com (mail-pl1-f205.google.com [209.85.214.205]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1993519A7 for ; Fri, 24 Nov 2023 18:45:22 -0800 (PST) Received: by mail-pl1-f205.google.com with SMTP id d9443c01a7336-1cfa28ab0f3so16508665ad.2 for ; Fri, 24 Nov 2023 18:45:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700880321; x=1701485121; h=to:from:subject:message-id:date:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=0vhGKlbf8um049+SfnQY02FwXu7vtzZ58JJDrZbPu1A=; b=SDvSxA6JFhQUHygi62XcTIKOyyuox5Q4l4NQ1FGapKYEZGwjnC8g0w1kzFRKQy/MMN VORJYoFgTJLMcBpqHUEdtNJg27IhcrTcPADyzRtOpsU7oypn1OJ7f7i5XUqCf/iFs4Q0 POKczz5Aj6kwPVGh3v2M6an4sdRMpnKNxuCuvp3iqKJ5WG7zKMOi1mMVbuAWNFEVAbmA yioM2KrPA1b9e3OJR9X4XbfqF/UVhiHxK9I1I0hWA8i6mycPCcyXGfcAOpVluNg7O9W+ vaUht4WCNARTumw7DBGoN6yyWpxlw/i4z/60hLgOZ+1JgOg/0L7i41xlJRCmJH84ZB+H 2l1g== X-Gm-Message-State: AOJu0YzfRlsFGVIRSZwPu4Mfdd4si/Tg1E2NCZiR+Wd9cX0hD9FLo/B+ rhKu+Aefg5UwW0qtziFqKsLWdJXmaDYhBCHEj4qQtdcbwvzQ X-Google-Smtp-Source: AGHT+IFF+tdQ0IvQ09sdtpSQX+cOiRWTsmvFyfF9lEU7+E0eKL76FjEDaxdvZVR5smmM51SF+4RFC0QLWDTXavvMp8UMiv84+4bO Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a17:902:d2d2:b0:1cf:9a43:d323 with SMTP id n18-20020a170902d2d200b001cf9a43d323mr972682plc.11.1700880321624; Fri, 24 Nov 2023 18:45:21 -0800 (PST) Date: Fri, 24 Nov 2023 18:45:21 -0800 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <00000000000060446d060af10f08@google.com> Subject: [syzbot] [can?] memory leak in j1939_netdev_start From: syzbot To: davem@davemloft.net, edumazet@google.com, kernel@pengutronix.de, kuba@kernel.org, linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, mkl@pengutronix.de, netdev@vger.kernel.org, o.rempel@pengutronix.de, pabeni@redhat.com, robin@protonic.nl, socketcan@hartkopp.net, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot found the following issue on: HEAD commit: 98b1cc82c4af Linux 6.7-rc2 git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1286e3d4e80000 kernel config: https://syzkaller.appspot.com/x/.config?x=f1b9d95ada516af dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c8f8cce80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/6b6d520f592c/disk-98b1cc82.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/c2cb6183fd56/vmlinux-98b1cc82.xz kernel image: https://storage.googleapis.com/syzbot-assets/de520cfc8b93/bzImage-98b1cc82.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com BUG: memory leak unreferenced object 0xffff88811f324000 (size 8192): comm "syz-executor.7", pid 5245, jiffies 4294947603 (age 10.860s) hex dump (first 32 bytes): 00 40 32 1f 81 88 ff ff 00 40 32 1f 81 88 ff ff .@2......@2..... 00 00 00 00 00 00 00 00 00 80 0f 1b 81 88 ff ff ................ backtrace: [] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [] slab_post_alloc_hook mm/slab.h:766 [inline] [] slab_alloc_node mm/slub.c:3478 [inline] [] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [] kmalloc include/linux/slab.h:600 [inline] [] kzalloc include/linux/slab.h:721 [inline] [] j1939_priv_create net/can/j1939/main.c:135 [inline] [] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272 [] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485 [] __sys_bind+0x11c/0x130 net/socket.c:1845 [] __do_sys_bind net/socket.c:1856 [inline] [] __se_sys_bind net/socket.c:1854 [inline] [] __x64_sys_bind+0x1c/0x20 net/socket.c:1854 [] do_syscall_x64 arch/x86/entry/common.c:51 [inline] [] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 [] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88811f0bf300 (size 240): comm "softirq", pid 0, jiffies 4294947604 (age 10.850s) hex dump (first 32 bytes): 68 74 bb 1d 81 88 ff ff 68 74 bb 1d 81 88 ff ff ht......ht...... 00 80 0f 1b 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [] slab_post_alloc_hook mm/slab.h:766 [inline] [] slab_alloc_node mm/slub.c:3478 [inline] [] kmem_cache_alloc_node+0x2c7/0x450 mm/slub.c:3523 [] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641 [] alloc_skb include/linux/skbuff.h:1286 [inline] [] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline] [] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline] [] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735 [] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline] [] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144 [] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112 [] deliver net/can/af_can.c:572 [inline] [] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606 [] can_receive+0xf0/0x140 net/can/af_can.c:663 [] can_rcv+0xf0/0x130 net/can/af_can.c:687 [] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529 [] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643 [] process_backlog+0xbc/0x190 net/core/dev.c:5971 [] __napi_poll+0x3e/0x310 net/core/dev.c:6533 [] napi_poll net/core/dev.c:6602 [inline] [] net_rx_action+0x3d8/0x510 net/core/dev.c:6735 [] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88811f340000 (size 131072): comm "softirq", pid 0, jiffies 4294947604 (age 10.850s) hex dump (first 32 bytes): 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] __kmalloc_large_node+0xe3/0x170 mm/slab_common.c:1157 [] __do_kmalloc_node mm/slab_common.c:995 [inline] [] __kmalloc_node_track_caller+0xbb/0x150 mm/slab_common.c:1027 [] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582 [] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651 [] alloc_skb include/linux/skbuff.h:1286 [inline] [] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline] [] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline] [] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735 [] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline] [] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144 [] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112 [] deliver net/can/af_can.c:572 [inline] [] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606 [] can_receive+0xf0/0x140 net/can/af_can.c:663 [] can_rcv+0xf0/0x130 net/can/af_can.c:687 [] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529 [] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643 [] process_backlog+0xbc/0x190 net/core/dev.c:5971 [] __napi_poll+0x3e/0x310 net/core/dev.c:6533 [] napi_poll net/core/dev.c:6602 [inline] [] net_rx_action+0x3d8/0x510 net/core/dev.c:6735 [] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88811dbb7400 (size 512): comm "softirq", pid 0, jiffies 4294947604 (age 10.850s) hex dump (first 32 bytes): 00 40 32 1f 81 88 ff ff 28 50 32 1f 81 88 ff ff .@2.....(P2..... 28 50 32 1f 81 88 ff ff 18 74 bb 1d 81 88 ff ff (P2......t...... backtrace: [] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [] slab_post_alloc_hook mm/slab.h:766 [inline] [] slab_alloc_node mm/slub.c:3478 [inline] [] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [] kmalloc include/linux/slab.h:600 [inline] [] kzalloc include/linux/slab.h:721 [inline] [] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494 [] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline] [] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline] [] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735 [] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline] [] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144 [] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112 [] deliver net/can/af_can.c:572 [inline] [] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606 [] can_receive+0xf0/0x140 net/can/af_can.c:663 [] can_rcv+0xf0/0x130 net/can/af_can.c:687 [] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529 [] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643 [] process_backlog+0xbc/0x190 net/core/dev.c:5971 [] __napi_poll+0x3e/0x310 net/core/dev.c:6533 [] napi_poll net/core/dev.c:6602 [inline] [] net_rx_action+0x3d8/0x510 net/core/dev.c:6735 [] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup