Re: [syzbot] [wireless?] [net?] memory leak in ieee80211_add_key

[Johannes Berg]

On Tue, 2023-10-10 at 17:19 -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    af95dc6fdc25 Merge tag 'pci-v6.6-fixes-2' of git://git.ker..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=111f9141680000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=92fc678f64486a09
> dashboard link: https://syzkaller.appspot.com/bug?extid=c7f9b4282ce793ea2456
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12874a7e680000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=17eba911680000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/8bc195198bd8/disk-af95dc6f.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/769216d795c4/vmlinux-af95dc6f.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/8ceb9e44a618/bzImage-af95dc6f.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+c7f9b4282ce793ea2456@xxxxxxxxxxxxxxxxxxxxxxxxx
> 
> executing program
> executing program
> BUG: memory leak
> unreferenced object 0xffff8881419b3000 (size 1024):
>   comm "syz-executor294", pid 5023, jiffies 4294944772 (age 13.090s)
>   hex dump (first 32 bytes):
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 18 30 9b 41 81 88 ff ff  .........0.A....
>   backtrace:
>     [<ffffffff8157491b>] __do_kmalloc_node mm/slab_common.c:1022 [inline]
>     [<ffffffff8157491b>] __kmalloc+0x4b/0x150 mm/slab_common.c:1036
>     [<ffffffff848575dc>] kmalloc include/linux/slab.h:603 [inline]
>     [<ffffffff848575dc>] kzalloc include/linux/slab.h:720 [inline]
>     [<ffffffff848575dc>] ieee80211_key_alloc+0x5c/0x590 net/mac80211/key.c:603
>     [<ffffffff8482b0d2>] ieee80211_add_key+0x162/0x540 net/mac80211/cfg.c:500

I think already fixed by
https://patchwork.kernel.org/project/linux-wireless/patch/20231005210917.13977-2-johannes@xxxxxxxxxxxxxxxx/
though the patch isn't in the tree yet - will take care of it later
today (I hope).

johannes