All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com>
To: code@siddh.me, davem@davemloft.net, johannes@sipsolutions.net,
	kuba@kernel.org, linux-kernel@vger.kernel.org,
	linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] memory leak in cfg80211_inform_single_bss_frame_data
Date: Wed, 13 Jul 2022 03:35:06 -0700	[thread overview]
Message-ID: <000000000000b1b55a05e3ad5692@google.com> (raw)
In-Reply-To: <181f7180015.1ea4d3b3328398.7889962633178976958@siddh.me>

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in regulatory_init_db

BUG: memory leak
unreferenced object 0xffff888145137a00 (size 64):
  comm "swapper/0", pid 1, jiffies 4294937939 (age 68.850s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    ff ff ff ff 00 00 00 00 00 00 00 00 30 30 00 00  ............00..
  backtrace:
    [<ffffffff86ff026b>] kmalloc include/linux/slab.h:600 [inline]
    [<ffffffff86ff026b>] kzalloc include/linux/slab.h:733 [inline]
    [<ffffffff86ff026b>] regulatory_hint_core net/wireless/reg.c:3216 [inline]
    [<ffffffff86ff026b>] regulatory_init_db+0x22f/0x2de net/wireless/reg.c:4277
    [<ffffffff81000fe3>] do_one_initcall+0x63/0x2e0 init/main.c:1295
    [<ffffffff86f4eb10>] do_initcall_level init/main.c:1368 [inline]
    [<ffffffff86f4eb10>] do_initcalls init/main.c:1384 [inline]
    [<ffffffff86f4eb10>] do_basic_setup init/main.c:1403 [inline]
    [<ffffffff86f4eb10>] kernel_init_freeable+0x255/0x2cf init/main.c:1610
    [<ffffffff845b427a>] kernel_init+0x1a/0x1c0 init/main.c:1499
    [<ffffffff8100225f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

BUG: memory leak
unreferenced object 0xffff88810a760180 (size 96):
  comm "kworker/u4:2", pid 43, jiffies 4294943904 (age 9.220s)
  hex dump (first 32 bytes):
    fa fd 93 53 ad e3 05 00 00 00 00 00 00 00 00 00  ...S............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff840740b6>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8407461b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff84115816>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff841240e2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff841240e2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff841240e2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff84126b81>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff84126b81>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8127130f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff81271c39>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff8127b955>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100225f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

BUG: memory leak
unreferenced object 0xffff88810a760100 (size 96):
  comm "kworker/u4:0", pid 8, jiffies 4294943986 (age 8.400s)
  hex dump (first 32 bytes):
    36 80 a0 53 ad e3 05 00 00 00 00 00 00 00 00 00  6..S............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff840740b6>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8407461b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff84115816>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff841240e2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff841240e2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff841240e2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff84126b81>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff84126b81>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8127130f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff81271c39>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff8127b955>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100225f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

BUG: memory leak
unreferenced object 0xffff888114cb9100 (size 96):
  comm "kworker/u4:3", pid 53, jiffies 4294944017 (age 8.090s)
  hex dump (first 32 bytes):
    95 32 a5 53 ad e3 05 00 00 00 00 00 00 00 00 00  .2.S............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff840740b6>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8407461b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff84115816>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff841240e2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff841240e2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff841240e2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff84126b81>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff84126b81>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8127130f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff81271c39>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff8127b955>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100225f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

BUG: memory leak
unreferenced object 0xffff888114afa500 (size 96):
  comm "kworker/u4:3", pid 53, jiffies 4294944037 (age 7.890s)
  hex dump (first 32 bytes):
    1c 46 a8 53 ad e3 05 00 00 00 00 00 00 00 00 00  .F.S............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff840740b6>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8407461b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff84115816>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff841240e2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff841240e2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff841240e2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff84126b81>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff84126b81>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8127130f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff81271c39>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff8127b955>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100225f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

[   75.59820


Tested on:

commit:         b047602d Merge tag 'trace-v5.19-rc5' of git://git.kern..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10cfa478080000
kernel config:  https://syzkaller.appspot.com/x/.config?x=689b5fe7168a1260
dashboard link: https://syzkaller.appspot.com/bug?extid=7a942657a255a9d9b18a
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

Note: no patches were applied.

      reply	other threads:[~2022-07-13 10:35 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-02 16:37 [syzbot] memory leak in cfg80211_inform_single_bss_frame_data syzbot
2021-10-25 22:33 ` syzbot
2021-10-26  9:27   ` Fabio M. De Francesco
2022-07-13  8:56 ` Siddh Raman Pant
2022-07-13  8:58   ` Siddh Raman Pant
2022-07-13  9:08     ` syzbot
2022-07-13 10:25       ` Siddh Raman Pant
2022-07-13 10:35         ` syzbot [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=000000000000b1b55a05e3ad5692@google.com \
    --to=syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com \
    --cc=code@siddh.me \
    --cc=davem@davemloft.net \
    --cc=johannes@sipsolutions.net \
    --cc=kuba@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.