* [syzbot] memory leak in netlink_policy_dump_add_policy
@ 2022-08-12 17:04 syzbot
2022-08-12 21:04 ` Jakub Kicinski
0 siblings, 1 reply; 4+ messages in thread
From: syzbot @ 2022-08-12 17:04 UTC (permalink / raw)
To: davem, edumazet, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 4e23eeebb2e5 Merge tag 'bitmap-6.0-rc1' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165f4f6a080000
kernel config: https://syzkaller.appspot.com/x/.config?x=3a433c7a2539f51c
dashboard link: https://syzkaller.appspot.com/bug?extid=dc54d9ba8153b216cae0
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1443be71080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e5918e080000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff888113093f00 (size 192):
comm "syz-executor228", pid 3636, jiffies 4294947950 (age 12.750s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 0a 00 00 00 00 00 00 00 ................
40 53 fd 84 ff ff ff ff 40 01 00 00 00 00 00 00 @S......@.......
backtrace:
[<ffffffff83a0e378>] kmalloc include/linux/slab.h:600 [inline]
[<ffffffff83a0e378>] kzalloc include/linux/slab.h:733 [inline]
[<ffffffff83a0e378>] alloc_state net/netlink/policy.c:104 [inline]
[<ffffffff83a0e378>] netlink_policy_dump_add_policy+0x198/0x1f0 net/netlink/policy.c:135
[<ffffffff83a0d78d>] ctrl_dumppolicy_start+0x15d/0x290 net/netlink/genetlink.c:1173
[<ffffffff83a0abf8>] genl_start+0x148/0x210 net/netlink/genetlink.c:596
[<ffffffff83a0756a>] __netlink_dump_start+0x20a/0x440 net/netlink/af_netlink.c:2370
[<ffffffff83a0a38e>] genl_family_rcv_msg_dumpit+0x15e/0x190 net/netlink/genetlink.c:678
[<ffffffff83a0b1d5>] genl_family_rcv_msg net/netlink/genetlink.c:772 [inline]
[<ffffffff83a0b1d5>] genl_rcv_msg+0x225/0x2c0 net/netlink/genetlink.c:792
[<ffffffff83a09807>] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2501
[<ffffffff83a0a214>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
[<ffffffff83a08977>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
[<ffffffff83a08977>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345
[<ffffffff83a08e36>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921
[<ffffffff8385aea6>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff8385aea6>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff8385b40c>] ____sys_sendmsg+0x36c/0x390 net/socket.c:2482
[<ffffffff8385fd08>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536
[<ffffffff8385fe98>] __sys_sendmsg+0x88/0x100 net/socket.c:2565
[<ffffffff845d8535>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845d8535>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [syzbot] memory leak in netlink_policy_dump_add_policy
2022-08-12 17:04 [syzbot] memory leak in netlink_policy_dump_add_policy syzbot
@ 2022-08-12 21:04 ` Jakub Kicinski
2022-08-12 21:04 ` syzbot
2022-08-12 21:04 ` syzbot
0 siblings, 2 replies; 4+ messages in thread
From: Jakub Kicinski @ 2022-08-12 21:04 UTC (permalink / raw)
To: syzbot; +Cc: davem, edumazet, linux-kernel, netdev, pabeni, syzkaller-bugs
[-- Attachment #1: Type: text/plain, Size: 892 bytes --]
On Fri, 12 Aug 2022 10:04:26 -0700 syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 4e23eeebb2e5 Merge tag 'bitmap-6.0-rc1' of https://github...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=165f4f6a080000
> kernel config: https://syzkaller.appspot.com/x/.config?x=3a433c7a2539f51c
> dashboard link: https://syzkaller.appspot.com/bug?extid=dc54d9ba8153b216cae0
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1443be71080000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e5918e080000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
Let's see if attaching a patch works...
#syz test
[-- Attachment #2: 0001-net-genl-fix-error-path-memory-leak-in-policy-dumpin.patch --]
[-- Type: text/x-patch, Size: 1180 bytes --]
From 7b3f410d5c49568deffcc8ee9881a7d3de730699 Mon Sep 17 00:00:00 2001
From: Jakub Kicinski <kuba@kernel.org>
Date: Fri, 12 Aug 2022 13:56:48 -0700
Subject: [--remember tree name--] net: genl: fix error path memory leak in
policy dumping
If construction of the array of policies fails when recording
non-first policy we need to unwind.
Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
Fixes: 50a896cf2d6f ("genetlink: properly support per-op policy dumping")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
net/netlink/genetlink.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 1afca2a6c2ac..57010927e20a 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -1174,13 +1174,17 @@ static int ctrl_dumppolicy_start(struct netlink_callback *cb)
op.policy,
op.maxattr);
if (err)
- return err;
+ goto err_free_state;
}
}
if (!ctx->state)
return -ENODATA;
return 0;
+
+err_free_state:
+ netlink_policy_dump_free(ctx->state);
+ return err;
}
static void *ctrl_dumppolicy_prep(struct sk_buff *skb,
--
2.37.1
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [syzbot] memory leak in netlink_policy_dump_add_policy
2022-08-12 21:04 ` Jakub Kicinski
@ 2022-08-12 21:04 ` syzbot
2022-08-12 21:04 ` syzbot
1 sibling, 0 replies; 4+ messages in thread
From: syzbot @ 2022-08-12 21:04 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, edumazet, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
> On Fri, 12 Aug 2022 10:04:26 -0700 syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 4e23eeebb2e5 Merge tag 'bitmap-6.0-rc1' of https://github...
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=165f4f6a080000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=3a433c7a2539f51c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=dc54d9ba8153b216cae0
>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1443be71080000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e5918e080000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
>
> Let's see if attaching a patch works...
>
> #syz test
want 2 args (repo, branch), got 1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [syzbot] memory leak in netlink_policy_dump_add_policy
2022-08-12 21:04 ` Jakub Kicinski
2022-08-12 21:04 ` syzbot
@ 2022-08-12 21:04 ` syzbot
1 sibling, 0 replies; 4+ messages in thread
From: syzbot @ 2022-08-12 21:04 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, edumazet, kuba, linux-kernel, netdev, pabeni, syzkaller-bugs
> On Fri, 12 Aug 2022 10:04:26 -0700 syzbot wrote:
>> Hello,
>>
>> syzbot found the following issue on:
>>
>> HEAD commit: 4e23eeebb2e5 Merge tag 'bitmap-6.0-rc1' of https://github...
>> git tree: upstream
>> console output: https://syzkaller.appspot.com/x/log.txt?x=165f4f6a080000
>> kernel config: https://syzkaller.appspot.com/x/.config?x=3a433c7a2539f51c
>> dashboard link: https://syzkaller.appspot.com/bug?extid=dc54d9ba8153b216cae0
>> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
>> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1443be71080000
>> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11e5918e080000
>>
>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>> Reported-by: syzbot+dc54d9ba8153b216cae0@syzkaller.appspotmail.com
>
> Let's see if attaching a patch works...
>
> #syz test
want 2 args (repo, branch), got 15
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/20220812140439.6bb2bb17%40kernel.org.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2022-08-12 21:05 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-08-12 17:04 [syzbot] memory leak in netlink_policy_dump_add_policy syzbot
2022-08-12 21:04 ` Jakub Kicinski
2022-08-12 21:04 ` syzbot
2022-08-12 21:04 ` syzbot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.