All of lore.kernel.org
 help / color / mirror / Atom feed
From: syzbot <syzbot+d56eaa979f1a3d6e2e2e@syzkaller.appspotmail.com>
To: davem@davemloft.net, kernel@pengutronix.de, kuba@kernel.org,
	linux-can@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux@rempel-privat.de, mkl@pengutronix.de,
	netdev@vger.kernel.org, robin@protonic.nl,
	socketcan@hartkopp.net, syzkaller-bugs@googlegroups.com
Subject: [syzbot] memory leak in j1939_xtp_rx_rts
Date: Tue, 22 Jun 2021 10:24:24 -0700	[thread overview]
Message-ID: <000000000000b7bee505c55e0f20@google.com> (raw)

Hello,

syzbot found the following issue on:

HEAD commit:    fd0aa1a4 Merge tag 'for-linus' of git://git.kernel.org/pub..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=155c8d10300000
kernel config:  https://syzkaller.appspot.com/x/.config?x=6ec2526c74098317
dashboard link: https://syzkaller.appspot.com/bug?extid=d56eaa979f1a3d6e2e2e
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=110912a4300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d56eaa979f1a3d6e2e2e@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff888126b3d500 (size 232):
  comm "softirq", pid 0, jiffies 4294974634 (age 13.120s)
  hex dump (first 32 bytes):
    68 16 14 26 81 88 ff ff 68 16 14 26 81 88 ff ff  h..&....h..&....
    00 80 5d 22 81 88 ff ff 00 00 00 00 00 00 00 00  ..]"............
  backtrace:
    [<ffffffff836a0d5f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:413
    [<ffffffff83c599e1>] alloc_skb include/linux/skbuff.h:1107 [inline]
    [<ffffffff83c599e1>] j1939_session_fresh_new net/can/j1939/transport.c:1484 [inline]
    [<ffffffff83c599e1>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1578 [inline]
    [<ffffffff83c599e1>] j1939_xtp_rx_rts+0x451/0xac0 net/can/j1939/transport.c:1679
    [<ffffffff83c5a7eb>] j1939_tp_cmd_recv net/can/j1939/transport.c:1986 [inline]
    [<ffffffff83c5a7eb>] j1939_tp_recv+0x44b/0x640 net/can/j1939/transport.c:2067
    [<ffffffff83c515dc>] j1939_can_recv+0x2bc/0x420 net/can/j1939/main.c:101
    [<ffffffff83c43d98>] deliver net/can/af_can.c:574 [inline]
    [<ffffffff83c43d98>] can_rcv_filter+0xd8/0x290 net/can/af_can.c:608
    [<ffffffff83c44360>] can_receive+0xf0/0x140 net/can/af_can.c:665
    [<ffffffff83c4442d>] can_rcv+0x7d/0xf0 net/can/af_can.c:696
    [<ffffffff836d2e1a>] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5459
    [<ffffffff836d2ea7>] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5573
    [<ffffffff836d3234>] process_backlog+0xb4/0x1a0 net/core/dev.c:6437
    [<ffffffff836d54fd>] __napi_poll+0x3d/0x2a0 net/core/dev.c:6985
    [<ffffffff836d5cea>] napi_poll net/core/dev.c:7052 [inline]
    [<ffffffff836d5cea>] net_rx_action+0x32a/0x410 net/core/dev.c:7139
    [<ffffffff846000bf>] __do_softirq+0xbf/0x2ab kernel/softirq.c:559
    [<ffffffff81238a0c>] do_softirq kernel/softirq.c:460 [inline]
    [<ffffffff81238a0c>] do_softirq+0x5c/0x80 kernel/softirq.c:447
    [<ffffffff81238a81>] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:384
    [<ffffffff840bf0cd>] spin_unlock_bh include/linux/spinlock.h:399 [inline]
    [<ffffffff840bf0cd>] batadv_nc_purge_paths+0x19d/0x1f0 net/batman-adv/network-coding.c:467

BUG: memory leak
unreferenced object 0xffff888126141600 (size 512):
  comm "softirq", pid 0, jiffies 4294974634 (age 13.120s)
  hex dump (first 32 bytes):
    00 e0 9f 2a 81 88 ff ff 08 16 14 26 81 88 ff ff  ...*.......&....
    08 16 14 26 81 88 ff ff 18 16 14 26 81 88 ff ff  ...&.......&....
  backtrace:
    [<ffffffff83c552eb>] kmalloc include/linux/slab.h:556 [inline]
    [<ffffffff83c552eb>] kzalloc include/linux/slab.h:686 [inline]
    [<ffffffff83c552eb>] j1939_session_new+0x5b/0x160 net/can/j1939/transport.c:1443
    [<ffffffff83c59a78>] j1939_session_fresh_new net/can/j1939/transport.c:1495 [inline]
    [<ffffffff83c59a78>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1578 [inline]
    [<ffffffff83c59a78>] j1939_xtp_rx_rts+0x4e8/0xac0 net/can/j1939/transport.c:1679
    [<ffffffff83c5a7eb>] j1939_tp_cmd_recv net/can/j1939/transport.c:1986 [inline]
    [<ffffffff83c5a7eb>] j1939_tp_recv+0x44b/0x640 net/can/j1939/transport.c:2067
    [<ffffffff83c515dc>] j1939_can_recv+0x2bc/0x420 net/can/j1939/main.c:101
    [<ffffffff83c43d98>] deliver net/can/af_can.c:574 [inline]
    [<ffffffff83c43d98>] can_rcv_filter+0xd8/0x290 net/can/af_can.c:608
    [<ffffffff83c44360>] can_receive+0xf0/0x140 net/can/af_can.c:665
    [<ffffffff83c4442d>] can_rcv+0x7d/0xf0 net/can/af_can.c:696
    [<ffffffff836d2e1a>] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5459
    [<ffffffff836d2ea7>] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5573
    [<ffffffff836d3234>] process_backlog+0xb4/0x1a0 net/core/dev.c:6437
    [<ffffffff836d54fd>] __napi_poll+0x3d/0x2a0 net/core/dev.c:6985
    [<ffffffff836d5cea>] napi_poll net/core/dev.c:7052 [inline]
    [<ffffffff836d5cea>] net_rx_action+0x32a/0x410 net/core/dev.c:7139
    [<ffffffff846000bf>] __do_softirq+0xbf/0x2ab kernel/softirq.c:559
    [<ffffffff81238a0c>] do_softirq kernel/softirq.c:460 [inline]
    [<ffffffff81238a0c>] do_softirq+0x5c/0x80 kernel/softirq.c:447
    [<ffffffff81238a81>] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:384
    [<ffffffff840bf0cd>] spin_unlock_bh include/linux/spinlock.h:399 [inline]
    [<ffffffff840bf0cd>] batadv_nc_purge_paths+0x19d/0x1f0 net/batman-adv/network-coding.c:467

BUG: memory leak
unreferenced object 0xffff888126b3d300 (size 232):
  comm "softirq", pid 0, jiffies 4294974634 (age 13.120s)
  hex dump (first 32 bytes):
    68 08 05 27 81 88 ff ff 68 08 05 27 81 88 ff ff  h..'....h..'....
    00 00 0b 22 81 88 ff ff 00 00 00 00 00 00 00 00  ..."............
  backtrace:
    [<ffffffff836a0d5f>] __alloc_skb+0x20f/0x280 net/core/skbuff.c:413
    [<ffffffff83c599e1>] alloc_skb include/linux/skbuff.h:1107 [inline]
    [<ffffffff83c599e1>] j1939_session_fresh_new net/can/j1939/transport.c:1484 [inline]
    [<ffffffff83c599e1>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1578 [inline]
    [<ffffffff83c599e1>] j1939_xtp_rx_rts+0x451/0xac0 net/can/j1939/transport.c:1679
    [<ffffffff83c5a7eb>] j1939_tp_cmd_recv net/can/j1939/transport.c:1986 [inline]
    [<ffffffff83c5a7eb>] j1939_tp_recv+0x44b/0x640 net/can/j1939/transport.c:2067
    [<ffffffff83c515dc>] j1939_can_recv+0x2bc/0x420 net/can/j1939/main.c:101
    [<ffffffff83c43d98>] deliver net/can/af_can.c:574 [inline]
    [<ffffffff83c43d98>] can_rcv_filter+0xd8/0x290 net/can/af_can.c:608
    [<ffffffff83c44360>] can_receive+0xf0/0x140 net/can/af_can.c:665
    [<ffffffff83c4442d>] can_rcv+0x7d/0xf0 net/can/af_can.c:696
    [<ffffffff836d2e1a>] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5459
    [<ffffffff836d2ea7>] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5573
    [<ffffffff836d3234>] process_backlog+0xb4/0x1a0 net/core/dev.c:6437
    [<ffffffff836d54fd>] __napi_poll+0x3d/0x2a0 net/core/dev.c:6985
    [<ffffffff836d5cea>] napi_poll net/core/dev.c:7052 [inline]
    [<ffffffff836d5cea>] net_rx_action+0x32a/0x410 net/core/dev.c:7139
    [<ffffffff846000bf>] __do_softirq+0xbf/0x2ab kernel/softirq.c:559
    [<ffffffff81238a0c>] do_softirq kernel/softirq.c:460 [inline]
    [<ffffffff81238a0c>] do_softirq+0x5c/0x80 kernel/softirq.c:447
    [<ffffffff81238a81>] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:384
    [<ffffffff840bf0cd>] spin_unlock_bh include/linux/spinlock.h:399 [inline]
    [<ffffffff840bf0cd>] batadv_nc_purge_paths+0x19d/0x1f0 net/batman-adv/network-coding.c:467



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

                 reply	other threads:[~2021-06-22 17:24 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=000000000000b7bee505c55e0f20@google.com \
    --to=syzbot+d56eaa979f1a3d6e2e2e@syzkaller.appspotmail.com \
    --cc=davem@davemloft.net \
    --cc=kernel@pengutronix.de \
    --cc=kuba@kernel.org \
    --cc=linux-can@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux@rempel-privat.de \
    --cc=mkl@pengutronix.de \
    --cc=netdev@vger.kernel.org \
    --cc=robin@protonic.nl \
    --cc=socketcan@hartkopp.net \
    --cc=syzkaller-bugs@googlegroups.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.