Re: [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223)

From: Geliang Tang <geliangtang@gmail.com>
To: Mat Martineau <mathew.j.martineau@linux.intel.com>
Cc: MPTCP Upstream <mptcp@lists.linux.dev>
Subject: Re: [multipath-tcp/mptcp_net-next] [syzkaller] Memory leak in mptcp_nl_cmd_add_addr (#223)
Date: Mon, 9 Aug 2021 18:15:41 +0800	[thread overview]
Message-ID: <CA+WQbwsnVEEcNG1Bp=nXU+gzygUpMTTmO29HxsZaVnu2boMFbw@mail.gmail.com> (raw)
In-Reply-To: <multipath-tcp/mptcp_net-next/issues/223@github.com>

Hi Mat,

Mat Martineau <notifications@github.com> 于2021年8月5日周四 上午7:46写道：
>
> BUG: memory leak
> unreferenced object 0xffff88810680ea00 (size 64):
> comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s)
> hex dump (first 32 bytes):
> 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<....".......
> 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................
> backtrace:
> [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline]
> [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170
> [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731
> [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline]
> [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792
> [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504
> [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803
> [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
> [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340
> [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929
> [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline]
> [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724
> [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403
> [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457
> [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486
> [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80
> [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae
>
> BUG: leak checking failed
>
> Config: config.txt
> Reproducer: repro.cprog.gz repro.prog.gz

I didn't reproduce this issue yet. I don't know to use the first repro.cprog
file. I just used the second repro.prog file like this:

/usr/sbin/syz-execprog -executor=/usr/sbin/syz-executor -repeat=0
-procs=16 -cover=0 repro.prog

And I got no memory leaking. It seems that MPTCP dosen't work in this test
at all, since I got no MPTCP debug output in the dmesg log.

I think maybe I used it in the wrong way. Could you give me some help about
how to use these reproducers?

Thanks,
-Geliang

>
> —
> You are receiving this because you are subscribed to this thread.
> Reply to this email directly, view it on GitHub, or unsubscribe.
> Triage notifications on the go with GitHub Mobile for iOS or Android.