Re: memory leak in nr_rx_frame (2)
syzbot has found a reproducer for the following crash on: HEAD commit:089cf7f6 Linux 5.3-rc7 git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1410053260 kernel config: https://syzkaller.appspot.com/x/.config?x=b10436cfda3838d9 dashboard link: https://syzkaller.appspot.com/bug?extid=0145ea560de205bc09f0 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=124dcf8e60 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=115f234660 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0145ea560de205bc0...@syzkaller.appspotmail.com executing program executing program executing program executing program executing program BUG: memory leak unreferenced object 0x88810de01800 (size 2048): comm "softirq", pid 0, jiffies 4294947090 (age 27.260s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@ backtrace: [<02377dcf>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<02377dcf>] slab_post_alloc_hook mm/slab.h:522 [inline] [<02377dcf>] slab_alloc mm/slab.c:3319 [inline] [<02377dcf>] __do_kmalloc mm/slab.c:3653 [inline] [<02377dcf>] __kmalloc+0x169/0x300 mm/slab.c:3664 [] kmalloc include/linux/slab.h:557 [inline] [ ] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603 [ ] sk_alloc+0x35/0x2f0 net/core/sock.c:1657 [ ] nr_make_new net/netrom/af_netrom.c:476 [inline] [ ] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959 [ ] nr_loopback_timer+0x4e/0xd0 net/netrom/nr_loopback.c:59 [<09d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322 [<47ea1d35>] expire_timers kernel/time/timer.c:1366 [inline] [<47ea1d35>] __run_timers kernel/time/timer.c:1685 [inline] [<47ea1d35>] __run_timers kernel/time/timer.c:1653 [inline] [<47ea1d35>] run_timer_softirq+0x256/0x740 kernel/time/timer.c:1698 [ ] __do_softirq+0x115/0x33f kernel/softirq.c:292 [<24be59bc>] invoke_softirq kernel/softirq.c:373 [inline] [<24be59bc>] irq_exit+0xbb/0xe0 kernel/softirq.c:413 [<80d19282>] exiting_irq arch/x86/include/asm/apic.h:537 [inline] [<80d19282>] smp_apic_timer_interrupt+0x96/0x190 arch/x86/kernel/apic/apic.c:1133 [<0e93dbd5>] apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 [<2864ce39>] native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:60 [<7e3841ad>] arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:571 [<546bc34f>] default_idle_call+0x1e/0x40 kernel/sched/idle.c:94 [ ] cpuidle_idle_call kernel/sched/idle.c:154 [inline] [ ] do_idle+0x1ea/0x2c0 kernel/sched/idle.c:263 [<1e3f823f>] cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:354 BUG: memory leak unreferenced object 0x88810fa3c9a0 (size 32): comm "softirq", pid 0, jiffies 4294947090 (age 27.260s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 backtrace: [ ] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [ ] slab_post_alloc_hook mm/slab.h:522 [inline] [ ] slab_alloc mm/slab.c:3319 [inline] [ ] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548 [<37f78c54>] kmalloc include/linux/slab.h:552 [inline] [<37f78c54>] kzalloc include/linux/slab.h:748 [inline] [<37f78c54>] selinux_sk_alloc_security+0x48/0xb0 security/selinux/hooks.c:5073 [<313a65ff>] security_sk_alloc+0x49/0x70 security/security.c:2029 [ ] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606 [ ] sk_alloc+0x35/0x2f0 net/core/sock.c:1657 [ ] nr_make_new net/netrom/af_netrom.c:476 [inline] [ ] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959 [ ] nr_loopback_timer+0x4e/0xd0 net/netrom/nr_loopback.c:59 [<09d4e723>] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322 [<47ea1d35>] expire_timers kernel/time/timer.c:1366 [inline] [<47ea1d35>] __run_timers kernel/time/timer.c:1685 [inline] [<47ea1d35>] __run_timers kernel/time/timer.c:1653 [inline] [<47ea1d35>] run_timer_softirq+0x256/0x740 kernel/time/timer.c:1698 [ ] __do_softirq+0x115/0x33f kernel/softirq.c:292 [<24be59bc>] invoke_softirq kernel/softirq.c:373 [inline]
memory leak in nr_rx_frame (2)
Hello, syzbot found the following crash on: HEAD commit:6525771f Merge tag 'arc-5.3-rc7' of git://git.kernel.org/p.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1020091260 kernel config: https://syzkaller.appspot.com/x/.config?x=e6131eafb9408877 dashboard link: https://syzkaller.appspot.com/bug?extid=0145ea560de205bc09f0 compiler: gcc (GCC) 9.0.0 20181231 (experimental) syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12b51f9c60 IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+0145ea560de205bc0...@syzkaller.appspotmail.com 2019/08/29 23:31:49 executed programs: 8 2019/08/29 23:31:56 executed programs: 15 2019/08/29 23:32:02 executed programs: 24 BUG: memory leak unreferenced object 0x888123355800 (size 2048): comm "softirq", pid 0, jiffies 4295062008 (age 25.620s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@ backtrace: [] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [ ] slab_post_alloc_hook mm/slab.h:522 [inline] [ ] slab_alloc mm/slab.c:3319 [inline] [ ] __do_kmalloc mm/slab.c:3653 [inline] [ ] __kmalloc+0x169/0x300 mm/slab.c:3664 [<3948180d>] kmalloc include/linux/slab.h:557 [inline] [<3948180d>] sk_prot_alloc+0x112/0x170 net/core/sock.c:1603 [ ] sk_alloc+0x35/0x2f0 net/core/sock.c:1657 [<4e2b1f5c>] nr_make_new net/netrom/af_netrom.c:476 [inline] [<4e2b1f5c>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959 [ ] nr_loopback_timer+0x4e/0xd0 net/netrom/nr_loopback.c:59 [ ] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322 [ ] expire_timers kernel/time/timer.c:1366 [inline] [ ] __run_timers kernel/time/timer.c:1685 [inline] [ ] __run_timers kernel/time/timer.c:1653 [inline] [ ] run_timer_softirq+0x256/0x740 kernel/time/timer.c:1698 [<8a8ac853>] __do_softirq+0x115/0x33f kernel/softirq.c:292 [ ] invoke_softirq kernel/softirq.c:373 [inline] [ ] irq_exit+0xbb/0xe0 kernel/softirq.c:413 [ ] exiting_irq arch/x86/include/asm/apic.h:537 [inline] [ ] smp_apic_timer_interrupt+0x96/0x190 arch/x86/kernel/apic/apic.c:1133 [<6a57c22f>] apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 [ ] arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline] [ ] console_unlock.part.0+0x5f0/0x6d0 kernel/printk/printk.c:2471 [<13f07031>] console_unlock kernel/printk/printk.c:2364 [inline] [<13f07031>] vprintk_emit+0x251/0x360 kernel/printk/printk.c:1986 [<704abaae>] vprintk_default+0x28/0x30 kernel/printk/printk.c:2013 [<8aa8a0ba>] vprintk_func+0x59/0xfa kernel/printk/printk_safe.c:386 [<4d884645>] printk+0x60/0x7d kernel/printk/printk.c:2046 BUG: memory leak unreferenced object 0x88810e8bd820 (size 32): comm "softirq", pid 0, jiffies 4295062008 (age 25.620s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 03 00 00 00 0f 00 00 00 00 00 00 00 backtrace: [<92f05cd5>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] [<92f05cd5>] slab_post_alloc_hook mm/slab.h:522 [inline] [<92f05cd5>] slab_alloc mm/slab.c:3319 [inline] [<92f05cd5>] kmem_cache_alloc_trace+0x145/0x2c0 mm/slab.c:3548 [ ] kmalloc include/linux/slab.h:552 [inline] [ ] kzalloc include/linux/slab.h:748 [inline] [ ] selinux_sk_alloc_security+0x48/0xb0 security/selinux/hooks.c:5073 [<2301f7f8>] security_sk_alloc+0x49/0x70 security/security.c:2029 [<9fb5708b>] sk_prot_alloc+0x12d/0x170 net/core/sock.c:1606 [ ] sk_alloc+0x35/0x2f0 net/core/sock.c:1657 [<4e2b1f5c>] nr_make_new net/netrom/af_netrom.c:476 [inline] [<4e2b1f5c>] nr_rx_frame+0x339/0x8ee net/netrom/af_netrom.c:959 [ ] nr_loopback_timer+0x4e/0xd0 net/netrom/nr_loopback.c:59 [ ] call_timer_fn+0x45/0x1e0 kernel/time/timer.c:1322 [ ] expire_timers kernel/time/timer.c:1366 [inline] [ ] __run_timers kernel/time/timer.c:1685 [inline] [ ] __run_timers kernel/time/timer.c:1653 [inline] [ ] run_timer_softirq+0x256/0x740 kernel/time/timer.c:1698 [<8a8ac853>] __do_softirq+0x115/0x33f
