All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+57281c762a3922e14dfe@syzkaller.appspotmail.com>
To: a.darwish@linutronix.de, bigeasy@linutronix.de,
	gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org,
	linux-usb@vger.kernel.org, minhquangbui99@gmail.com,
	stern@rowland.harvard.edu, syzkaller-bugs@googlegroups.com,
	tglx@linutronix.de
Subject: Re: memory leak in mcba_usb_probe
Date: Sun, 10 Jan 2021 01:09:09 -0800	[thread overview]
Message-ID: <00000000000065b02205b8882492@google.com> (raw)
In-Reply-To: <20210110085436.3616-1-minhquangbui99@gmail.com>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in rxrpc_lookup_local

BUG: memory leak
unreferenced object 0xffff888118b2f300 (size 256):
  comm "syz-executor.5", pid 8860, jiffies 4294944050 (age 373.640s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 0a 00 00 00 00 80 c3 18 81 88 ff ff  ................
  backtrace:
    [<00000000799c996d>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000799c996d>] kzalloc include/linux/slab.h:682 [inline]
    [<00000000799c996d>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
    [<00000000799c996d>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
    [<00000000a9547b72>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
    [<00000000c8d0f9b2>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
    [<0000000029791b25>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
    [<000000005937929d>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
    [<0000000064e0e1db>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
    [<00000000ca4d5a61>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
    [<0000000029feabb4>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
    [<000000005ce44751>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [<000000003c257699>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
    [<000000001788a4be>] __do_sys_unshare kernel/fork.c:3025 [inline]
    [<000000001788a4be>] __se_sys_unshare kernel/fork.c:3023 [inline]
    [<000000001788a4be>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
    [<00000000db77e81f>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<0000000052c5dd81>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118afb200 (size 256):
  comm "syz-executor.0", pid 8858, jiffies 4294944054 (age 373.600s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 0a 00 00 00 00 00 92 18 81 88 ff ff  ................
  backtrace:
    [<00000000799c996d>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000799c996d>] kzalloc include/linux/slab.h:682 [inline]
    [<00000000799c996d>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
    [<00000000799c996d>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
    [<00000000a9547b72>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
    [<00000000c8d0f9b2>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
    [<0000000029791b25>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
    [<000000005937929d>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
    [<0000000064e0e1db>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
    [<00000000ca4d5a61>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
    [<0000000029feabb4>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
    [<000000005ce44751>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [<000000003c257699>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
    [<000000001788a4be>] __do_sys_unshare kernel/fork.c:3025 [inline]
    [<000000001788a4be>] __se_sys_unshare kernel/fork.c:3023 [inline]
    [<000000001788a4be>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
    [<00000000db77e81f>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<0000000052c5dd81>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881189f4800 (size 256):
  comm "syz-executor.6", pid 8856, jiffies 4294944054 (age 373.600s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 0a 00 00 00 00 c0 56 18 81 88 ff ff  ..........V.....
  backtrace:
    [<00000000799c996d>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000799c996d>] kzalloc include/linux/slab.h:682 [inline]
    [<00000000799c996d>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
    [<00000000799c996d>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
    [<00000000a9547b72>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
    [<00000000c8d0f9b2>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
    [<0000000029791b25>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
    [<000000005937929d>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
    [<0000000064e0e1db>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
    [<00000000ca4d5a61>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
    [<0000000029feabb4>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
    [<000000005ce44751>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [<000000003c257699>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
    [<000000001788a4be>] __do_sys_unshare kernel/fork.c:3025 [inline]
    [<000000001788a4be>] __se_sys_unshare kernel/fork.c:3023 [inline]
    [<000000001788a4be>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
    [<00000000db77e81f>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<0000000052c5dd81>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888118c34100 (size 256):
  comm "syz-executor.2", pid 8861, jiffies 4294944055 (age 373.590s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 0a 00 00 00 00 40 56 18 81 88 ff ff  .........@V.....
  backtrace:
    [<00000000799c996d>] kmalloc include/linux/slab.h:552 [inline]
    [<00000000799c996d>] kzalloc include/linux/slab.h:682 [inline]
    [<00000000799c996d>] rxrpc_alloc_local net/rxrpc/local_object.c:79 [inline]
    [<00000000799c996d>] rxrpc_lookup_local+0x1c1/0x760 net/rxrpc/local_object.c:244
    [<00000000a9547b72>] rxrpc_bind+0x174/0x240 net/rxrpc/af_rxrpc.c:149
    [<00000000c8d0f9b2>] afs_open_socket+0xdb/0x200 fs/afs/rxrpc.c:64
    [<0000000029791b25>] afs_net_init+0x2b4/0x340 fs/afs/main.c:126
    [<000000005937929d>] ops_init+0x4e/0x190 net/core/net_namespace.c:152
    [<0000000064e0e1db>] setup_net+0xde/0x2d0 net/core/net_namespace.c:342
    [<00000000ca4d5a61>] copy_net_ns+0x19f/0x3e0 net/core/net_namespace.c:483
    [<0000000029feabb4>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
    [<000000005ce44751>] unshare_nsproxy_namespaces+0x9b/0x120 kernel/nsproxy.c:226
    [<000000003c257699>] ksys_unshare+0x2fe/0x5c0 kernel/fork.c:2957
    [<000000001788a4be>] __do_sys_unshare kernel/fork.c:3025 [inline]
    [<000000001788a4be>] __se_sys_unshare kernel/fork.c:3023 [inline]
    [<000000001788a4be>] __x64_sys_unshare+0x12/0x20 kernel/fork.c:3023
    [<00000000db77e81f>] do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
    [<0000000052c5dd81>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



Tested on:

commit:         080e743d can: mcba_usb: Fix memory leak when cancelling urb
git tree:       https://github.com/minhbq-99/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1322c7a8d00000
kernel config:  https://syzkaller.appspot.com/x/.config?x=67a7baec24faba80
dashboard link: https://syzkaller.appspot.com/bug?extid=57281c762a3922e14dfe
compiler:       gcc (GCC) 10.1.0-syz 20200507


      parent reply	other threads:[~2021-01-10  9:10 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-21  8:54 memory leak in mcba_usb_probe syzbot
2021-01-10  8:54 ` Bui Quang Minh
2021-01-10  8:54   ` [PATCH] can: mcba_usb: Fix memory leak when cancelling urb Bui Quang Minh
2021-01-10  9:09   ` syzbot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=00000000000065b02205b8882492@google.com \
    --to=syzbot+57281c762a3922e14dfe@syzkaller.appspotmail.com \
    --cc=a.darwish@linutronix.de \
    --cc=bigeasy@linutronix.de \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=minhquangbui99@gmail.com \
    --cc=stern@rowland.harvard.edu \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.