syzbot


memory leak in ctnetlink_del_conntrack

Status: fixed on 2020/07/17 17:58
Subsystems: netfilter
[Documentation on labels]
Reported-by: syzbot+38b8b548a851a01793c5@syzkaller.appspotmail.com
Fix commit: 6c2d2176a85e netfilter: ctnetlink: memleak in filter initialization error path
First crash: 1469d, last: 1469d
Discussions (3)
Title Replies (including bot) Last reply
[PATCH 0/4] Netfilter fixes for net 6 (6) 2020/06/15 20:27
[PATCH nf] netfilter: ctnetlink: memleak in filter initialization error path 2 (2) 2020/06/11 08:46
memory leak in ctnetlink_del_conntrack 0 (1) 2020/06/09 21:58

Sample crash report:
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88811c505300 (size 128):
  comm "syz-executor470", pid 6431, jiffies 4294945909 (age 13.210s)
  hex dump (first 32 bytes):
    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000da2809df>] kmalloc include/linux/slab.h:555 [inline]
    [<00000000da2809df>] kzalloc include/linux/slab.h:669 [inline]
    [<00000000da2809df>] ctnetlink_alloc_filter+0x3a/0x2a0 net/netfilter/nf_conntrack_netlink.c:924
    [<00000000745f0fc9>] ctnetlink_flush_conntrack net/netfilter/nf_conntrack_netlink.c:1516 [inline]
    [<00000000745f0fc9>] ctnetlink_del_conntrack+0x20a/0x326 net/netfilter/nf_conntrack_netlink.c:1554
    [<00000000385a38da>] nfnetlink_rcv_msg+0x32f/0x370 net/netfilter/nfnetlink.c:229
    [<00000000bb3b1fc1>] netlink_rcv_skb+0x5a/0x180 net/netlink/af_netlink.c:2469
    [<00000000b2799dbb>] nfnetlink_rcv+0x83/0x1b0 net/netfilter/nfnetlink.c:563
    [<000000006021f56a>] netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
    [<000000006021f56a>] netlink_unicast+0x20a/0x2f0 net/netlink/af_netlink.c:1329
    [<000000003a4cd173>] netlink_sendmsg+0x2b5/0x560 net/netlink/af_netlink.c:1918
    [<00000000ff287393>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000ff287393>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<000000008c32b330>] ____sys_sendmsg+0x2c4/0x2f0 net/socket.c:2352
    [<00000000a8f57b1b>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2406
    [<000000002c938bcf>] __sys_sendmsg+0x77/0xe0 net/socket.c:2439
    [<00000000878f0bd0>] do_syscall_64+0x6e/0x220 arch/x86/entry/common.c:295
    [<00000000dcd0e014>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811ac32a00 (size 128):
  comm "syz-executor470", pid 6432, jiffies 4294946459 (age 7.710s)
  hex dump (first 32 bytes):
    00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000da2809df>] kmalloc include/linux/slab.h:555 [inline]
    [<00000000da2809df>] kzalloc include/linux/slab.h:669 [inline]
    [<00000000da2809df>] ctnetlink_alloc_filter+0x3a/0x2a0 net/netfilter/nf_conntrack_netlink.c:924
    [<00000000745f0fc9>] ctnetlink_flush_conntrack net/netfilter/nf_conntrack_netlink.c:1516 [inline]
    [<00000000745f0fc9>] ctnetlink_del_conntrack+0x20a/0x326 net/netfilter/nf_conntrack_netlink.c:1554
    [<00000000385a38da>] nfnetlink_rcv_msg+0x32f/0x370 net/netfilter/nfnetlink.c:229
    [<00000000bb3b1fc1>] netlink_rcv_skb+0x5a/0x180 net/netlink/af_netlink.c:2469
    [<00000000b2799dbb>] nfnetlink_rcv+0x83/0x1b0 net/netfilter/nfnetlink.c:563
    [<000000006021f56a>] netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
    [<000000006021f56a>] netlink_unicast+0x20a/0x2f0 net/netlink/af_netlink.c:1329
    [<000000003a4cd173>] netlink_sendmsg+0x2b5/0x560 net/netlink/af_netlink.c:1918
    [<00000000ff287393>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000ff287393>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<000000008c32b330>] ____sys_sendmsg+0x2c4/0x2f0 net/socket.c:2352
    [<00000000a8f57b1b>] ___sys_sendmsg+0x8a/0xd0 net/socket.c:2406
    [<000000002c938bcf>] __sys_sendmsg+0x77/0xe0 net/socket.c:2439
    [<00000000878f0bd0>] do_syscall_64+0x6e/0x220 arch/x86/entry/common.c:295
    [<00000000dcd0e014>] entry_SYSCALL_64_after_hwframe+0x44/0xa9


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/06/07 07:13 upstream 7ae77150d94d e6b89e4e .config console log report syz C ci-upstream-gce-leak
* Struck through repros no longer work on HEAD.