From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.7 required=3.0 tests=BAYES_00,FROM_LOCAL_HEX, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF876C48BDF for ; Tue, 22 Jun 2021 17:24:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A29C561055 for ; Tue, 22 Jun 2021 17:24:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232001AbhFVR0m (ORCPT ); Tue, 22 Jun 2021 13:26:42 -0400 Received: from mail-io1-f71.google.com ([209.85.166.71]:43796 "EHLO mail-io1-f71.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231352AbhFVR0l (ORCPT ); Tue, 22 Jun 2021 13:26:41 -0400 Received: by mail-io1-f71.google.com with SMTP id p7-20020a5d8d070000b02904c0978ed194so11801914ioj.10 for ; Tue, 22 Jun 2021 10:24:25 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:date:message-id:subject:from:to; bh=TWUiO1YZGpvaS76ZHhe+JSwwIrerDvGwOdhWfmTH2VY=; b=k9mA/Xeh0k9KhyHHdy0M3n5XPjAHfmqATLcQ2+XX1f+7mqzGqGtiwiuj6KzQdpBdfh pC4fy3TkyWB7NZNBqr6cgTYxZlsJKYjeeSeCtLLMaqzbEnj1GdGEtXEs64YXOl8xjNgX 3yfFSPP4fyhSKjaDtO087/wBoMbPZ0KpbgWlLaKGW5vDKBkkE3wIXrtzFU3Vr87D+TtW oAGokm/Uws4FvwZaU3bhwfoGABPwH8JAqpltWqFr9GRjA4k2Z6RpCfI7bM69q9KZouNq NgjcaRvOZEQpGKgkQsvx7HUIuXDm5ExZhEBhNn+EbBivNgZmoouemuMH7bgxmh9Anq/Y 8XYw== X-Gm-Message-State: AOAM531IkuCwRb+L7hRXjP07Dgu5/ofl0vzzJDa93q1en3HIs7NWvTh7 FRbl+c95ETnZLqCd5SmnbsUtLezWcQ3vCsLZV0O+C7bLMg9I X-Google-Smtp-Source: ABdhPJwFf6BqLXzzPmMy2MUlHAhXeH9dt1YUXkmsVOD/qRbLygvTTvI14qNET7Y6ajo8lVrNpxZbJMQ71IVqr8dzTzuf9N1hKGoW MIME-Version: 1.0 X-Received: by 2002:a05:6e02:20e4:: with SMTP id q4mr3175014ilv.50.1624382664849; Tue, 22 Jun 2021 10:24:24 -0700 (PDT) Date: Tue, 22 Jun 2021 10:24:24 -0700 X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <000000000000b7bee505c55e0f20@google.com> Subject: [syzbot] memory leak in j1939_xtp_rx_rts From: syzbot To: davem@davemloft.net, kernel@pengutronix.de, kuba@kernel.org, linux-can@vger.kernel.org, linux-kernel@vger.kernel.org, linux@rempel-privat.de, mkl@pengutronix.de, netdev@vger.kernel.org, robin@protonic.nl, socketcan@hartkopp.net, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hello, syzbot found the following issue on: HEAD commit: fd0aa1a4 Merge tag 'for-linus' of git://git.kernel.org/pub.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=155c8d10300000 kernel config: https://syzkaller.appspot.com/x/.config?x=6ec2526c74098317 dashboard link: https://syzkaller.appspot.com/bug?extid=d56eaa979f1a3d6e2e2e syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110912a4300000 IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+d56eaa979f1a3d6e2e2e@syzkaller.appspotmail.com BUG: memory leak unreferenced object 0xffff888126b3d500 (size 232): comm "softirq", pid 0, jiffies 4294974634 (age 13.120s) hex dump (first 32 bytes): 68 16 14 26 81 88 ff ff 68 16 14 26 81 88 ff ff h..&....h..&.... 00 80 5d 22 81 88 ff ff 00 00 00 00 00 00 00 00 ..]"............ backtrace: [] __alloc_skb+0x20f/0x280 net/core/skbuff.c:413 [] alloc_skb include/linux/skbuff.h:1107 [inline] [] j1939_session_fresh_new net/can/j1939/transport.c:1484 [inline] [] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1578 [inline] [] j1939_xtp_rx_rts+0x451/0xac0 net/can/j1939/transport.c:1679 [] j1939_tp_cmd_recv net/can/j1939/transport.c:1986 [inline] [] j1939_tp_recv+0x44b/0x640 net/can/j1939/transport.c:2067 [] j1939_can_recv+0x2bc/0x420 net/can/j1939/main.c:101 [] deliver net/can/af_can.c:574 [inline] [] can_rcv_filter+0xd8/0x290 net/can/af_can.c:608 [] can_receive+0xf0/0x140 net/can/af_can.c:665 [] can_rcv+0x7d/0xf0 net/can/af_can.c:696 [] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5459 [] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5573 [] process_backlog+0xb4/0x1a0 net/core/dev.c:6437 [] __napi_poll+0x3d/0x2a0 net/core/dev.c:6985 [] napi_poll net/core/dev.c:7052 [inline] [] net_rx_action+0x32a/0x410 net/core/dev.c:7139 [] __do_softirq+0xbf/0x2ab kernel/softirq.c:559 [] do_softirq kernel/softirq.c:460 [inline] [] do_softirq+0x5c/0x80 kernel/softirq.c:447 [] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:384 [] spin_unlock_bh include/linux/spinlock.h:399 [inline] [] batadv_nc_purge_paths+0x19d/0x1f0 net/batman-adv/network-coding.c:467 BUG: memory leak unreferenced object 0xffff888126141600 (size 512): comm "softirq", pid 0, jiffies 4294974634 (age 13.120s) hex dump (first 32 bytes): 00 e0 9f 2a 81 88 ff ff 08 16 14 26 81 88 ff ff ...*.......&.... 08 16 14 26 81 88 ff ff 18 16 14 26 81 88 ff ff ...&.......&.... backtrace: [] kmalloc include/linux/slab.h:556 [inline] [] kzalloc include/linux/slab.h:686 [inline] [] j1939_session_new+0x5b/0x160 net/can/j1939/transport.c:1443 [] j1939_session_fresh_new net/can/j1939/transport.c:1495 [inline] [] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1578 [inline] [] j1939_xtp_rx_rts+0x4e8/0xac0 net/can/j1939/transport.c:1679 [] j1939_tp_cmd_recv net/can/j1939/transport.c:1986 [inline] [] j1939_tp_recv+0x44b/0x640 net/can/j1939/transport.c:2067 [] j1939_can_recv+0x2bc/0x420 net/can/j1939/main.c:101 [] deliver net/can/af_can.c:574 [inline] [] can_rcv_filter+0xd8/0x290 net/can/af_can.c:608 [] can_receive+0xf0/0x140 net/can/af_can.c:665 [] can_rcv+0x7d/0xf0 net/can/af_can.c:696 [] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5459 [] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5573 [] process_backlog+0xb4/0x1a0 net/core/dev.c:6437 [] __napi_poll+0x3d/0x2a0 net/core/dev.c:6985 [] napi_poll net/core/dev.c:7052 [inline] [] net_rx_action+0x32a/0x410 net/core/dev.c:7139 [] __do_softirq+0xbf/0x2ab kernel/softirq.c:559 [] do_softirq kernel/softirq.c:460 [inline] [] do_softirq+0x5c/0x80 kernel/softirq.c:447 [] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:384 [] spin_unlock_bh include/linux/spinlock.h:399 [inline] [] batadv_nc_purge_paths+0x19d/0x1f0 net/batman-adv/network-coding.c:467 BUG: memory leak unreferenced object 0xffff888126b3d300 (size 232): comm "softirq", pid 0, jiffies 4294974634 (age 13.120s) hex dump (first 32 bytes): 68 08 05 27 81 88 ff ff 68 08 05 27 81 88 ff ff h..'....h..'.... 00 00 0b 22 81 88 ff ff 00 00 00 00 00 00 00 00 ..."............ backtrace: [] __alloc_skb+0x20f/0x280 net/core/skbuff.c:413 [] alloc_skb include/linux/skbuff.h:1107 [inline] [] j1939_session_fresh_new net/can/j1939/transport.c:1484 [inline] [] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1578 [inline] [] j1939_xtp_rx_rts+0x451/0xac0 net/can/j1939/transport.c:1679 [] j1939_tp_cmd_recv net/can/j1939/transport.c:1986 [inline] [] j1939_tp_recv+0x44b/0x640 net/can/j1939/transport.c:2067 [] j1939_can_recv+0x2bc/0x420 net/can/j1939/main.c:101 [] deliver net/can/af_can.c:574 [inline] [] can_rcv_filter+0xd8/0x290 net/can/af_can.c:608 [] can_receive+0xf0/0x140 net/can/af_can.c:665 [] can_rcv+0x7d/0xf0 net/can/af_can.c:696 [] __netif_receive_skb_one_core+0x6a/0xa0 net/core/dev.c:5459 [] __netif_receive_skb+0x27/0xa0 net/core/dev.c:5573 [] process_backlog+0xb4/0x1a0 net/core/dev.c:6437 [] __napi_poll+0x3d/0x2a0 net/core/dev.c:6985 [] napi_poll net/core/dev.c:7052 [inline] [] net_rx_action+0x32a/0x410 net/core/dev.c:7139 [] __do_softirq+0xbf/0x2ab kernel/softirq.c:559 [] do_softirq kernel/softirq.c:460 [inline] [] do_softirq+0x5c/0x80 kernel/softirq.c:447 [] __local_bh_enable_ip+0x51/0x60 kernel/softirq.c:384 [] spin_unlock_bh include/linux/spinlock.h:399 [inline] [] batadv_nc_purge_paths+0x19d/0x1f0 net/batman-adv/network-coding.c:467 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches