[syzbot] [can?] memory leak in j1939_netdev_start

From: syzbot
Date: Fri Nov 24 2023 - 21:45:26 EST

Hello,

syzbot found the following issue on:

HEAD commit: 98b1cc82c4af Linux 6.7-rc2
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1286e3d4e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1b9d95ada516af
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c8f8cce80000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6b6d520f592c/disk-98b1cc82.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/c2cb6183fd56/vmlinux-98b1cc82.xz
kernel image: https://storage.googleapis.com/syzbot-assets/de520cfc8b93/bzImage-98b1cc82.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d37bef05da87b99c5a6@xxxxxxxxxxxxxxxxxxxxxxxxx

BUG: memory leak
unreferenced object 0xffff88811f324000 (size 8192):
comm "syz-executor.7", pid 5245, jiffies 4294947603 (age 10.860s)
hex dump (first 32 bytes):
00 40 32 1f 81 88 ff ff 00 40 32 1f 81 88 ff ff .@2......@2.....
00 00 00 00 00 00 00 00 00 80 0f 1b 81 88 ff ff ................
backtrace:
[<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517
[<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098
[<ffffffff8453e829>] kmalloc include/linux/slab.h:600 [inline]
[<ffffffff8453e829>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff8453e829>] j1939_priv_create net/can/j1939/main.c:135 [inline]
[<ffffffff8453e829>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272
[<ffffffff8454046e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485
[<ffffffff83ec4dac>] __sys_bind+0x11c/0x130 net/socket.c:1845
[<ffffffff83ec4ddc>] __do_sys_bind net/socket.c:1856 [inline]
[<ffffffff83ec4ddc>] __se_sys_bind net/socket.c:1854 [inline]
[<ffffffff83ec4ddc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1854
[<ffffffff84b6bd8f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline]
[<ffffffff84b6bd8f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b

BUG: memory leak
unreferenced object 0xffff88811f0bf300 (size 240):
comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
hex dump (first 32 bytes):
68 74 bb 1d 81 88 ff ff 68 74 bb 1d 81 88 ff ff ht......ht......
00 80 0f 1b 81 88 ff ff 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81631427>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff81631427>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff81631427>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff81631427>] kmem_cache_alloc_node+0x2c7/0x450 mm/slub.c:3523
[<ffffffff83ed869f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641
[<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline]
[<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
[<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
[<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
[<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
[<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
[<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
[<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553

BUG: memory leak
unreferenced object 0xffff88811f340000 (size 131072):
comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8157e703>] __kmalloc_large_node+0xe3/0x170 mm/slab_common.c:1157
[<ffffffff8157ecbb>] __do_kmalloc_node mm/slab_common.c:995 [inline]
[<ffffffff8157ecbb>] __kmalloc_node_track_caller+0xbb/0x150 mm/slab_common.c:1027
[<ffffffff83ed49a6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582
[<ffffffff83ed8585>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651
[<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline]
[<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
[<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
[<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
[<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
[<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
[<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
[<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553

BUG: memory leak
unreferenced object 0xffff88811dbb7400 (size 512):
comm "softirq", pid 0, jiffies 4294947604 (age 10.850s)
hex dump (first 32 bytes):
00 40 32 1f 81 88 ff ff 28 50 32 1f 81 88 ff ff .@2.....(P2.....
28 50 32 1f 81 88 ff ff 18 74 bb 1d 81 88 ff ff (P2......t......
backtrace:
[<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
[<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline]
[<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline]
[<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517
[<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098
[<ffffffff84542463>] kmalloc include/linux/slab.h:600 [inline]
[<ffffffff84542463>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff84542463>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494
[<ffffffff84547485>] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline]
[<ffffffff84547485>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline]
[<ffffffff84547485>] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735
[<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline]
[<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144
[<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112
[<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline]
[<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606
[<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663
[<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687
[<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529
[<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643
[<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971
[<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533
[<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline]
[<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735
[<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup