syzbot


memory leak in nf_tables_addchain

Status: fixed on 2020/09/16 22:51
Subsystems: netfilter
[Documentation on labels]
Reported-by: syzbot+c99868fde67014f7e9f5@syzkaller.appspotmail.com
Fix commit: 59136aa3b264 netfilter: nf_tables: free chain context when BINDING flag is missing
First crash: 1527d, last: 1527d
Discussions (3)
Title Replies (including bot) Last reply
[PATCH 0/8] Netfilter fixes for net 10 (10) 2020/08/16 23:05
[PATCH nf] netfilter: free chain context when BINDING flag is missing 2 (2) 2020/08/13 02:17
memory leak in nf_tables_addchain 0 (1) 2020/08/11 17:07

Sample crash report:
executing program
BUG: memory leak
unreferenced object 0xffff888119189f80 (size 128):
  comm "syz-executor071", pid 6469, jiffies 4294944001 (age 12.440s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    90 9f 18 19 81 88 ff ff 90 9f 18 19 81 88 ff ff  ................
  backtrace:
    [<0000000004286457>] kmalloc include/linux/slab.h:554 [inline]
    [<0000000004286457>] kzalloc include/linux/slab.h:666 [inline]
    [<0000000004286457>] nf_tables_addchain.constprop.0+0x414/0x720 net/netfilter/nf_tables_api.c:2006
    [<0000000064582dc8>] nf_tables_newchain+0x74c/0x9d0 net/netfilter/nf_tables_api.c:2316
    [<000000009af54f85>] nfnetlink_rcv_batch+0x2fb/0x9e0 net/netfilter/nfnetlink.c:434
    [<000000000edcf8ff>] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:544 [inline]
    [<000000000edcf8ff>] nfnetlink_rcv+0x182/0x1b0 net/netfilter/nfnetlink.c:562
    [<00000000d8cb87ba>] netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
    [<00000000d8cb87ba>] netlink_unicast+0x2b6/0x3c0 net/netlink/af_netlink.c:1330
    [<00000000e133d3d8>] netlink_sendmsg+0x2ba/0x570 net/netlink/af_netlink.c:1919
    [<000000003f4dae42>] sock_sendmsg_nosec net/socket.c:651 [inline]
    [<000000003f4dae42>] sock_sendmsg+0x4c/0x60 net/socket.c:671
    [<00000000a38aa29c>] ____sys_sendmsg+0x2c4/0x2f0 net/socket.c:2359
    [<00000000a06b2c98>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2413
    [<00000000b3d1da45>] __sys_sendmsg+0x77/0xe0 net/socket.c:2446
    [<00000000e1124972>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<00000000f18a8a31>] entry_SYSCALL_64_after_hwframe+0x44/0xa9


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2020/08/09 04:13 upstream 449dc8c97089 f721e4a0 .config console log report syz C ci-upstream-gce-leak
* Struck through repros no longer work on HEAD.