syzbot


memory leak in tun_chr_open

Status: fixed on 2023/02/24 13:50
Subsystems: net
[Documentation on labels]
Fix commit: 1118b2049d77 net: tun: Fix memory leaks of napi_get_frags
First crash: 596d, last: 596d

Sample crash report:
executing program
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88810e604800 (size 2048):
  comm "syz-executor388", pid 3719, jiffies 4294951967 (age 23.760s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace:
    [<ffffffff8386ccad>] kmalloc include/linux/slab.h:605 [inline]
    [<ffffffff8386ccad>] sk_prot_alloc+0xcd/0x1b0 net/core/sock.c:1976
    [<ffffffff8386ed92>] sk_alloc+0x32/0x2e0 net/core/sock.c:2029
    [<ffffffff82a20b76>] tun_chr_open+0x36/0x170 drivers/net/tun.c:3419
    [<ffffffff8267d09f>] misc_open+0x19f/0x1f0 drivers/char/misc.c:143
    [<ffffffff815ece6d>] chrdev_open+0x10d/0x340 fs/char_dev.c:414
    [<ffffffff815db9c6>] do_dentry_open+0x1e6/0x750 fs/open.c:878
    [<ffffffff81602296>] do_open fs/namei.c:3557 [inline]
    [<ffffffff81602296>] path_openat+0x1756/0x1be0 fs/namei.c:3691
    [<ffffffff81604fc1>] do_filp_open+0xc1/0x1b0 fs/namei.c:3718
    [<ffffffff815df3cd>] do_sys_openat2+0xed/0x260 fs/open.c:1311
    [<ffffffff815dfe1f>] do_sys_open fs/open.c:1327 [inline]
    [<ffffffff815dfe1f>] __do_sys_openat fs/open.c:1343 [inline]
    [<ffffffff815dfe1f>] __se_sys_openat fs/open.c:1338 [inline]
    [<ffffffff815dfe1f>] __x64_sys_openat+0x7f/0xe0 fs/open.c:1338
    [<ffffffff845e56f5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff845e56f5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810e607840 (size 32):
  comm "syz-executor388", pid 3719, jiffies 4294951967 (age 23.760s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff822645f3>] kmalloc include/linux/slab.h:600 [inline]
    [<ffffffff822645f3>] kzalloc include/linux/slab.h:733 [inline]
    [<ffffffff822645f3>] apparmor_sk_alloc_security+0x53/0xd0 security/apparmor/lsm.c:812
    [<ffffffff82229cc1>] security_sk_alloc+0x31/0x70 security/security.c:2279
    [<ffffffff8386ccc8>] sk_prot_alloc+0xe8/0x1b0 net/core/sock.c:1979
    [<ffffffff8386ed92>] sk_alloc+0x32/0x2e0 net/core/sock.c:2029
    [<ffffffff82a20b76>] tun_chr_open+0x36/0x170 drivers/net/tun.c:3419
    [<ffffffff8267d09f>] misc_open+0x19f/0x1f0 drivers/char/misc.c:143
    [<ffffffff815ece6d>] chrdev_open+0x10d/0x340 fs/char_dev.c:414
    [<ffffffff815db9c6>] do_dentry_open+0x1e6/0x750 fs/open.c:878
    [<ffffffff81602296>] do_open fs/namei.c:3557 [inline]
    [<ffffffff81602296>] path_openat+0x1756/0x1be0 fs/namei.c:3691
    [<ffffffff81604fc1>] do_filp_open+0xc1/0x1b0 fs/namei.c:3718
    [<ffffffff815df3cd>] do_sys_openat2+0xed/0x260 fs/open.c:1311
    [<ffffffff815dfe1f>] do_sys_open fs/open.c:1327 [inline]
    [<ffffffff815dfe1f>] __do_sys_openat fs/open.c:1343 [inline]
    [<ffffffff815dfe1f>] __se_sys_openat fs/open.c:1338 [inline]
    [<ffffffff815dfe1f>] __x64_sys_openat+0x7f/0xe0 fs/open.c:1338
    [<ffffffff845e56f5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff845e56f5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810e21f600 (size 240):
  comm "syz-executor388", pid 3719, jiffies 4294951968 (age 23.750s)
  hex dump (first 32 bytes):
    68 49 60 0e 81 88 ff ff 68 49 60 0e 81 88 ff ff  hI`.....hI`.....
    00 40 ea 0a 81 88 ff ff 00 48 60 0e 81 88 ff ff  .@.......H`.....
  backtrace:
    [<ffffffff83877d69>] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:418
    [<ffffffff8387e76a>] alloc_skb include/linux/skbuff.h:1257 [inline]
    [<ffffffff8387e76a>] alloc_skb_with_frags+0x6a/0x340 net/core/skbuff.c:6017
    [<ffffffff8387129f>] sock_alloc_send_pskb+0x39f/0x3d0 net/core/sock.c:2665
    [<ffffffff82a289b7>] tun_alloc_skb drivers/net/tun.c:1520 [inline]
    [<ffffffff82a289b7>] tun_get_user+0x577/0x1df0 drivers/net/tun.c:1833
    [<ffffffff82a2af2d>] tun_chr_write_iter+0x6d/0x110 drivers/net/tun.c:2025
    [<ffffffff815e418d>] call_write_iter include/linux/fs.h:2187 [inline]
    [<ffffffff815e418d>] new_sync_write fs/read_write.c:491 [inline]
    [<ffffffff815e418d>] vfs_write+0x42d/0x540 fs/read_write.c:578
    [<ffffffff815e44dd>] ksys_write+0x9d/0x160 fs/read_write.c:631
    [<ffffffff845e56f5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff845e56f5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd


Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/09/08 08:36 upstream 0066f1b0e275 435aeef7 .config console log report syz C ci-upstream-gce-leak memory leak in tun_chr_open
* Struck through repros no longer work on HEAD.