memory leak in proc_register

From: syzbot
Date: Mon Jun 03 2019 - 15:06:02 EST


Hello,

syzbot found the following crash on:

HEAD commit: 9221dced Merge tag 'for-linus-20190601' of git://git.kerne..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=179a80f2a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=50393f7bfe444ff6
dashboard link: https://syzkaller.appspot.com/bug?extid=06780effeefb578dcbfa
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12155636a00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=126f1042a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+06780effeefb578dcbfa@xxxxxxxxxxxxxxxxxxxxxxxxx

m
executing program
executing program
executing program
BUG: memory leak
unreferenced object 0xffff88821b68d780 (size 128):
comm "swapper/0", pid 1, jiffies 4294937320 (age 1363.880s)
hex dump (first 32 bytes):
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
backtrace:
[<000000005ff104f1>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000005ff104f1>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000005ff104f1>] slab_alloc mm/slab.c:3326 [inline]
[<000000005ff104f1>] kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553
[<000000008feae05f>] kmalloc include/linux/slab.h:547 [inline]
[<000000008feae05f>] kzalloc include/linux/slab.h:742 [inline]
[<000000008feae05f>] ida_alloc_range+0x2d6/0x520 lib/idr.c:416
[<00000000dd09fe3e>] proc_alloc_inum fs/proc/generic.c:209 [inline]
[<00000000dd09fe3e>] proc_register+0x34/0x200 fs/proc/generic.c:354
[<00000000433ed329>] proc_mkdir_data+0x89/0xc0 fs/proc/generic.c:476
[<0000000040802aab>] proc_mkdir+0x22/0x30 fs/proc/generic.c:494
[<00000000a4ab923e>] register_irq_proc+0xbe/0x1d0 kernel/irq/proc.c:352
[<00000000204292a9>] init_irq_proc+0x74/0xb0 kernel/irq/proc.c:438
[<000000002b246fb2>] do_basic_setup init/main.c:1006 [inline]
[<000000002b246fb2>] kernel_init_freeable+0x12b/0x26c init/main.c:1169
[<00000000cc140f05>] kernel_init+0x10/0x155 init/main.c:1087
[<00000000d18604ff>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352

BUG: memory leak
unreferenced object 0xffff888113775d00 (size 96):
comm "syz-executor225", pid 7540, jiffies 4295072562 (age 11.510s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 70 87 bb 82 ff ff ff ff ........p.......
00 00 00 00 00 00 00 00 50 9b bb 82 ff ff ff ff ........P.......
backtrace:
[<000000001a48c6be>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0 mm/slab.c:3597
[<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
[<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
[<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
[<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
[<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
[<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
[<000000005df86337>] allocate_hook_entries_size+0x3b/0x60 net/netfilter/core.c:61
[<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190 net/netfilter/core.c:248
[<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0 net/netfilter/core.c:416
[<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70 net/netfilter/core.c:431
[<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50 net/netfilter/core.c:499
[<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30 security/selinux/hooks.c:7089
[<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80 net/core/net_namespace.c:154
[<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
[<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
[<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0 kernel/nsproxy.c:107
[<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100 kernel/nsproxy.c:206
[<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
[<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
[<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
[<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff888113a5e680 (size 96):
comm "syz-executor225", pid 7540, jiffies 4295072562 (age 11.510s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 90 9b bb 82 ff ff ff ff ................
00 00 00 00 00 00 00 00 40 87 bb 82 ff ff ff ff ........@.......
backtrace:
[<000000001a48c6be>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0 mm/slab.c:3597
[<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
[<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
[<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
[<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
[<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
[<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
[<000000005df86337>] allocate_hook_entries_size+0x3b/0x60 net/netfilter/core.c:61
[<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190 net/netfilter/core.c:248
[<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0 net/netfilter/core.c:416
[<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70 net/netfilter/core.c:431
[<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50 net/netfilter/core.c:499
[<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30 security/selinux/hooks.c:7089
[<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80 net/core/net_namespace.c:154
[<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
[<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
[<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0 kernel/nsproxy.c:107
[<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100 kernel/nsproxy.c:206
[<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
[<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
[<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
[<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff888113775d00 (size 96):
comm "syz-executor225", pid 7540, jiffies 4295072562 (age 14.060s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 70 87 bb 82 ff ff ff ff ........p.......
00 00 00 00 00 00 00 00 50 9b bb 82 ff ff ff ff ........P.......
backtrace:
[<000000001a48c6be>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0 mm/slab.c:3597
[<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
[<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
[<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
[<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
[<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
[<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
[<000000005df86337>] allocate_hook_entries_size+0x3b/0x60 net/netfilter/core.c:61
[<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190 net/netfilter/core.c:248
[<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0 net/netfilter/core.c:416
[<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70 net/netfilter/core.c:431
[<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50 net/netfilter/core.c:499
[<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30 security/selinux/hooks.c:7089
[<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80 net/core/net_namespace.c:154
[<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
[<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
[<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0 kernel/nsproxy.c:107
[<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100 kernel/nsproxy.c:206
[<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
[<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
[<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
[<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff888113a5e680 (size 96):
comm "syz-executor225", pid 7540, jiffies 4295072562 (age 14.060s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 90 9b bb 82 ff ff ff ff ................
00 00 00 00 00 00 00 00 40 87 bb 82 ff ff ff ff ........@.......
backtrace:
[<000000001a48c6be>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0 mm/slab.c:3597
[<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
[<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
[<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
[<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
[<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
[<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
[<000000005df86337>] allocate_hook_entries_size+0x3b/0x60 net/netfilter/core.c:61
[<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190 net/netfilter/core.c:248
[<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0 net/netfilter/core.c:416
[<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70 net/netfilter/core.c:431
[<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50 net/netfilter/core.c:499
[<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30 security/selinux/hooks.c:7089
[<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80 net/core/net_namespace.c:154
[<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
[<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
[<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0 kernel/nsproxy.c:107
[<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100 kernel/nsproxy.c:206
[<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
[<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
[<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
[<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

BUG: memory leak
unreferenced object 0xffff88811491e580 (size 96):
comm "syz-executor225", pid 7540, jiffies 4295072562 (age 14.060s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 80 66 bb 82 ff ff ff ff .........f......
00 00 00 00 00 00 00 00 e0 9a bb 82 ff ff ff ff ................
backtrace:
[<000000001a48c6be>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000001a48c6be>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000001a48c6be>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000001a48c6be>] kmem_cache_alloc_node_trace+0x15b/0x2a0 mm/slab.c:3597
[<00000000a81e20d3>] __do_kmalloc_node mm/slab.c:3619 [inline]
[<00000000a81e20d3>] __kmalloc_node+0x38/0x50 mm/slab.c:3627
[<0000000017e61fcc>] kmalloc_node include/linux/slab.h:590 [inline]
[<0000000017e61fcc>] kvmalloc_node+0x4a/0xd0 mm/util.c:431
[<000000005df86337>] kvmalloc include/linux/mm.h:637 [inline]
[<000000005df86337>] kvzalloc include/linux/mm.h:645 [inline]
[<000000005df86337>] allocate_hook_entries_size+0x3b/0x60 net/netfilter/core.c:61
[<00000000c5768c2c>] __nf_hook_entries_try_shrink+0xbd/0x190 net/netfilter/core.c:248
[<00000000ce18e0f8>] __nf_unregister_net_hook+0x12f/0x1b0 net/netfilter/core.c:416
[<0000000026fee9e8>] nf_unregister_net_hook+0x32/0x70 net/netfilter/core.c:431
[<00000000479d68cf>] nf_unregister_net_hooks+0x3d/0x50 net/netfilter/core.c:499
[<0000000079ad6bc5>] selinux_nf_unregister+0x22/0x30 security/selinux/hooks.c:7089
[<0000000010f43268>] ops_exit_list.isra.0+0x4c/0x80 net/core/net_namespace.c:154
[<000000008c4f29b7>] setup_net+0x14a/0x230 net/core/net_namespace.c:333
[<0000000055c17b35>] copy_net_ns+0xf0/0x1e0 net/core/net_namespace.c:439
[<00000000a1ddcf1a>] create_new_namespaces+0x141/0x2a0 kernel/nsproxy.c:107
[<00000000d179cbd0>] unshare_nsproxy_namespaces+0x7f/0x100 kernel/nsproxy.c:206
[<000000009640569f>] ksys_unshare+0x236/0x490 kernel/fork.c:2692
[<00000000722273f8>] __do_sys_unshare kernel/fork.c:2760 [inline]
[<00000000722273f8>] __se_sys_unshare kernel/fork.c:2758 [inline]
[<00000000722273f8>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:2758

executing program
executing program
executing program
executing program
executing program


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxxx

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches