syzbot


memory leak in j1939_netdev_start

Status: upstream: reported syz repro on 2023/11/25 02:45
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com
First crash: 366d, last: 352d
Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [can?] memory leak in j1939_netdev_start 3 (8) 2024/01/24 02:51
[syzbot] Monthly can report (Dec 2023) 0 (1) 2023/12/02 14:45
Last patch testing requests (9)
Created Duration User Patch Repo Result
2024/10/27 06:45 14m retest repro upstream report log
2024/08/18 06:21 13m retest repro upstream report log
2024/06/08 23:42 11m retest repro upstream report log
2024/03/30 19:01 12m retest repro upstream report log
2024/01/24 01:24 1h24m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2024/01/23 09:39 13m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2024/01/23 09:12 0m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 98b1cc82c4af error
2024/01/19 13:27 19m n.zhandarovich@fintech.ru upstream report log
2023/12/05 02:49 24m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88811f324000 (size 8192):
  comm "syz-executor.7", pid 5245, jiffies 4294947603 (age 10.860s)
  hex dump (first 32 bytes):
    00 40 32 1f 81 88 ff ff 00 40 32 1f 81 88 ff ff  .@2......@2.....
    00 00 00 00 00 00 00 00 00 80 0f 1b 81 88 ff ff  ................
  backtrace:
    [<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline]
    [<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline]
    [<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517
    [<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098
    [<ffffffff8453e829>] kmalloc include/linux/slab.h:600 [inline]
    [<ffffffff8453e829>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff8453e829>] j1939_priv_create net/can/j1939/main.c:135 [inline]
    [<ffffffff8453e829>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
    [<ffffffff8454046e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485
    [<ffffffff83ec4dac>] __sys_bind+0x11c/0x130 net/socket.c:1845
    [<ffffffff83ec4ddc>] __do_sys_bind net/socket.c:1856 [inline]
    [<ffffffff83ec4ddc>] __se_sys_bind net/socket.c:1854 [inline]
    [<ffffffff83ec4ddc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1854
    [<ffffffff84b6bd8f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
    [<ffffffff84b6bd8f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b

BUG: memory leak
unreferenced object 0xffff88811f0bf300 (size 240):
  comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
  hex dump (first 32 bytes):
    68 74 bb 1d 81 88 ff ff 68 74 bb 1d 81 88 ff ff  ht......ht......
    00 80 0f 1b 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff81631427>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff81631427>] slab_post_alloc_hook mm/slab.h:766 [inline]
    [<ffffffff81631427>] slab_alloc_node mm/slub.c:3478 [inline]
    [<ffffffff81631427>] kmem_cache_alloc_node+0x2c7/0x450 mm/slub.c:3523
    [<ffffffff83ed869f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
    [<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline]
    [<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
    [<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
    [<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
    [<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
    [<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
    [<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
    [<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
    [<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
    [<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
    [<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
    [<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
    [<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
    [<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
    [<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
    [<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
    [<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
    [<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553

BUG: memory leak
unreferenced object 0xffff88811f340000 (size 131072):
  comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
  hex dump (first 32 bytes):
    0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff8157e703>] __kmalloc_large_node+0xe3/0x170 mm/slab_common.c:1157
    [<ffffffff8157ecbb>] __do_kmalloc_node mm/slab_common.c:995 [inline]
    [<ffffffff8157ecbb>] __kmalloc_node_track_caller+0xbb/0x150 mm/slab_common.c:1027
    [<ffffffff83ed49a6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
    [<ffffffff83ed8585>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
    [<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline]
    [<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
    [<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
    [<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
    [<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
    [<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
    [<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
    [<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
    [<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
    [<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
    [<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
    [<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
    [<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
    [<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
    [<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
    [<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
    [<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
    [<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553

BUG: memory leak
unreferenced object 0xffff88811dbb7400 (size 512):
  comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
  hex dump (first 32 bytes):
    00 40 32 1f 81 88 ff ff 28 50 32 1f 81 88 ff ff  .@2.....(P2.....
    28 50 32 1f 81 88 ff ff 18 74 bb 1d 81 88 ff ff  (P2......t......
  backtrace:
    [<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline]
    [<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline]
    [<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517
    [<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098
    [<ffffffff84542463>] kmalloc include/linux/slab.h:600 [inline]
    [<ffffffff84542463>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff84542463>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494
    [<ffffffff84547485>] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline]
    [<ffffffff84547485>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
    [<ffffffff84547485>] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735
    [<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
    [<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
    [<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
    [<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
    [<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
    [<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
    [<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
    [<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
    [<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
    [<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
    [<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
    [<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
    [<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
    [<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/11/21 02:33 upstream 98b1cc82c4af cb976f63 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
* Struck through repros no longer work on HEAD.