memory leak in kcm

memory leak in kcm_sendmsg
Status: upstream: reported C repro on 2020/02/13 18:37
Reported-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
First crash: 148d, last: 8d21h

Sample crash report:

executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff888118cc4700 (size 224):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    00 45 cc 18 81 88 ff ff 00 00 00 00 00 00 00 00  .E..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811c5e9200 (size 512):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    6c 69 62 75 64 65 76 00 fe ed ca fe 28 00 00 00  libudev.....(...
    28 00 00 00 94 00 00 00 8a fa 90 c8 00 00 00 00  (...............
  backtrace:
    [<00000000f3b93311>] __kmalloc_reserve net/core/skbuff.c:142 [inline]
    [<00000000f3b93311>] __alloc_skb+0x99/0x250 net/core/skbuff.c:210
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118cc4500 (size 224):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    00 44 cc 18 81 88 ff ff 00 00 00 00 00 00 00 00  .D..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811c5e9800 (size 512):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    61 64 64 40 2f 64 65 76 69 63 65 73 2f 76 69 72  add@/devices/vir
    74 75 61 6c 2f 74 74 79 2f 70 74 79 72 31 00 41  tual/tty/ptyr1.A
  backtrace:
    [<00000000f3b93311>] __kmalloc_reserve net/core/skbuff.c:142 [inline]
    [<00000000f3b93311>] __alloc_skb+0x99/0x250 net/core/skbuff.c:210
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118cc4400 (size 224):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    00 46 cc 18 81 88 ff ff 00 00 00 00 00 00 00 00  .F..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	Maintainers
ci-upstream-gce-leak	2020/07/02 08:53	upstream	cd77006e	bed10395	.config	log	report	syz	C	andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, john.fastabend@gmail.com, jonathan.lemon@gmail.com, kafai@fb.com, kpsingh@chromium.org, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, samitolvanen@google.com, songliubraving@fb.com, willy@infradead.org, yhs@fb.com
ci-upstream-gce-leak	2020/02/13 09:30	upstream	f2850dd5	84f4fc8a	.config	log	report	syz	C	andriin@fb.com, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, edumazet@google.com, jslaby@suse.cz, kafai@fb.com, kuba@kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, songliubraving@fb.com, tglx@linutronix.de, willy@infradead.org, yhs@fb.com