syzbot

 sign-in | mailing list | source | docs
🐞 Open [1167] ≡ Subsystems 🐞 Fixed [4402] 🐞 Invalid [9898] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes 💬 Send us feedback

memory leak in sctp_packet_transmit

Status: upstream: reported C repro on 2020/07/22 20:32
Subsystems: sctp (incorrect?)
Reported-by: syzbot+8bb053b5d63595ab47db@syzkaller.appspotmail.com
First crash: 973d, last: 132d
Last patch testing requests:
Created Duration User Patch Repo Result
2022/11/10 17:30 9m retest repro upstream report log
2021/08/04 01:06 16m phind.uet@gmail.com linux-next OK
2021/04/15 09:23 8m phil@philpotter.co.uk upstream report log
2020/10/16 23:42 8m anant.thazhemadam@gmail.com upstream report log

Sample crash report:
executing program
BUG: memory leak
unreferenced object 0xffff88810a3ecf00 (size 232):
  comm "syz-executor766", pid 3604, jiffies 4294947015 (age 12.590s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 f0 a0 01 81 88 ff ff 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83824026>] __alloc_skb+0x216/0x290 net/core/skbuff.c:414
    [<ffffffff83fdd7b9>] alloc_skb include/linux/skbuff.h:1300 [inline]
    [<ffffffff83fdd7b9>] sctp_packet_transmit+0xa9/0xc80 net/sctp/output.c:597
    [<ffffffff83fc13d1>] sctp_outq_flush_transports+0x151/0x1c0 net/sctp/outqueue.c:1170
    [<ffffffff83fc412f>] sctp_outq_flush net/sctp/outqueue.c:1218 [inline]
    [<ffffffff83fc412f>] sctp_outq_uncork+0xaf/0xd0 net/sctp/outqueue.c:761
    [<ffffffff83faad22>] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1816 [inline]
    [<ffffffff83faad22>] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
    [<ffffffff83faad22>] sctp_do_sm+0x312/0x2290 net/sctp/sm_sideeffect.c:1170
    [<ffffffff83fb1b03>] sctp_assoc_bh_rcv+0x1e3/0x300 net/sctp/associola.c:1054
    [<ffffffff83fc0cf3>] sctp_inq_push+0x93/0xc0 net/sctp/inqueue.c:80
    [<ffffffff83fdf272>] sctp_backlog_rcv+0xa2/0x4f0 net/sctp/input.c:344
    [<ffffffff8381ebae>] sk_backlog_rcv include/net/sock.h:1051 [inline]
    [<ffffffff8381ebae>] __release_sock+0xbe/0x140 net/core/sock.c:2794
    [<ffffffff8381ec62>] release_sock+0x32/0xd0 net/core/sock.c:3327
    [<ffffffff83fcce92>] sctp_wait_for_connect+0xd2/0x290 net/sctp/socket.c:9316
    [<ffffffff83fce3d6>] sctp_sendmsg_to_asoc+0xd66/0xdb0 net/sctp/socket.c:1881
    [<ffffffff83fd6c6f>] sctp_sendmsg+0x99f/0x1030 net/sctp/socket.c:2027
    [<ffffffff83bc1505>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:819
    [<ffffffff838124a6>] sock_sendmsg_nosec net/socket.c:705 [inline]
    [<ffffffff838124a6>] sock_sendmsg+0x56/0x80 net/socket.c:725
    [<ffffffff8381544c>] __sys_sendto+0x15c/0x200 net/socket.c:2040

BUG: memory leak
unreferenced object 0xffff88810d547200 (size 232):
  comm "syz-executor766", pid 3607, jiffies 4294947538 (age 7.360s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83824026>] __alloc_skb+0x216/0x290 net/core/skbuff.c:414
    [<ffffffff83fddb37>] alloc_skb include/linux/skbuff.h:1300 [inline]
    [<ffffffff83fddb37>] sctp_packet_pack net/sctp/output.c:471 [inline]
    [<ffffffff83fddb37>] sctp_packet_transmit+0x427/0xc80 net/sctp/output.c:620
    [<ffffffff83fc13d1>] sctp_outq_flush_transports+0x151/0x1c0 net/sctp/outqueue.c:1170
    [<ffffffff83fc412f>] sctp_outq_flush net/sctp/outqueue.c:1218 [inline]
    [<ffffffff83fc412f>] sctp_outq_uncork+0xaf/0xd0 net/sctp/outqueue.c:761
    [<ffffffff83faad22>] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1816 [inline]
    [<ffffffff83faad22>] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
    [<ffffffff83faad22>] sctp_do_sm+0x312/0x2290 net/sctp/sm_sideeffect.c:1170
    [<ffffffff83fb1b03>] sctp_assoc_bh_rcv+0x1e3/0x300 net/sctp/associola.c:1054
    [<ffffffff83fc0cf3>] sctp_inq_push+0x93/0xc0 net/sctp/inqueue.c:80
    [<ffffffff83fdf272>] sctp_backlog_rcv+0xa2/0x4f0 net/sctp/input.c:344
    [<ffffffff8381ebae>] sk_backlog_rcv include/net/sock.h:1051 [inline]
    [<ffffffff8381ebae>] __release_sock+0xbe/0x140 net/core/sock.c:2794
    [<ffffffff8381ec62>] release_sock+0x32/0xd0 net/core/sock.c:3327
    [<ffffffff83fcce92>] sctp_wait_for_connect+0xd2/0x290 net/sctp/socket.c:9316
    [<ffffffff83fce3d6>] sctp_sendmsg_to_asoc+0xd66/0xdb0 net/sctp/socket.c:1881
    [<ffffffff83fd6c6f>] sctp_sendmsg+0x99f/0x1030 net/sctp/socket.c:2027
    [<ffffffff83bc1505>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:819
    [<ffffffff838124a6>] sock_sendmsg_nosec net/socket.c:705 [inline]
    [<ffffffff838124a6>] sock_sendmsg+0x56/0x80 net/socket.c:725
    [<ffffffff8381544c>] __sys_sendto+0x15c/0x200 net/socket.c:2040

BUG: memory leak
unreferenced object 0xffff888109ada800 (size 2048):
  comm "syz-executor766", pid 3607, jiffies 4294947538 (age 7.360s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83823ef3>] kmalloc_reserve net/core/skbuff.c:354 [inline]
    [<ffffffff83823ef3>] __alloc_skb+0xe3/0x290 net/core/skbuff.c:426
    [<ffffffff83fddb37>] alloc_skb include/linux/skbuff.h:1300 [inline]
    [<ffffffff83fddb37>] sctp_packet_pack net/sctp/output.c:471 [inline]
    [<ffffffff83fddb37>] sctp_packet_transmit+0x427/0xc80 net/sctp/output.c:620
    [<ffffffff83fc13d1>] sctp_outq_flush_transports+0x151/0x1c0 net/sctp/outqueue.c:1170
    [<ffffffff83fc412f>] sctp_outq_flush net/sctp/outqueue.c:1218 [inline]
    [<ffffffff83fc412f>] sctp_outq_uncork+0xaf/0xd0 net/sctp/outqueue.c:761
    [<ffffffff83faad22>] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1816 [inline]
    [<ffffffff83faad22>] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
    [<ffffffff83faad22>] sctp_do_sm+0x312/0x2290 net/sctp/sm_sideeffect.c:1170
    [<ffffffff83fb1b03>] sctp_assoc_bh_rcv+0x1e3/0x300 net/sctp/associola.c:1054
    [<ffffffff83fc0cf3>] sctp_inq_push+0x93/0xc0 net/sctp/inqueue.c:80
    [<ffffffff83fdf272>] sctp_backlog_rcv+0xa2/0x4f0 net/sctp/input.c:344
    [<ffffffff8381ebae>] sk_backlog_rcv include/net/sock.h:1051 [inline]
    [<ffffffff8381ebae>] __release_sock+0xbe/0x140 net/core/sock.c:2794
    [<ffffffff8381ec62>] release_sock+0x32/0xd0 net/core/sock.c:3327
    [<ffffffff83fcce92>] sctp_wait_for_connect+0xd2/0x290 net/sctp/socket.c:9316
    [<ffffffff83fce3d6>] sctp_sendmsg_to_asoc+0xd66/0xdb0 net/sctp/socket.c:1881
    [<ffffffff83fd6c6f>] sctp_sendmsg+0x99f/0x1030 net/sctp/socket.c:2027
    [<ffffffff83bc1505>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:819
    [<ffffffff838124a6>] sock_sendmsg_nosec net/socket.c:705 [inline]
    [<ffffffff838124a6>] sock_sendmsg+0x56/0x80 net/socket.c:725
    [<ffffffff8381544c>] __sys_sendto+0x15c/0x200 net/socket.c:2040

Crashes (12):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets Title
ci-upstream-gce-leak 2022/05/13 16:46 upstream f3f19f939c11 107f6434 .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/07/08 13:51 upstream 3dbdb38e2869 95793bce .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/06/10 05:42 upstream cd1245d75ce9 1ba81399 .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/04/14 16:43 upstream 50987beca096 3134b37f .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/03/11 18:32 upstream a74e6a014c9d c2ca1f2a .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/02/07 01:49 upstream 964d069f93c4 0655e081 .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/02/03 11:47 upstream 3aaf0a27ffc2 624dad51 .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/02/01 04:27 upstream 6642d600b541 fc9fd31e .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/01/24 18:31 upstream e1ae4b0be158 52e37319 .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/01/22 16:35 upstream 9f29bd8b2e71 d4f4eca5 .config console log report syz C memory leak in sctp_packet_transmit
ci-upstream-gce-leak 2021/01/16 22:00 upstream 1d94330a437a 65a7a854 .config console log report syz C
ci-upstream-gce-leak 2020/07/22 17:57 upstream 4fa640dc5230 128cd85f .config console log report syz C
* Struck through repros no longer work on HEAD.