syzbot


memory leak in hwsim_new_radio_nl

Status: fixed on 2023/07/01 16:05
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+904ce6fbb38532d9795c@syzkaller.appspotmail.com
Fix commit: 098abbd48ec1 mac80211_hwsim: fix memory leak in hwsim_new_radio_nl
First crash: 351d, last: 351d
Discussions (3)
Title Replies (including bot) Last reply
[PATCH net-next,v2] mac80211_hwsim: fix memory leak in hwsim_new_radio_nl 4 (4) 2023/05/15 13:05
[PATCH net-next] mac80211_hwsim: fix memory leak in hwsim_new_radio_nl 3 (3) 2023/05/15 09:07
[syzbot] [wireless?] memory leak in hwsim_new_radio_nl 1 (2) 2023/05/15 02:45

Sample crash report:
Warning: Permanently added '10.128.1.177' (ECDSA) to the list of known hosts.
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88810e2ac920 (size 32):
  comm "syz-executor238", pid 4983, jiffies 4294944120 (age 14.000s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815458a4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
    [<ffffffff830fc4fb>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff830fc4fb>] hwsim_new_radio_nl+0x43b/0x660 drivers/net/wireless/virtual/mac80211_hwsim.c:5962
    [<ffffffff83f4aa6e>] genl_family_rcv_msg_doit.isra.0+0xee/0x150 net/netlink/genetlink.c:968
    [<ffffffff83f4ada7>] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
    [<ffffffff83f4ada7>] genl_rcv_msg+0x2d7/0x430 net/netlink/genetlink.c:1065
    [<ffffffff83f49111>] netlink_rcv_skb+0x91/0x1e0 net/netlink/af_netlink.c:2546
    [<ffffffff83f4a118>] genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
    [<ffffffff83f4805b>] netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
    [<ffffffff83f4805b>] netlink_unicast+0x39b/0x4d0 net/netlink/af_netlink.c:1365
    [<ffffffff83f4852a>] netlink_sendmsg+0x39a/0x720 net/netlink/af_netlink.c:1913
    [<ffffffff83db5258>] sock_sendmsg_nosec net/socket.c:724 [inline]
    [<ffffffff83db5258>] sock_sendmsg+0x58/0xb0 net/socket.c:747
    [<ffffffff83db5817>] ____sys_sendmsg+0x397/0x430 net/socket.c:2503
    [<ffffffff83db9e08>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2557
    [<ffffffff83db9fac>] __sys_sendmsg+0x8c/0x100 net/socket.c:2586
    [<ffffffff84a127b9>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84a127b9>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810e2ac800 (size 32):
  comm "syz-executor238", pid 4984, jiffies 4294944700 (age 8.200s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff815458a4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
    [<ffffffff830fc4fb>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff830fc4fb>] hwsim_new_radio_nl+0x43b/0x660 drivers/net/wireless/virtual/mac80211_hwsim.c:5962
    [<ffffffff83f4aa6e>] genl_family_rcv_msg_doit.isra.0+0xee/0x150 net/netlink/genetlink.c:968
    [<ffffffff83f4ada7>] genl_family_rcv_msg net/netlink/genetlink.c:1048 [inline]
    [<ffffffff83f4ada7>] genl_rcv_msg+0x2d7/0x430 net/netlink/genetlink.c:1065
    [<ffffffff83f49111>] netlink_rcv_skb+0x91/0x1e0 net/netlink/af_netlink.c:2546
    [<ffffffff83f4a118>] genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
    [<ffffffff83f4805b>] netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
    [<ffffffff83f4805b>] netlink_unicast+0x39b/0x4d0 net/netlink/af_netlink.c:1365
    [<ffffffff83f4852a>] netlink_sendmsg+0x39a/0x720 net/netlink/af_netlink.c:1913
    [<ffffffff83db5258>] sock_sendmsg_nosec net/socket.c:724 [inline]
    [<ffffffff83db5258>] sock_sendmsg+0x58/0xb0 net/socket.c:747
    [<ffffffff83db5817>] ____sys_sendmsg+0x397/0x430 net/socket.c:2503
    [<ffffffff83db9e08>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2557
    [<ffffffff83db9fac>] __sys_sendmsg+0x8c/0x100 net/socket.c:2586
    [<ffffffff84a127b9>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff84a127b9>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/05/11 23:04 upstream 105131df9c3b adb9a3cd .config console log report syz C ci-upstream-gce-leak memory leak in hwsim_new_radio_nl
* Struck through repros no longer work on HEAD.