[syzbot] [batman?] memory leak in skb_clone (2)

From: syzbot
Date: Sun Aug 27 2023 - 22:43:26 EST

Hello,

syzbot found the following issue on:

HEAD commit: a5e505a99ca7 Merge tag 'platform-drivers-x86-v6.5-5' of gi..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15eea3e3a80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3c65e06397a9d58
dashboard link: https://syzkaller.appspot.com/bug?extid=92f9b5fba2df252a3569
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13597f90680000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c534ce48946f/disk-a5e505a9.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/724bbdaa3992/vmlinux-a5e505a9.xz
kernel image: https://storage.googleapis.com/syzbot-assets/47fba0663891/bzImage-a5e505a9.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+92f9b5fba2df252a3569@xxxxxxxxxxxxxxxxxxxxxxxxx

2023/08/24 02:03:48 executed programs: 322
2023/08/24 02:03:54 executed programs: 337
BUG: memory leak
unreferenced object 0xffff888120ea2600 (size 240):
comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
hex dump (first 32 bytes):
00 22 e3 20 81 88 ff ff 00 00 00 00 00 00 00 00 .". ............
00 80 ed 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860
[<ffffffff8499f31f>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline]
[<ffffffff8499f31f>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
[<ffffffff8499f31f>] batadv_iv_send_outstanding_bat_ogm_packet+0x2ef/0x370 net/batman-adv/bat_iv_ogm.c:1700
[<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
[<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
[<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
[<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

BUG: memory leak
unreferenced object 0xffff888120f36c00 (size 1024):
comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81554a79>] __do_kmalloc_node mm/slab_common.c:984 [inline]
[<ffffffff81554a79>] __kmalloc_node_track_caller+0x49/0x140 mm/slab_common.c:1005
[<ffffffff83e54735>] kmalloc_reserve+0x95/0x180 net/core/skbuff.c:575
[<ffffffff83e5c6c8>] pskb_expand_head+0xd8/0x5f0 net/core/skbuff.c:2042
[<ffffffff849ccbef>] __skb_cow include/linux/skbuff.h:3571 [inline]
[<ffffffff849ccbef>] skb_cow_head include/linux/skbuff.h:3605 [inline]
[<ffffffff849ccbef>] batadv_skb_head_push+0x8f/0x110 net/batman-adv/soft-interface.c:72
[<ffffffff849ca643>] batadv_send_skb_packet+0x83/0x1c0 net/batman-adv/send.c:86
[<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
[<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
[<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700
[<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
[<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
[<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
[<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

BUG: memory leak
unreferenced object 0xffff888120ea2000 (size 240):
comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s)
hex dump (first 32 bytes):
00 28 ea 20 81 88 ff ff 00 00 00 00 00 00 00 00 .(. ............
00 80 ec 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860
[<ffffffff83f88552>] netem_enqueue+0xc62/0x1430 net/sched/sch_netem.c:479
[<ffffffff83e80975>] dev_qdisc_enqueue+0x25/0xf0 net/core/dev.c:3732
[<ffffffff83e8b217>] __dev_xmit_skb net/core/dev.c:3821 [inline]
[<ffffffff83e8b217>] __dev_queue_xmit+0xdc7/0x17d0 net/core/dev.c:4169
[<ffffffff849ca710>] dev_queue_xmit include/linux/netdevice.h:3088 [inline]
[<ffffffff849ca710>] batadv_send_skb_packet+0x150/0x1c0 net/batman-adv/send.c:108
[<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline]
[<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline]
[<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700
[<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600
[<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751
[<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389
[<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145
[<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup