memory leak in kcm

memory leak in kcm_sendmsg
Status: upstream: reported C repro on 2020/02/13 18:37
Reported-by: syzbot+b039f5699bd82e1fb011@syzkaller.appspotmail.com
Fix commit: c47cc304 net: kcm: fix memory leak in kcm_sendmsg
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32 ci-qemu2-riscv64 ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root]
First crash: 492d, last: 352d

Patch testing requests:
Created	Duration	User	Patch	Repo	Result
2021/06/02 19:06	16m	paskripkin@gmail.com	patch	upstream	OK
2020/10/05 05:57	7m	anant.thazhemadam@gmail.com	patch	upstream	report log
2020/10/05 02:54	8m	anant.thazhemadam@gmail.com		upstream	report log

Sample crash report:

executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff888118cc4700 (size 224):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    00 45 cc 18 81 88 ff ff 00 00 00 00 00 00 00 00  .E..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811c5e9200 (size 512):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    6c 69 62 75 64 65 76 00 fe ed ca fe 28 00 00 00  libudev.....(...
    28 00 00 00 94 00 00 00 8a fa 90 c8 00 00 00 00  (...............
  backtrace:
    [<00000000f3b93311>] __kmalloc_reserve net/core/skbuff.c:142 [inline]
    [<00000000f3b93311>] __alloc_skb+0x99/0x250 net/core/skbuff.c:210
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118cc4500 (size 224):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    00 44 cc 18 81 88 ff ff 00 00 00 00 00 00 00 00  .D..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811c5e9800 (size 512):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    61 64 64 40 2f 64 65 76 69 63 65 73 2f 76 69 72  add@/devices/vir
    74 75 61 6c 2f 74 74 79 2f 70 74 79 72 31 00 41  tual/tty/ptyr1.A
  backtrace:
    [<00000000f3b93311>] __kmalloc_reserve net/core/skbuff.c:142 [inline]
    [<00000000f3b93311>] __alloc_skb+0x99/0x250 net/core/skbuff.c:210
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118cc4400 (size 224):
  comm "syz-executor425", pid 6443, jiffies 4294943726 (age 13.140s)
  hex dump (first 32 bytes):
    00 46 cc 18 81 88 ff ff 00 00 00 00 00 00 00 00  .F..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000094c02615>] __alloc_skb+0x5e/0x250 net/core/skbuff.c:198
    [<00000000e5386cbd>] alloc_skb include/linux/skbuff.h:1083 [inline]
    [<00000000e5386cbd>] kcm_sendmsg+0x3b6/0xa50 net/kcm/kcmsock.c:967
    [<00000000f1613a8a>] sock_sendmsg_nosec net/socket.c:652 [inline]
    [<00000000f1613a8a>] sock_sendmsg+0x4c/0x60 net/socket.c:672
    [<00000000aba7096c>] ____sys_sendmsg+0x118/0x2f0 net/socket.c:2352
    [<000000007cd4be39>] ___sys_sendmsg+0x81/0xc0 net/socket.c:2406
    [<0000000098b1ee50>] __sys_sendmmsg+0xda/0x230 net/socket.c:2496
    [<000000009a409d75>] __do_sys_sendmmsg net/socket.c:2525 [inline]
    [<000000009a409d75>] __se_sys_sendmmsg net/socket.c:2522 [inline]
    [<000000009a409d75>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2522
    [<0000000045f49211>] do_syscall_64+0x4c/0xe0 arch/x86/entry/common.c:359
    [<0000000053b1fefd>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Title
ci-upstream-gce-leak	2020/07/02 08:53	upstream	cd77006e	bed10395	.config	log	report	syz	C
ci-upstream-gce-leak	2020/02/13 09:30	upstream	f2850dd5	84f4fc8a	.config	log	report	syz	C