* [syzbot] [net?] memory leak in ___neigh_create (2)
@ 2024-01-05 17:32 syzbot
2024-01-05 17:33 ` syzbot
` (81 more replies)
0 siblings, 82 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:32 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, wangyuweihx
Hello,
syzbot found the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
@ 2024-01-05 17:33 ` syzbot
2024-01-05 17:34 ` syzbot
` (80 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:33 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
2024-01-05 17:33 ` syzbot
@ 2024-01-05 17:34 ` syzbot
2024-01-05 17:35 ` syzbot
` (79 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:34 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
2024-01-05 17:33 ` syzbot
2024-01-05 17:34 ` syzbot
@ 2024-01-05 17:35 ` syzbot
2024-01-05 17:36 ` syzbot
` (78 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:35 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (2 preceding siblings ...)
2024-01-05 17:35 ` syzbot
@ 2024-01-05 17:36 ` syzbot
2024-01-05 17:37 ` syzbot
` (77 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:36 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (3 preceding siblings ...)
2024-01-05 17:36 ` syzbot
@ 2024-01-05 17:37 ` syzbot
2024-01-05 17:38 ` syzbot
` (76 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:37 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (4 preceding siblings ...)
2024-01-05 17:37 ` syzbot
@ 2024-01-05 17:38 ` syzbot
2024-01-05 17:39 ` syzbot
` (75 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:38 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (5 preceding siblings ...)
2024-01-05 17:38 ` syzbot
@ 2024-01-05 17:39 ` syzbot
2024-01-05 17:40 ` syzbot
` (74 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:39 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (6 preceding siblings ...)
2024-01-05 17:39 ` syzbot
@ 2024-01-05 17:40 ` syzbot
2024-01-05 17:41 ` syzbot
` (73 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:40 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (7 preceding siblings ...)
2024-01-05 17:40 ` syzbot
@ 2024-01-05 17:41 ` syzbot
2024-01-05 17:42 ` syzbot
` (72 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:41 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (8 preceding siblings ...)
2024-01-05 17:41 ` syzbot
@ 2024-01-05 17:42 ` syzbot
2024-01-05 17:43 ` syzbot
` (71 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:42 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (9 preceding siblings ...)
2024-01-05 17:42 ` syzbot
@ 2024-01-05 17:43 ` syzbot
2024-01-05 17:44 ` syzbot
` (70 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:43 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (10 preceding siblings ...)
2024-01-05 17:43 ` syzbot
@ 2024-01-05 17:44 ` syzbot
2024-01-05 17:45 ` syzbot
` (69 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:44 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (11 preceding siblings ...)
2024-01-05 17:44 ` syzbot
@ 2024-01-05 17:45 ` syzbot
2024-01-05 17:46 ` syzbot
` (68 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:45 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (12 preceding siblings ...)
2024-01-05 17:45 ` syzbot
@ 2024-01-05 17:46 ` syzbot
2024-01-05 17:47 ` syzbot
` (67 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:46 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (13 preceding siblings ...)
2024-01-05 17:46 ` syzbot
@ 2024-01-05 17:47 ` syzbot
2024-01-05 17:48 ` syzbot
` (66 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:47 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (14 preceding siblings ...)
2024-01-05 17:47 ` syzbot
@ 2024-01-05 17:48 ` syzbot
2024-01-05 17:49 ` syzbot
` (65 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:48 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (15 preceding siblings ...)
2024-01-05 17:48 ` syzbot
@ 2024-01-05 17:49 ` syzbot
2024-01-05 17:50 ` syzbot
` (64 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:49 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (16 preceding siblings ...)
2024-01-05 17:49 ` syzbot
@ 2024-01-05 17:50 ` syzbot
2024-01-05 17:51 ` syzbot
` (63 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:50 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (17 preceding siblings ...)
2024-01-05 17:50 ` syzbot
@ 2024-01-05 17:51 ` syzbot
2024-01-05 17:52 ` syzbot
` (62 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:51 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (18 preceding siblings ...)
2024-01-05 17:51 ` syzbot
@ 2024-01-05 17:52 ` syzbot
2024-01-05 17:53 ` syzbot
` (61 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:52 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (19 preceding siblings ...)
2024-01-05 17:52 ` syzbot
@ 2024-01-05 17:53 ` syzbot
2024-01-05 17:54 ` syzbot
` (60 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:53 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (20 preceding siblings ...)
2024-01-05 17:53 ` syzbot
@ 2024-01-05 17:54 ` syzbot
2024-01-05 17:55 ` syzbot
` (59 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:54 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (21 preceding siblings ...)
2024-01-05 17:54 ` syzbot
@ 2024-01-05 17:55 ` syzbot
2024-01-05 17:56 ` syzbot
` (58 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:55 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (22 preceding siblings ...)
2024-01-05 17:55 ` syzbot
@ 2024-01-05 17:56 ` syzbot
2024-01-05 17:57 ` syzbot
` (57 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:56 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (23 preceding siblings ...)
2024-01-05 17:56 ` syzbot
@ 2024-01-05 17:57 ` syzbot
2024-01-05 17:58 ` syzbot
` (56 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:57 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (24 preceding siblings ...)
2024-01-05 17:57 ` syzbot
@ 2024-01-05 17:58 ` syzbot
2024-01-05 17:59 ` syzbot
` (55 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:58 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (25 preceding siblings ...)
2024-01-05 17:58 ` syzbot
@ 2024-01-05 17:59 ` syzbot
2024-01-05 18:00 ` syzbot
` (54 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 17:59 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (26 preceding siblings ...)
2024-01-05 17:59 ` syzbot
@ 2024-01-05 18:00 ` syzbot
2024-01-05 18:01 ` syzbot
` (53 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:00 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (27 preceding siblings ...)
2024-01-05 18:00 ` syzbot
@ 2024-01-05 18:01 ` syzbot
2024-01-05 18:02 ` syzbot
` (52 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:01 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (28 preceding siblings ...)
2024-01-05 18:01 ` syzbot
@ 2024-01-05 18:02 ` syzbot
2024-01-05 18:03 ` syzbot
` (51 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:02 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (29 preceding siblings ...)
2024-01-05 18:02 ` syzbot
@ 2024-01-05 18:03 ` syzbot
2024-01-05 18:04 ` syzbot
` (50 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:03 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (30 preceding siblings ...)
2024-01-05 18:03 ` syzbot
@ 2024-01-05 18:04 ` syzbot
2024-01-05 18:05 ` syzbot
` (49 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:04 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (31 preceding siblings ...)
2024-01-05 18:04 ` syzbot
@ 2024-01-05 18:05 ` syzbot
2024-01-05 18:06 ` syzbot
` (48 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:05 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (32 preceding siblings ...)
2024-01-05 18:05 ` syzbot
@ 2024-01-05 18:06 ` syzbot
2024-01-05 18:07 ` syzbot
` (47 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:06 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (33 preceding siblings ...)
2024-01-05 18:06 ` syzbot
@ 2024-01-05 18:07 ` syzbot
2024-01-05 18:08 ` syzbot
` (46 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:07 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (34 preceding siblings ...)
2024-01-05 18:07 ` syzbot
@ 2024-01-05 18:08 ` syzbot
2024-01-05 18:09 ` syzbot
` (45 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:08 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (35 preceding siblings ...)
2024-01-05 18:08 ` syzbot
@ 2024-01-05 18:09 ` syzbot
2024-01-05 18:10 ` syzbot
` (44 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:09 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (36 preceding siblings ...)
2024-01-05 18:09 ` syzbot
@ 2024-01-05 18:10 ` syzbot
2024-01-05 18:11 ` syzbot
` (43 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:10 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (37 preceding siblings ...)
2024-01-05 18:10 ` syzbot
@ 2024-01-05 18:11 ` syzbot
2024-01-05 18:12 ` syzbot
` (42 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:11 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (38 preceding siblings ...)
2024-01-05 18:11 ` syzbot
@ 2024-01-05 18:12 ` syzbot
2024-01-05 18:13 ` syzbot
` (41 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:12 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (39 preceding siblings ...)
2024-01-05 18:12 ` syzbot
@ 2024-01-05 18:13 ` syzbot
2024-01-05 18:14 ` syzbot
` (40 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:13 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (40 preceding siblings ...)
2024-01-05 18:13 ` syzbot
@ 2024-01-05 18:14 ` syzbot
2024-01-05 18:15 ` syzbot
` (39 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:14 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (41 preceding siblings ...)
2024-01-05 18:14 ` syzbot
@ 2024-01-05 18:15 ` syzbot
2024-01-05 18:16 ` syzbot
` (38 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:15 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (42 preceding siblings ...)
2024-01-05 18:15 ` syzbot
@ 2024-01-05 18:16 ` syzbot
2024-01-05 18:17 ` syzbot
` (37 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:16 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (43 preceding siblings ...)
2024-01-05 18:16 ` syzbot
@ 2024-01-05 18:17 ` syzbot
2024-01-05 18:18 ` syzbot
` (36 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:17 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (44 preceding siblings ...)
2024-01-05 18:17 ` syzbot
@ 2024-01-05 18:18 ` syzbot
2024-01-05 18:19 ` syzbot
` (35 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:18 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (45 preceding siblings ...)
2024-01-05 18:18 ` syzbot
@ 2024-01-05 18:19 ` syzbot
2024-01-05 18:20 ` Florian Fainelli
` (34 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:19 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (46 preceding siblings ...)
2024-01-05 18:19 ` syzbot
@ 2024-01-05 18:20 ` Florian Fainelli
2024-01-05 18:20 ` syzbot
` (33 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: Florian Fainelli @ 2024-01-05 18:20 UTC (permalink / raw)
To: syzbot, alexander.mikhalitsyn, davem, den, dsahern, edumazet,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, wangyuweihx
On 1/5/24 09:32, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
> dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
Is there a way to stop sending multiple such duplicate reports?
--
Florian
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (47 preceding siblings ...)
2024-01-05 18:20 ` Florian Fainelli
@ 2024-01-05 18:20 ` syzbot
2024-01-05 18:21 ` syzbot
` (32 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:20 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (48 preceding siblings ...)
2024-01-05 18:20 ` syzbot
@ 2024-01-05 18:21 ` syzbot
2024-01-05 18:22 ` syzbot
` (31 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:21 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (49 preceding siblings ...)
2024-01-05 18:21 ` syzbot
@ 2024-01-05 18:22 ` syzbot
2024-01-05 18:23 ` syzbot
` (30 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:22 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (50 preceding siblings ...)
2024-01-05 18:22 ` syzbot
@ 2024-01-05 18:23 ` syzbot
2024-01-05 18:25 ` Eric Dumazet
2024-01-05 18:24 ` syzbot
` (29 subsequent siblings)
81 siblings, 1 reply; 214+ messages in thread
From: syzbot @ 2024-01-05 18:23 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (51 preceding siblings ...)
2024-01-05 18:23 ` syzbot
@ 2024-01-05 18:24 ` syzbot
2024-01-05 18:25 ` syzbot
` (28 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:24 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 18:23 ` syzbot
@ 2024-01-05 18:25 ` Eric Dumazet
0 siblings, 0 replies; 214+ messages in thread
From: Eric Dumazet @ 2024-01-05 18:25 UTC (permalink / raw)
To: syzbot
Cc: alexander.mikhalitsyn, davem, den, dsahern, f.fainelli, kuba,
linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
On Fri, Jan 5, 2024 at 7:23 PM syzbot
<syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com> wrote:
>
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
> dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff88810b8ea400 (size 512):
> comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
> hex dump (first 32 bytes):
> 00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
> c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
> [<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
> [<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
> [<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
> [<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
> [<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
> [<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
> [<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
> [<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>
> BUG: memory leak
> unreferenced object 0xffff888109a7fa00 (size 512):
> comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
> 00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
> [<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
> [<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
> [<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
> [<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
> [<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
> [<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
> [<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
> [<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>
> BUG: memory leak
> unreferenced object 0xffff88810a9fb400 (size 512):
> comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
> c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
> [<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
> [<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
> [<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
> [<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
> [<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
> [<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
> [<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
> [<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
> [<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
> [<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
> [<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> BUG: memory leak
> unreferenced object 0xffff88810a9fba00 (size 512):
> comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
> 80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
> [<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
> [<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
> [<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
> [<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
> [<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
> [<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
> [<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
> [<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
> [<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
> [<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
> [<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
Not sure what happened with syzbot today ....
#syz fix: net: stop syzbot
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (52 preceding siblings ...)
2024-01-05 18:24 ` syzbot
@ 2024-01-05 18:25 ` syzbot
2024-01-05 18:26 ` syzbot
` (27 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:25 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (53 preceding siblings ...)
2024-01-05 18:25 ` syzbot
@ 2024-01-05 18:26 ` syzbot
2024-01-05 18:27 ` syzbot
` (26 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:26 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (54 preceding siblings ...)
2024-01-05 18:26 ` syzbot
@ 2024-01-05 18:27 ` syzbot
2024-01-05 18:28 ` syzbot
` (25 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:27 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (55 preceding siblings ...)
2024-01-05 18:27 ` syzbot
@ 2024-01-05 18:28 ` syzbot
2024-01-05 18:29 ` syzbot
` (24 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:28 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (56 preceding siblings ...)
2024-01-05 18:28 ` syzbot
@ 2024-01-05 18:29 ` syzbot
2024-01-05 18:30 ` syzbot
` (23 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:29 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (57 preceding siblings ...)
2024-01-05 18:29 ` syzbot
@ 2024-01-05 18:30 ` syzbot
2024-01-05 18:31 ` syzbot
` (22 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:30 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (58 preceding siblings ...)
2024-01-05 18:30 ` syzbot
@ 2024-01-05 18:31 ` syzbot
2024-01-05 18:32 ` syzbot
` (21 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:31 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (59 preceding siblings ...)
2024-01-05 18:31 ` syzbot
@ 2024-01-05 18:32 ` syzbot
2024-01-05 18:33 ` syzbot
` (20 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:32 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (60 preceding siblings ...)
2024-01-05 18:32 ` syzbot
@ 2024-01-05 18:33 ` syzbot
2024-01-05 18:34 ` syzbot
` (19 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:33 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (61 preceding siblings ...)
2024-01-05 18:33 ` syzbot
@ 2024-01-05 18:34 ` syzbot
2024-01-05 18:35 ` syzbot
` (18 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:34 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (62 preceding siblings ...)
2024-01-05 18:34 ` syzbot
@ 2024-01-05 18:35 ` syzbot
2024-01-05 18:36 ` syzbot
` (17 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:35 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (63 preceding siblings ...)
2024-01-05 18:35 ` syzbot
@ 2024-01-05 18:36 ` syzbot
2024-01-05 18:37 ` syzbot
` (16 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:36 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (64 preceding siblings ...)
2024-01-05 18:36 ` syzbot
@ 2024-01-05 18:37 ` syzbot
2024-01-05 18:38 ` syzbot
` (15 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:37 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (65 preceding siblings ...)
2024-01-05 18:37 ` syzbot
@ 2024-01-05 18:38 ` syzbot
2024-01-05 18:39 ` syzbot
` (14 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:38 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (66 preceding siblings ...)
2024-01-05 18:38 ` syzbot
@ 2024-01-05 18:39 ` syzbot
2024-01-05 18:40 ` syzbot
` (13 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:39 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (67 preceding siblings ...)
2024-01-05 18:39 ` syzbot
@ 2024-01-05 18:40 ` syzbot
2024-01-05 18:41 ` syzbot
` (12 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-01-05 18:40 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (68 preceding siblings ...)
2024-01-05 18:40 ` syzbot
@ 2024-01-05 18:41 ` syzbot
2024-01-05 18:46 ` Aleksandr Nogikh
2024-04-04 18:26 ` [syzbot] " syzbot
` (11 subsequent siblings)
81 siblings, 1 reply; 214+ messages in thread
From: syzbot @ 2024-01-05 18:41 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
syzbot has found a reproducer for the following issue on:
HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810b8ea400 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff888109a7fa00 (size 512):
comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
[<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
[<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
[<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
[<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
[<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
[<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
[<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
[<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
[<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
BUG: memory leak
unreferenced object 0xffff88810a9fb400 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
BUG: memory leak
unreferenced object 0xffff88810a9fba00 (size 512):
comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
backtrace:
[<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
[<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
[<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
[<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
[<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
[<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
[<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
[<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
[<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
[<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
[<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
[<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
[<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
[<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
[<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
[<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
[<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
[<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
[<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
[<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
[<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
[<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
[<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
[<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] [net?] memory leak in ___neigh_create (2)
2024-01-05 18:41 ` syzbot
@ 2024-01-05 18:46 ` Aleksandr Nogikh
0 siblings, 0 replies; 214+ messages in thread
From: Aleksandr Nogikh @ 2024-01-05 18:46 UTC (permalink / raw)
To: syzbot
Cc: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, pabeni, razor, syzkaller-bugs,
thomas.zeitlhofer+lkml, thomas.zeitlhofer, wangyuweihx
I'm very sorry for the inconvenience due to the syzbot breakage!
The reporting was stopped.
We're figuring out what went wrong and will add more fine-grained
controls to prevent such situations in the future.
On Fri, Jan 5, 2024 at 7:41 PM syzbot
<syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com> wrote:
>
> syzbot has found a reproducer for the following issue on:
>
> HEAD commit: 2258c2dc850b Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16f67b44480000
> kernel config: https://syzkaller.appspot.com/x/.config?x=a4fb7ad9185f1501
> dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14e23d44480000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/0e65a45877eb/disk-2258c2dc.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/7617adf885a8/vmlinux-2258c2dc.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/43fb89ea894a/bzImage-2258c2dc.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+42cfec52b6508887bbe8@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff88810b8ea400 (size 512):
> comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
> hex dump (first 32 bytes):
> 00 9c f8 0a 81 88 ff ff 80 29 23 86 ff ff ff ff .........)#.....
> c0 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
> [<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
> [<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
> [<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
> [<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
> [<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
> [<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
> [<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
> [<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>
> BUG: memory leak
> unreferenced object 0xffff888109a7fa00 (size 512):
> comm "kworker/0:3", pid 4440, jiffies 4294938594 (age 1132.680s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
> 00 79 79 44 81 88 ff ff 72 78 ff ff 00 00 00 00 .yyD....rx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff83ff16d9>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff83ff16d9>] NF_HOOK include/linux/netfilter.h:302 [inline]
> [<ffffffff83ff16d9>] NF_HOOK.constprop.0+0x49/0x110 include/linux/netfilter.h:296
> [<ffffffff83ff19c4>] mld_sendpack+0x224/0x350 net/ipv6/mcast.c:1820
> [<ffffffff83ff5403>] mld_send_cr net/ipv6/mcast.c:2121 [inline]
> [<ffffffff83ff5403>] mld_ifc_work+0x2a3/0x750 net/ipv6/mcast.c:2653
> [<ffffffff8129519a>] process_one_work+0x2ba/0x5f0 kernel/workqueue.c:2289
> [<ffffffff81295ab9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
> [<ffffffff8129fb05>] kthread+0x125/0x160 kernel/kthread.c:376
> [<ffffffff8100224f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
>
> BUG: memory leak
> unreferenced object 0xffff88810a9fb400 (size 512):
> comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
> c0 76 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .vyD....sx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
> [<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
> [<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
> [<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
> [<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
> [<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
> [<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
> [<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
> [<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
> [<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
> [<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
> [<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> BUG: memory leak
> unreferenced object 0xffff88810a9fba00 (size 512):
> comm "dhcpcd", pid 4638, jiffies 4294938595 (age 1132.670s)
> hex dump (first 32 bytes):
> 00 00 00 00 00 00 00 00 80 29 23 86 ff ff ff ff .........)#.....
> 80 77 79 44 81 88 ff ff 73 78 ff ff 00 00 00 00 .wyD....sx......
> backtrace:
> [<ffffffff814f9fe6>] __do_kmalloc_node mm/slab_common.c:967 [inline]
> [<ffffffff814f9fe6>] __kmalloc+0x46/0x120 mm/slab_common.c:981
> [<ffffffff83b5234f>] kmalloc include/linux/slab.h:584 [inline]
> [<ffffffff83b5234f>] kzalloc include/linux/slab.h:720 [inline]
> [<ffffffff83b5234f>] neigh_alloc net/core/neighbour.c:476 [inline]
> [<ffffffff83b5234f>] ___neigh_create+0xdf/0xd60 net/core/neighbour.c:661
> [<ffffffff83f9f886>] ip6_finish_output2+0x776/0x9b0 net/ipv6/ip6_output.c:125
> [<ffffffff83fa5530>] __ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
> [<ffffffff83fa5530>] ip6_finish_output+0x270/0x530 net/ipv6/ip6_output.c:206
> [<ffffffff83fa5893>] NF_HOOK_COND include/linux/netfilter.h:291 [inline]
> [<ffffffff83fa5893>] ip6_output+0xa3/0x1b0 net/ipv6/ip6_output.c:227
> [<ffffffff84062411>] dst_output include/net/dst.h:444 [inline]
> [<ffffffff84062411>] ip6_local_out+0x51/0x70 net/ipv6/output_core.c:155
> [<ffffffff83fa6285>] ip6_send_skb+0x25/0xc0 net/ipv6/ip6_output.c:1971
> [<ffffffff83fa6394>] ip6_push_pending_frames+0x74/0x90 net/ipv6/ip6_output.c:1991
> [<ffffffff83fec08c>] rawv6_push_pending_frames net/ipv6/raw.c:579 [inline]
> [<ffffffff83fec08c>] rawv6_sendmsg+0x16ac/0x1ba0 net/ipv6/raw.c:922
> [<ffffffff83ebe965>] inet_sendmsg+0x45/0x70 net/ipv4/af_inet.c:827
> [<ffffffff83af7116>] sock_sendmsg_nosec net/socket.c:714 [inline]
> [<ffffffff83af7116>] sock_sendmsg+0x56/0x80 net/socket.c:734
> [<ffffffff83af769d>] ____sys_sendmsg+0x38d/0x410 net/socket.c:2476
> [<ffffffff83afbfe8>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2530
> [<ffffffff83afc178>] __sys_sendmsg+0x88/0x100 net/socket.c:2559
> [<ffffffff848ed5b5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> [<ffffffff848ed5b5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
>
>
> ---
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000d4a93c060e373195%40google.com.
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (69 preceding siblings ...)
2024-01-05 18:41 ` syzbot
@ 2024-04-04 18:26 ` syzbot
2024-04-18 18:27 ` syzbot
` (10 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-04-04 18:26 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 9 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (70 preceding siblings ...)
2024-04-04 18:26 ` [syzbot] " syzbot
@ 2024-04-18 18:27 ` syzbot
2024-05-02 18:28 ` syzbot
` (9 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-04-18 18:27 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 9 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (71 preceding siblings ...)
2024-04-18 18:27 ` syzbot
@ 2024-05-02 18:28 ` syzbot
2024-05-16 18:28 ` syzbot
` (8 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-05-02 18:28 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 9 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (72 preceding siblings ...)
2024-05-02 18:28 ` syzbot
@ 2024-05-16 18:28 ` syzbot
2024-05-30 18:29 ` syzbot
` (7 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-05-16 18:28 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 9 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (73 preceding siblings ...)
2024-05-16 18:28 ` syzbot
@ 2024-05-30 18:29 ` syzbot
2024-06-13 18:30 ` syzbot
` (6 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-05-30 18:29 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 9 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (74 preceding siblings ...)
2024-05-30 18:29 ` syzbot
@ 2024-06-13 18:30 ` syzbot
2024-06-27 18:31 ` syzbot
` (5 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-06-13 18:30 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 10 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (75 preceding siblings ...)
2024-06-13 18:30 ` syzbot
@ 2024-06-27 18:31 ` syzbot
2024-07-11 18:32 ` syzbot
` (4 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-06-27 18:31 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 10 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (76 preceding siblings ...)
2024-06-27 18:31 ` syzbot
@ 2024-07-11 18:32 ` syzbot
2024-07-25 18:33 ` syzbot
` (3 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-07-11 18:32 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 10 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (77 preceding siblings ...)
2024-07-11 18:32 ` syzbot
@ 2024-07-25 18:33 ` syzbot
2024-08-08 18:34 ` syzbot
` (2 subsequent siblings)
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-07-25 18:33 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 10 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (78 preceding siblings ...)
2024-07-25 18:33 ` syzbot
@ 2024-08-08 18:34 ` syzbot
2024-08-22 18:35 ` syzbot
2024-09-05 11:54 ` [syzbot] syzbot
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-08-08 18:34 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 10 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot] memory leak in ___neigh_create (2)
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (79 preceding siblings ...)
2024-08-08 18:34 ` syzbot
@ 2024-08-22 18:35 ` syzbot
2024-09-05 11:54 ` [syzbot] syzbot
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-08-22 18:35 UTC (permalink / raw)
To: alexander.mikhalitsyn, davem, den, dsahern, edumazet, f.fainelli,
kuba, linux-kernel, netdev, nogikh, pabeni, razor,
syzkaller-bugs, thomas.zeitlhofer+lkml, thomas.zeitlhofer,
wangyuweihx
This bug is marked as fixed by commit:
net: stop syzbot
But I can't find it in the tested trees[1] for more than 90 days.
Is it a correct commit? Please update it by replying:
#syz fix: exact-commit-title
Until then the bug is still considered open and new crashes with
the same signature are ignored.
Kernel: Linux
Dashboard link: https://syzkaller.appspot.com/bug?extid=42cfec52b6508887bbe8
---
[1] I expect the commit to be present in:
1. for-kernelci branch of
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git
2. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git
3. master branch of
git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git
4. main branch of
git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next.git
The full list of 10 trees can be found at
https://syzkaller.appspot.com/upstream/repos
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
` (80 preceding siblings ...)
2024-08-22 18:35 ` syzbot
@ 2024-09-05 11:54 ` syzbot
81 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-05 11:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-06-10 19:15 [syzbot] [bcachefs?] divide error in bch2_sb_members_v2_to_text syzbot
@ 2025-06-19 21:00 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-19 21:00 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't trust sb->nr_devices in members_to_text()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-06-08 5:52 [syzbot] [bcachefs?] kernel BUG in vfs_get_tree (2) syzbot
@ 2025-06-19 20:57 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-19 20:57 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Call bch2_fs_start before getting vfs superblock
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-05-31 15:09 [syzbot] [bcachefs?] WARNING in lookup_object_or_alloc syzbot
@ 2025-06-19 20:54 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-19 20:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't put rhashtable on stack
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-06-12 7:52 [syzbot] [bcachefs?] WARNING in __init_work (2) syzbot
@ 2025-06-19 20:54 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-19 20:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't put rhashtable on stack
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-07-13 22:54 [syzbot] [bpf?] [trace?] possible deadlock in console_flush_all (3) syzbot
@ 2025-06-19 20:48 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-19 20:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix possible console lock involved deadlock
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-04-28 17:04 [syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update syzbot
@ 2025-06-08 16:01 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-08 16:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix downgrade_table_extra()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-05-26 8:50 [syzbot] [bcachefs?] WARNING in rhashtable_init_noprof syzbot
@ 2025-06-08 15:41 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-08 15:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't put rhashtable on stack
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-05-26 10:41 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in bch2_sb_members_v2_to_text syzbot
@ 2025-06-08 15:33 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-06-08 15:33 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't trust sb->nr_devices in members_to_text()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-04-08 11:53 [syzbot] [bcachefs?] WARNING in bch2_dev_free syzbot
@ 2025-04-18 0:37 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-18 0:37 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Prevent granting write refs when filesystem is read-only
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-23 6:02 [syzbot] linux-next build error (20) syzbot
@ 2025-04-14 14:48 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-14 14:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
The bug was fixed with a different commit than the recorded [PATCH] discussion.
Close it so that it may be reopened the next time we face a linux next
build problem.
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-17 11:55 [syzbot] [usb?] KMSAN: uninit-value in mii_nway_restart (2) syzbot
2025-02-17 20:59 ` [syzbot] syzbot
@ 2025-04-11 12:15 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-11 12:15 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
` (6 preceding siblings ...)
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
@ 2025-04-07 14:17 ` Arnaud Lecomte
7 siblings, 0 replies; 214+ messages in thread
From: Arnaud Lecomte @ 2025-04-07 14:17 UTC (permalink / raw)
To: syzbot+29fc8991b0ecb186cf40
Cc: andrew+netdev, davem, edumazet, kuba, linux-kernel, linux-ppp,
netdev, pabeni, syzkaller-bugs
Author: contact@arnaud-lcm.com
#syz test
diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index 644e99fc3623..520d895acc60 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -506,6 +506,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
unsigned char *data;
int islcp;
+ /* Ensure we can safely access protocol field and LCP code */
+ if (!skb || !pskb_may_pull(skb, 3)) {
+ kfree_skb(skb);
+ return NULL;
+ }
data = skb->data;
proto = get_unaligned_be16(data);
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
@ 2025-04-07 14:17 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-07 14:17 UTC (permalink / raw)
To: contact
Cc: andrew, contact, davem, edumazet, kuba, linux-kernel, linux-ppp,
netdev, pabeni, syzkaller-bugs
> Author: contact@arnaud-lcm.com
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
want either no args or 2 args (repo, branch), got 5
>
> diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
> index 644e99fc3623..520d895acc60 100644
> --- a/drivers/net/ppp/ppp_synctty.c
> +++ b/drivers/net/ppp/ppp_synctty.c
> @@ -506,6 +506,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
> unsigned char *data;
> int islcp;
>
> + /* Ensure we can safely access protocol field and LCP code */
> + if (!skb || !pskb_may_pull(skb, 3)) {
> + kfree_skb(skb);
> + return NULL;
> + }
> data = skb->data;
> proto = get_unaligned_be16(data);
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
` (5 preceding siblings ...)
2025-04-07 14:06 ` [syzbot] Arnaud Lecomte
@ 2025-04-07 14:17 ` Arnaud Lecomte
2025-04-07 14:17 ` [syzbot] syzbot
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
7 siblings, 1 reply; 214+ messages in thread
From: Arnaud Lecomte @ 2025-04-07 14:17 UTC (permalink / raw)
To: syzbot+29fc8991b0ecb186cf40
Cc: andrew+netdev, davem, edumazet, kuba, linux-kernel, linux-ppp,
netdev, pabeni, syzkaller-bugs
Author: contact@arnaud-lcm.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
diff --git a/drivers/net/ppp/ppp_synctty.c b/drivers/net/ppp/ppp_synctty.c
index 644e99fc3623..520d895acc60 100644
--- a/drivers/net/ppp/ppp_synctty.c
+++ b/drivers/net/ppp/ppp_synctty.c
@@ -506,6 +506,11 @@ ppp_sync_txmunge(struct syncppp *ap, struct sk_buff *skb)
unsigned char *data;
int islcp;
+ /* Ensure we can safely access protocol field and LCP code */
+ if (!skb || !pskb_may_pull(skb, 3)) {
+ kfree_skb(skb);
+ return NULL;
+ }
data = skb->data;
proto = get_unaligned_be16(data);
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
` (4 preceding siblings ...)
2025-02-15 19:35 ` [syzbot] syzbot
@ 2025-04-07 14:06 ` Arnaud Lecomte
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
7 siblings, 0 replies; 214+ messages in thread
From: Arnaud Lecomte @ 2025-04-07 14:06 UTC (permalink / raw)
To: syzbot+29fc8991b0ecb186cf40
Cc: andrew+netdev, davem, edumazet, kuba, linux-kernel, linux-ppp,
netdev, pabeni, syzkaller-bugs
#syz test: https://github.com/ArnaudLcm/linux bounds-checking-txmung
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-30 16:49 [syzbot] [pci?] upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_prepare_msi_desc syzbot
@ 2025-04-03 7:06 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-03 7:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-30 10:15 [syzbot] [pci?] upstream test error: general protection fault in msix_prepare_msi_desc syzbot
@ 2025-04-03 7:06 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-03 7:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-31 2:14 [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in __kfifo_alloc syzbot
2025-04-01 10:18 ` [syzbot] syzbot
2025-04-01 10:24 ` [syzbot] syzbot
@ 2025-04-01 11:04 ` syzbot
2 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 11:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-31 2:14 [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in __kfifo_alloc syzbot
2025-04-01 10:18 ` [syzbot] syzbot
@ 2025-04-01 10:24 ` syzbot
2025-04-01 11:04 ` [syzbot] syzbot
2 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 10:24 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-31 2:14 [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in __kfifo_alloc syzbot
@ 2025-04-01 10:18 ` syzbot
2025-04-01 10:24 ` [syzbot] syzbot
2025-04-01 11:04 ` [syzbot] syzbot
2 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 10:18 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-31 14:06 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_copygc (2) syzbot
@ 2025-04-01 4:10 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:10 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Eliminate padding in move_bucket_key
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-11 0:28 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_check_topology syzbot
@ 2025-04-01 4:10 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:10 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-22 18:44 [syzbot] [bcachefs?] KMSAN: uninit-value in rw_aux_tree_set (2) syzbot
@ 2025-04-01 4:09 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-26 0:00 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_trans_start_alloc_update syzbot
@ 2025-04-01 4:08 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:08 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-19 7:33 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_inode_v3_validate syzbot
@ 2025-04-01 4:08 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:08 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-13 7:56 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_xattr_validate syzbot
2025-04-01 4:06 ` [syzbot] syzbot
@ 2025-04-01 4:07 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:07 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-17 8:54 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_iter_init (2) syzbot
@ 2025-04-01 4:07 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:07 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-15 8:10 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_checksum_update (2) syzbot
@ 2025-04-01 4:06 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-13 7:56 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_xattr_validate syzbot
@ 2025-04-01 4:06 ` syzbot
2025-04-01 4:07 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-06 13:58 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bucket_alloc_early syzbot
@ 2025-04-01 4:05 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:05 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-30 19:55 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_dirent_validate syzbot
@ 2025-04-01 4:04 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-19 10:14 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_dirent_rename (2) syzbot
@ 2025-04-01 4:04 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-04 17:36 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_dev_freespace_init syzbot
@ 2025-04-01 4:03 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-13 19:13 [syzbot] [bcachefs?] KMSAN: uninit-value in __build_ro_aux_tree syzbot
@ 2025-04-01 4:03 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-24 14:42 [syzbot] [bcachefs?] KMSAN: uninit-value in __bch2_bkey_cmp_left_packed syzbot
@ 2025-04-01 4:02 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-29 16:59 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_val_validate syzbot
@ 2025-04-01 4:02 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-01 8:34 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_ptrs_validate syzbot
@ 2025-04-01 4:02 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-27 18:59 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_cmp_packed_inlined (2) syzbot
@ 2025-04-01 4:01 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-17 8:54 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_alloc_v4_validate (2) syzbot
@ 2025-04-01 4:00 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 4:00 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-01 9:40 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_get syzbot
@ 2025-04-01 3:59 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-11 13:37 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_readdir (2) syzbot
@ 2025-04-01 3:59 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-01 20:55 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_inode_unpack (2) syzbot
@ 2025-04-01 3:58 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-03 1:56 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_trans_start_alloc_update_noupdate syzbot
@ 2025-04-01 3:58 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-29 9:17 [syzbot] [bcachefs?] KMSAN: uninit-value in btree_interior_update_work syzbot
@ 2025-04-01 3:57 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:57 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Fix a KMSAN splat in btree_update_nodes_written()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-04 15:33 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_ptr_v2_validate syzbot
@ 2025-04-01 3:56 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Disable asm memcpys when kmsan enabled
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-03-09 4:20 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_extent_crc_append (2) syzbot
@ 2025-04-01 3:55 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-04-01 3:55 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Fix kmsan warnings in bch2_extent_crc_pack()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-17 11:55 [syzbot] [usb?] KMSAN: uninit-value in mii_nway_restart (2) syzbot
@ 2025-02-17 20:59 ` syzbot
2025-04-11 12:15 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-17 20:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-17 11:55 [syzbot] [can?] WARNING in ucan_probe syzbot
@ 2025-02-17 17:59 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-17 17:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
` (3 preceding siblings ...)
2025-02-15 18:42 ` [syzbot] syzbot
@ 2025-02-15 19:35 ` syzbot
2025-04-07 14:06 ` [syzbot] Arnaud Lecomte
` (2 subsequent siblings)
7 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-15 19:35 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
` (2 preceding siblings ...)
2025-02-15 14:31 ` [syzbot] syzbot
@ 2025-02-15 18:42 ` syzbot
2025-02-15 19:35 ` [syzbot] syzbot
` (3 subsequent siblings)
7 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-15 18:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
2025-02-15 7:58 ` [syzbot] syzbot
2025-02-15 12:33 ` [syzbot] syzbot
@ 2025-02-15 14:31 ` syzbot
2025-02-15 18:42 ` [syzbot] syzbot
` (4 subsequent siblings)
7 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-15 14:31 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
2025-02-15 7:58 ` [syzbot] syzbot
@ 2025-02-15 12:33 ` syzbot
2025-02-15 14:31 ` [syzbot] syzbot
` (5 subsequent siblings)
7 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-15 12:33 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
@ 2025-02-15 7:58 ` syzbot
2025-02-15 12:33 ` [syzbot] syzbot
` (6 subsequent siblings)
7 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-15 7:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-12 13:41 [syzbot] [modules?] KMSAN: uninit-value in __request_module (6) syzbot
2025-02-13 14:21 ` [syzbot] syzbot
@ 2025-02-13 18:22 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-13 18:22 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-12 13:41 [syzbot] [modules?] KMSAN: uninit-value in __request_module (6) syzbot
@ 2025-02-13 14:21 ` syzbot
2025-02-13 18:22 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-13 14:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: purvayeshi550@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-12 10:57 [syzbot] [jfs?] KASAN: slab-out-of-bounds Read in ea_get (4) syzbot
@ 2025-02-12 22:56 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-12 22:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-09 5:48 [syzbot] [isofs?] KMSAN: uninit-value in isofs_readdir syzbot
2025-02-09 23:50 ` [syzbot] syzbot
@ 2025-02-11 1:00 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-11 1:00 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-02-09 5:48 [syzbot] [isofs?] KMSAN: uninit-value in isofs_readdir syzbot
@ 2025-02-09 23:50 ` syzbot
2025-02-11 1:00 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-09 23:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-27 0:00 [syzbot] upstream build error (22) syzbot
@ 2025-02-03 12:55 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-02-03 12:55 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
All the previous reasons for build breakages are no longer relevant.
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-17 6:14 [syzbot] [usb?] general protection fault in status_show syzbot
@ 2025-01-17 15:41 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-01-17 15:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-12 6:45 [syzbot] [iommu?] UBSAN: shift-out-of-bounds in iova_bitmap_alloc syzbot
@ 2025-01-12 11:58 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-01-12 11:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-11 0:40 [syzbot] [usb?] general protection fault in qt2_read_bulk_callback syzbot
@ 2025-01-11 17:19 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-01-11 17:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2022-12-21 8:15 [syzbot] possible deadlock in page_cache_ra_unbounded syzbot
@ 2025-01-08 16:11 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2025-01-08 16:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz set subsystems: mm, fs
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-02 14:45 [syzbot] [f2fs?] KASAN: slab-out-of-bounds Read in f2fs_getxattr syzbot
2025-01-07 22:19 ` [syzbot] syzbot
@ 2025-01-08 14:13 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-01-08 14:13 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2025-01-02 14:45 [syzbot] [f2fs?] KASAN: slab-out-of-bounds Read in f2fs_getxattr syzbot
@ 2025-01-07 22:19 ` syzbot
2025-01-08 14:13 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2025-01-07 22:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-25 2:26 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in force_devcd_write syzbot
@ 2024-12-26 3:43 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-26 3:43 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-12-24 6:38 [syzbot] [input?] KASAN: null-ptr-deref Write in input_ff_create syzbot
@ 2024-12-25 16:44 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-25 16:44 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: qasdev00@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-07-24 8:59 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync syzbot
2024-12-05 1:58 ` [syzbot] syzbot
@ 2024-12-23 22:19 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-23 22:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-22 14:42 [syzbot] [netfilter?] KMSAN: uninit-value in ip6table_mangle_hook (3) syzbot
2024-12-14 22:16 ` [syzbot] syzbot
2024-12-14 22:21 ` [syzbot] syzbot
@ 2024-12-15 2:34 ` syzbot
2 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-15 2:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-22 14:42 [syzbot] [netfilter?] KMSAN: uninit-value in ip6table_mangle_hook (3) syzbot
2024-12-14 22:16 ` [syzbot] syzbot
@ 2024-12-14 22:21 ` syzbot
2024-12-15 2:34 ` [syzbot] syzbot
2 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-14 22:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-22 14:42 [syzbot] [netfilter?] KMSAN: uninit-value in ip6table_mangle_hook (3) syzbot
@ 2024-12-14 22:16 ` syzbot
2024-12-14 22:21 ` [syzbot] syzbot
2024-12-15 2:34 ` [syzbot] syzbot
2 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-14 22:16 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-07-24 8:59 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync syzbot
@ 2024-12-05 1:58 ` syzbot
2024-12-23 22:19 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2024-12-05 1:58 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-25 13:05 [syzbot] [bcachefs?] kernel BUG in bch2_evacuate_bucket syzbot
@ 2024-11-29 0:39 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-29 0:39 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Kill bch2_get_next_backpointer()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-12 3:25 [syzbot] [bcachefs?] possible deadlock in bch2_alloc_sectors_start_trans syzbot
@ 2024-11-29 0:34 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-29 0:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't recurse in check_discard_freespace_key
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-08 15:57 [syzbot] [bcachefs?] kernel BUG in bch2_rechecksum_bio syzbot
@ 2024-11-29 0:32 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-29 0:32 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Check for extent crc uncompressed/compressed size mismatch
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-23 18:30 [syzbot] [bcachefs?] possible deadlock in __bch2_trans_relock syzbot
@ 2024-11-28 23:06 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 23:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: bch2_trans_relock() is trylock for lockdep
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-07-17 13:39 [syzbot] [bcachefs?] general protection fault in bch2_checksum syzbot
@ 2024-11-28 22:59 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 22:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: cryptographic MACs on superblock are not (yet?) supported
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-09-18 7:28 [syzbot] [bcachefs?] WARNING in bch2_journal_flush_seq_async syzbot
@ 2024-11-28 22:50 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 22:50 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Check for inode journal seq in the future
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-07-10 20:55 [syzbot] [bcachefs?] kernel BUG in bch2_journal_noflush_seq syzbot
@ 2024-11-28 22:12 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 22:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Check for bucket journal sequence numbers from the future
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-28 9:49 [syzbot] [bcachefs?] kernel BUG in bch2_get_scanned_nodes syzbot
@ 2024-11-28 20:31 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 20:31 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: struct bkey_validate_context
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-25 13:28 [syzbot] [bcachefs?] BUG: corrupted list in bch2_btree_and_journal_iter_exit syzbot
@ 2024-11-28 20:12 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 20:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix journal_iter list corruption
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-06 13:24 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_traverse_one syzbot
@ 2024-11-28 3:27 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 3:27 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix btree node scan when unknown btree IDs are present
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-25 13:28 [syzbot] [bcachefs?] kernel BUG in bch2_journal_pin_set syzbot
@ 2024-11-28 3:23 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 3:23 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Guard against journal seq overflow
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-28 15:49 [syzbot] [bcachefs?] kernel BUG in bch2_btree_write_buffer_flush_locked syzbot
@ 2024-11-28 3:21 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 3:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Guard against journal seq overflow
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-21 12:40 [syzbot] [bcachefs?] kernel BUG in bch2_btree_node_lock_write syzbot
@ 2024-11-28 3:12 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 3:12 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Issue a transaction restart after commit in repair
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-25 3:10 [syzbot] [bcachefs?] kernel BUG in __bch2_journal_pin_put syzbot
@ 2024-11-28 3:00 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-28 3:00 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Guard against journal seq overflow
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-25 6:48 [syzbot] [bcachefs?] general protection fault in bch2_btree_path_traverse_one syzbot
@ 2024-11-27 8:09 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-27 8:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Ignore empty btree root journal entries
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-06-14 12:16 [syzbot] [crypto?] [bcachefs?] BUG: unable to handle kernel paging request in crypto_skcipher_encrypt syzbot
@ 2024-11-25 7:19 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-25 7:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Don't try to en/decrypt when encryption not available
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-18 21:41 [syzbot] [bcachefs?] kernel BUG in bch2_bucket_alloc_trans (3) syzbot
@ 2024-11-25 6:54 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-25 6:54 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Kill bch2_bucket_alloc_new_fs()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-22 15:15 [syzbot] [bcachefs?] kernel BUG in bch2_btree_root_read syzbot
@ 2024-11-25 6:53 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-25 6:53 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Kill bch2_bucket_alloc_new_fs()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-03 8:10 [syzbot] [bcachefs?] kernel BUG in __bch2_btree_node_write syzbot
@ 2024-11-25 6:52 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-25 6:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix dup/misordered check in btree node read
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-22 18:44 [syzbot] [bcachefs?] kernel BUG in bch2_btree_pos_to_text (2) syzbot
@ 2024-11-25 3:59 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-25 3:59 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix btree node scan when unknown btree IDs are present
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2020-10-13 17:02 WARNING in drop_nlink (2) syzbot
@ 2024-11-20 15:35 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-20 15:35 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
There will be no such crash title under the new report extraction rules
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-23 4:12 [syzbot] [bcachefs?] kernel BUG in bch2_ptr_swab syzbot
@ 2024-11-11 21:16 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-11 21:16 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix assertion pop in bch2_ptr_swab()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-07-30 1:14 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in journal_entry_dev_usage_to_text syzbot
@ 2024-11-11 21:03 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-11 21:03 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix journal_entry_dev_usage_to_text() overrun
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-18 7:37 [syzbot] [bcachefs?] kernel BUG in bch2_fs_btree_cache_exit syzbot
@ 2024-11-11 4:46 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-11 4:46 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: bch2_btree_write_buffer_flush_going_ro()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-24 17:47 [syzbot] [bcachefs?] kernel BUG in bch2_run_recovery_pass syzbot
@ 2024-11-11 4:31 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-11 4:31 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Allow for unknown key types in backpointers fsck
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-23 11:21 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (2) syzbot
@ 2024-11-11 3:14 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-11 3:14 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix missing validation for bch_backpointer.level
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-11-09 15:43 [syzbot] [bcachefs?] kernel BUG in __bch2_btree_node_hash_insert syzbot
@ 2024-11-11 3:13 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-11 3:13 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix assertion pop in topology repair
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-27 1:10 [syzbot] [bcachefs?] kernel BUG in bch2_bkey_pack_pos_lossy syzbot
@ 2024-11-08 5:11 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 5:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix validate_bset() repair path
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-30 16:39 [syzbot] [bcachefs?] kernel BUG in __bkey_unpack_pos syzbot
@ 2024-11-08 5:02 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 5:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix validate_bset() repair path
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-21 13:07 [syzbot] [bcachefs?] kernel BUG in bch2_dev_btree_bitmap_mark syzbot
@ 2024-11-08 4:25 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 4:25 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix bch_member.btree_bitmap_shift validation
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-25 6:48 [syzbot] [bcachefs?] kernel BUG in bch2_journal_res_get (2) syzbot
@ 2024-11-08 3:28 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 3:28 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: bch2_btree_write_buffer_flush_going_ro()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-25 6:49 [syzbot] [bcachefs?] kernel BUG in bch2_trans_node_iter_init syzbot
@ 2024-11-08 3:21 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 3:21 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Fix missing validation for bch_backpointer.level
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-09-28 2:13 [syzbot] [bcachefs?] kernel BUG in bch2_fs_btree_write_buffer_exit syzbot
@ 2024-11-08 3:04 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 3:04 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: bch2_btree_write_buffer_flush_going_ro()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-27 3:54 [syzbot] [bcachefs?] kernel BUG in bch2_inconsistent_error syzbot
@ 2024-11-08 0:48 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 0:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Change OPT_STR max to be 1 less than the size of choices array
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-25 6:49 [syzbot] [bcachefs?] kernel BUG in __bch2_bkey_cmp_packed_format_checked syzbot
@ 2024-11-08 0:34 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 0:34 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: Ancient versions with bad bkey_formats are no longer supported
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-21 4:31 [syzbot] [bcachefs?] kernel BUG in __bch2_trans_commit syzbot
@ 2024-11-08 0:18 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-11-08 0:18 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix: bcachefs: -o norecovery now bails out of recovery earlier
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2021-02-01 10:07 BUG: Bad page state (8) syzbot
@ 2024-10-28 14:11 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-10-28 14:11 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-23 14:27 [syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in validate_sb_layout syzbot
@ 2024-10-26 0:49 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-10-26 0:49 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Fix invalid shift in validate_sb_layout()
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-21 6:44 [syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in bch2_alloc_to_text syzbot
@ 2024-10-26 0:47 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-10-26 0:47 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: fix shift oob in alloc_lru_idx_fragmentation
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-10-03 17:42 [syzbot] [bcachefs?] possible deadlock in bch2_replicas_entry_validate syzbot
@ 2024-10-16 6:42 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-10-16 6:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: kent.overstreet@linux.dev
#syz fix bcachefs: Fix lockdep splat in bch2_accounting_read
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2020-08-08 21:27 KASAN: use-after-free Read in __queue_work (3) syzbot
@ 2024-09-06 10:40 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:40 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Repro triggers a different kind of problem
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2020-11-21 1:55 INFO: task can't die in shrink_inactive_list (2) syzbot
@ 2024-09-06 10:39 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:39 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2022-09-25 11:18 [syzbot] WARNING in __change_page_attr_set_clr syzbot
@ 2024-09-06 10:39 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:39 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Repro triggers a different problem
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2023-10-16 7:38 [syzbot] [kernel?] KASAN: slab-use-after-free Read in reweight_entity syzbot
@ 2024-09-06 10:38 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:38 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Repro triggers a different kind of an issue
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2023-11-16 11:09 [syzbot] [kernel?] inconsistent lock state in __lock_task_sighand syzbot
@ 2024-09-06 10:37 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:37 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2022-07-12 12:03 [syzbot] inconsistent lock state in find_vmap_area syzbot
@ 2024-09-06 10:36 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:36 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
Repro now triggers a different kind of problem
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2020-08-04 15:46 KASAN: use-after-free Read in __sco_sock_close syzbot
@ 2024-09-06 10:35 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:35 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
The reproducer now hits
WARNING: CPU: 0 PID: 5640 at net/bluetooth/hci_conn.c:565
hci_conn_timeout+0xfb/0x290 net/bluetooth/hci_conn.c:565
for which we have a separate bug.
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-08-27 2:12 [syzbot] [sound?] WARNING in snd_pcm_open syzbot
@ 2024-09-06 10:33 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-09-06 10:33 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2021-02-26 14:48 general protection fault in try_to_wake_up (2) syzbot
@ 2024-07-25 16:29 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-07-25 16:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: axboe@kernel.dk
#syz invalid
--
Jens Axboe
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2022-10-17 7:43 [syzbot] possible deadlock in attr_data_get_block syzbot
@ 2024-07-17 8:19 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-07-17 8:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: almaz.alexandrovich@paragon-software.com
#syz test: https://github.com/Paragon-Software-Group/linux-ntfs3.git
d57431c6f511bf020e474026d9f3123d7bfbea8c
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2023-06-05 3:53 [syzbot] [ext4?] WARNING: locking bug in ext4_move_extents syzbot
@ 2024-07-03 7:48 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-07-03 7:48 UTC (permalink / raw)
To: linux-kernel
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.
***
Subject:
Author: bottaawesome633@gmail.com
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2024-01-12 20:14 [syzbot] upstream build error (21) syzbot
@ 2024-06-20 8:00 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-06-20 8:00 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
[not found] <mailman.217.1706634262.2961.pvrusb2@isely.net>
@ 2024-02-15 16:26 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2024-02-15 16:26 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazin@getstate.dev
#syz test
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2018-11-24 19:40 WARNING in csum_and_copy_to_iter syzbot
@ 2023-11-24 10:30 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2023-11-24 10:30 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: nogikh@google.com
The issue has not been happening for >1800 days.
#syz invalid
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2023-11-15 9:34 [syzbot] [dri?] divide error in drm_mode_debug_printmodeline syzbot
2023-11-16 2:33 ` [syzbot] syzbot
@ 2023-11-16 3:29 ` syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2023-11-16 3:29 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazinalhaddad05@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2023-11-15 9:34 [syzbot] [dri?] divide error in drm_mode_debug_printmodeline syzbot
@ 2023-11-16 2:33 ` syzbot
2023-11-16 3:29 ` [syzbot] syzbot
1 sibling, 0 replies; 214+ messages in thread
From: syzbot @ 2023-11-16 2:33 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: mazinalhaddad05@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master
^ permalink raw reply [flat|nested] 214+ messages in thread
* Re: [syzbot]
2022-02-10 19:17 [syzbot] general protection fault in blk_mq_free_rqs syzbot
@ 2023-11-10 18:56 ` syzbot
0 siblings, 0 replies; 214+ messages in thread
From: syzbot @ 2023-11-10 18:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: yuran.pereira@hotmail.com
#syz test: https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 214+ messages in thread
end of thread, other threads:[~2025-06-19 21:00 UTC | newest]
Thread overview: 214+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-05 17:32 [syzbot] [net?] memory leak in ___neigh_create (2) syzbot
2024-01-05 17:33 ` syzbot
2024-01-05 17:34 ` syzbot
2024-01-05 17:35 ` syzbot
2024-01-05 17:36 ` syzbot
2024-01-05 17:37 ` syzbot
2024-01-05 17:38 ` syzbot
2024-01-05 17:39 ` syzbot
2024-01-05 17:40 ` syzbot
2024-01-05 17:41 ` syzbot
2024-01-05 17:42 ` syzbot
2024-01-05 17:43 ` syzbot
2024-01-05 17:44 ` syzbot
2024-01-05 17:45 ` syzbot
2024-01-05 17:46 ` syzbot
2024-01-05 17:47 ` syzbot
2024-01-05 17:48 ` syzbot
2024-01-05 17:49 ` syzbot
2024-01-05 17:50 ` syzbot
2024-01-05 17:51 ` syzbot
2024-01-05 17:52 ` syzbot
2024-01-05 17:53 ` syzbot
2024-01-05 17:54 ` syzbot
2024-01-05 17:55 ` syzbot
2024-01-05 17:56 ` syzbot
2024-01-05 17:57 ` syzbot
2024-01-05 17:58 ` syzbot
2024-01-05 17:59 ` syzbot
2024-01-05 18:00 ` syzbot
2024-01-05 18:01 ` syzbot
2024-01-05 18:02 ` syzbot
2024-01-05 18:03 ` syzbot
2024-01-05 18:04 ` syzbot
2024-01-05 18:05 ` syzbot
2024-01-05 18:06 ` syzbot
2024-01-05 18:07 ` syzbot
2024-01-05 18:08 ` syzbot
2024-01-05 18:09 ` syzbot
2024-01-05 18:10 ` syzbot
2024-01-05 18:11 ` syzbot
2024-01-05 18:12 ` syzbot
2024-01-05 18:13 ` syzbot
2024-01-05 18:14 ` syzbot
2024-01-05 18:15 ` syzbot
2024-01-05 18:16 ` syzbot
2024-01-05 18:17 ` syzbot
2024-01-05 18:18 ` syzbot
2024-01-05 18:19 ` syzbot
2024-01-05 18:20 ` Florian Fainelli
2024-01-05 18:20 ` syzbot
2024-01-05 18:21 ` syzbot
2024-01-05 18:22 ` syzbot
2024-01-05 18:23 ` syzbot
2024-01-05 18:25 ` Eric Dumazet
2024-01-05 18:24 ` syzbot
2024-01-05 18:25 ` syzbot
2024-01-05 18:26 ` syzbot
2024-01-05 18:27 ` syzbot
2024-01-05 18:28 ` syzbot
2024-01-05 18:29 ` syzbot
2024-01-05 18:30 ` syzbot
2024-01-05 18:31 ` syzbot
2024-01-05 18:32 ` syzbot
2024-01-05 18:33 ` syzbot
2024-01-05 18:34 ` syzbot
2024-01-05 18:35 ` syzbot
2024-01-05 18:36 ` syzbot
2024-01-05 18:37 ` syzbot
2024-01-05 18:38 ` syzbot
2024-01-05 18:39 ` syzbot
2024-01-05 18:40 ` syzbot
2024-01-05 18:41 ` syzbot
2024-01-05 18:46 ` Aleksandr Nogikh
2024-04-04 18:26 ` [syzbot] " syzbot
2024-04-18 18:27 ` syzbot
2024-05-02 18:28 ` syzbot
2024-05-16 18:28 ` syzbot
2024-05-30 18:29 ` syzbot
2024-06-13 18:30 ` syzbot
2024-06-27 18:31 ` syzbot
2024-07-11 18:32 ` syzbot
2024-07-25 18:33 ` syzbot
2024-08-08 18:34 ` syzbot
2024-08-22 18:35 ` syzbot
2024-09-05 11:54 ` [syzbot] syzbot
-- strict thread matches above, loose matches on Subject: below --
2025-06-12 7:52 [syzbot] [bcachefs?] WARNING in __init_work (2) syzbot
2025-06-19 20:54 ` [syzbot] syzbot
2025-06-10 19:15 [syzbot] [bcachefs?] divide error in bch2_sb_members_v2_to_text syzbot
2025-06-19 21:00 ` [syzbot] syzbot
2025-06-08 5:52 [syzbot] [bcachefs?] kernel BUG in vfs_get_tree (2) syzbot
2025-06-19 20:57 ` [syzbot] syzbot
2025-05-31 15:09 [syzbot] [bcachefs?] WARNING in lookup_object_or_alloc syzbot
2025-06-19 20:54 ` [syzbot] syzbot
2025-05-26 10:41 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in bch2_sb_members_v2_to_text syzbot
2025-06-08 15:33 ` [syzbot] syzbot
2025-05-26 8:50 [syzbot] [bcachefs?] WARNING in rhashtable_init_noprof syzbot
2025-06-08 15:41 ` [syzbot] syzbot
2025-04-28 17:04 [syzbot] [bcachefs?] UBSAN: array-index-out-of-bounds in bch2_sb_downgrade_update syzbot
2025-06-08 16:01 ` [syzbot] syzbot
2025-04-08 11:53 [syzbot] [bcachefs?] WARNING in bch2_dev_free syzbot
2025-04-18 0:37 ` [syzbot] syzbot
2025-03-31 14:06 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_copygc (2) syzbot
2025-04-01 4:10 ` [syzbot] syzbot
2025-03-31 2:14 [syzbot] [input?] [usb?] UBSAN: shift-out-of-bounds in __kfifo_alloc syzbot
2025-04-01 10:18 ` [syzbot] syzbot
2025-04-01 10:24 ` [syzbot] syzbot
2025-04-01 11:04 ` [syzbot] syzbot
2025-03-30 16:49 [syzbot] [pci?] upstream test error: BUG: unable to handle kernel NULL pointer dereference in msix_prepare_msi_desc syzbot
2025-04-03 7:06 ` [syzbot] syzbot
2025-03-30 10:15 [syzbot] [pci?] upstream test error: general protection fault in msix_prepare_msi_desc syzbot
2025-04-03 7:06 ` [syzbot] syzbot
2025-03-09 4:20 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_extent_crc_append (2) syzbot
2025-04-01 3:55 ` [syzbot] syzbot
2025-02-23 6:02 [syzbot] linux-next build error (20) syzbot
2025-04-14 14:48 ` [syzbot] syzbot
2025-02-17 11:55 [syzbot] [usb?] KMSAN: uninit-value in mii_nway_restart (2) syzbot
2025-02-17 20:59 ` [syzbot] syzbot
2025-04-11 12:15 ` [syzbot] syzbot
2025-02-17 11:55 [syzbot] [can?] WARNING in ucan_probe syzbot
2025-02-17 17:59 ` [syzbot] syzbot
2025-02-13 18:25 [syzbot] [ppp?] KMSAN: uninit-value in ppp_sync_send (2) syzbot
2025-02-15 7:58 ` [syzbot] syzbot
2025-02-15 12:33 ` [syzbot] syzbot
2025-02-15 14:31 ` [syzbot] syzbot
2025-02-15 18:42 ` [syzbot] syzbot
2025-02-15 19:35 ` [syzbot] syzbot
2025-04-07 14:06 ` [syzbot] Arnaud Lecomte
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
2025-04-07 14:17 ` [syzbot] syzbot
2025-04-07 14:17 ` [syzbot] Arnaud Lecomte
2025-02-12 13:41 [syzbot] [modules?] KMSAN: uninit-value in __request_module (6) syzbot
2025-02-13 14:21 ` [syzbot] syzbot
2025-02-13 18:22 ` [syzbot] syzbot
2025-02-12 10:57 [syzbot] [jfs?] KASAN: slab-out-of-bounds Read in ea_get (4) syzbot
2025-02-12 22:56 ` [syzbot] syzbot
2025-02-09 5:48 [syzbot] [isofs?] KMSAN: uninit-value in isofs_readdir syzbot
2025-02-09 23:50 ` [syzbot] syzbot
2025-02-11 1:00 ` [syzbot] syzbot
2025-02-04 15:33 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_ptr_v2_validate syzbot
2025-04-01 3:56 ` [syzbot] syzbot
2025-01-29 9:17 [syzbot] [bcachefs?] KMSAN: uninit-value in btree_interior_update_work syzbot
2025-04-01 3:57 ` [syzbot] syzbot
2025-01-17 6:14 [syzbot] [usb?] general protection fault in status_show syzbot
2025-01-17 15:41 ` [syzbot] syzbot
2025-01-12 6:45 [syzbot] [iommu?] UBSAN: shift-out-of-bounds in iova_bitmap_alloc syzbot
2025-01-12 11:58 ` [syzbot] syzbot
2025-01-11 13:37 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_readdir (2) syzbot
2025-04-01 3:59 ` [syzbot] syzbot
2025-01-11 0:40 [syzbot] [usb?] general protection fault in qt2_read_bulk_callback syzbot
2025-01-11 17:19 ` [syzbot] syzbot
2025-01-03 1:56 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_trans_start_alloc_update_noupdate syzbot
2025-04-01 3:58 ` [syzbot] syzbot
2025-01-02 14:45 [syzbot] [f2fs?] KASAN: slab-out-of-bounds Read in f2fs_getxattr syzbot
2025-01-07 22:19 ` [syzbot] syzbot
2025-01-08 14:13 ` [syzbot] syzbot
2025-01-01 20:55 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_inode_unpack (2) syzbot
2025-04-01 3:58 ` [syzbot] syzbot
2024-12-25 2:26 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in force_devcd_write syzbot
2024-12-26 3:43 ` [syzbot] syzbot
2024-12-24 14:42 [syzbot] [bcachefs?] KMSAN: uninit-value in __bch2_bkey_cmp_left_packed syzbot
2025-04-01 4:02 ` [syzbot] syzbot
2024-12-24 6:38 [syzbot] [input?] KASAN: null-ptr-deref Write in input_ff_create syzbot
2024-12-25 16:44 ` [syzbot] syzbot
2024-12-19 10:14 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_dirent_rename (2) syzbot
2025-04-01 4:04 ` [syzbot] syzbot
2024-12-15 8:10 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_checksum_update (2) syzbot
2025-04-01 4:06 ` [syzbot] syzbot
2024-12-13 19:13 [syzbot] [bcachefs?] KMSAN: uninit-value in __build_ro_aux_tree syzbot
2025-04-01 4:03 ` [syzbot] syzbot
2024-12-13 7:56 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_xattr_validate syzbot
2025-04-01 4:06 ` [syzbot] syzbot
2025-04-01 4:07 ` [syzbot] syzbot
2024-12-04 17:36 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_dev_freespace_init syzbot
2025-04-01 4:03 ` [syzbot] syzbot
2024-12-01 9:40 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_get syzbot
2025-04-01 3:59 ` [syzbot] syzbot
2024-12-01 8:34 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_ptrs_validate syzbot
2025-04-01 4:02 ` [syzbot] syzbot
2024-11-30 19:55 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_dirent_validate syzbot
2025-04-01 4:04 ` [syzbot] syzbot
2024-11-29 16:59 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_val_validate syzbot
2025-04-01 4:02 ` [syzbot] syzbot
2024-11-28 9:49 [syzbot] [bcachefs?] kernel BUG in bch2_get_scanned_nodes syzbot
2024-11-28 20:31 ` [syzbot] syzbot
2024-11-27 18:59 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bkey_cmp_packed_inlined (2) syzbot
2025-04-01 4:01 ` [syzbot] syzbot
2024-11-27 0:00 [syzbot] upstream build error (22) syzbot
2025-02-03 12:55 ` [syzbot] syzbot
2024-11-26 0:00 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_trans_start_alloc_update syzbot
2025-04-01 4:08 ` [syzbot] syzbot
2024-11-25 13:28 [syzbot] [bcachefs?] kernel BUG in bch2_journal_pin_set syzbot
2024-11-28 3:23 ` [syzbot] syzbot
2024-11-25 13:28 [syzbot] [bcachefs?] BUG: corrupted list in bch2_btree_and_journal_iter_exit syzbot
2024-11-28 20:12 ` [syzbot] syzbot
2024-11-25 13:05 [syzbot] [bcachefs?] kernel BUG in bch2_evacuate_bucket syzbot
2024-11-29 0:39 ` [syzbot] syzbot
2024-11-25 3:10 [syzbot] [bcachefs?] kernel BUG in __bch2_journal_pin_put syzbot
2024-11-28 3:00 ` [syzbot] syzbot
2024-11-22 18:44 [syzbot] [bcachefs?] kernel BUG in bch2_btree_pos_to_text (2) syzbot
2024-11-25 3:59 ` [syzbot] syzbot
2024-11-22 18:44 [syzbot] [bcachefs?] KMSAN: uninit-value in rw_aux_tree_set (2) syzbot
2025-04-01 4:09 ` [syzbot] syzbot
2024-11-22 15:15 [syzbot] [bcachefs?] kernel BUG in bch2_btree_root_read syzbot
2024-11-25 6:53 ` [syzbot] syzbot
2024-11-22 14:42 [syzbot] [netfilter?] KMSAN: uninit-value in ip6table_mangle_hook (3) syzbot
2024-12-14 22:16 ` [syzbot] syzbot
2024-12-14 22:21 ` [syzbot] syzbot
2024-12-15 2:34 ` [syzbot] syzbot
2024-11-21 12:40 [syzbot] [bcachefs?] kernel BUG in bch2_btree_node_lock_write syzbot
2024-11-28 3:12 ` [syzbot] syzbot
2024-11-19 7:33 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_inode_v3_validate syzbot
2025-04-01 4:08 ` [syzbot] syzbot
2024-11-18 21:41 [syzbot] [bcachefs?] kernel BUG in bch2_bucket_alloc_trans (3) syzbot
2024-11-25 6:54 ` [syzbot] syzbot
2024-11-17 8:54 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_iter_init (2) syzbot
2025-04-01 4:07 ` [syzbot] syzbot
2024-11-17 8:54 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_alloc_v4_validate (2) syzbot
2025-04-01 4:00 ` [syzbot] syzbot
2024-11-12 3:25 [syzbot] [bcachefs?] possible deadlock in bch2_alloc_sectors_start_trans syzbot
2024-11-29 0:34 ` [syzbot] syzbot
2024-11-11 0:28 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_btree_node_check_topology syzbot
2025-04-01 4:10 ` [syzbot] syzbot
2024-11-09 15:43 [syzbot] [bcachefs?] kernel BUG in __bch2_btree_node_hash_insert syzbot
2024-11-11 3:13 ` [syzbot] syzbot
2024-11-08 15:57 [syzbot] [bcachefs?] kernel BUG in bch2_rechecksum_bio syzbot
2024-11-29 0:32 ` [syzbot] syzbot
2024-11-06 13:58 [syzbot] [bcachefs?] KMSAN: uninit-value in bch2_bucket_alloc_early syzbot
2025-04-01 4:05 ` [syzbot] syzbot
2024-11-06 13:24 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_traverse_one syzbot
2024-11-28 3:27 ` [syzbot] syzbot
2024-10-30 16:39 [syzbot] [bcachefs?] kernel BUG in __bkey_unpack_pos syzbot
2024-11-08 5:02 ` [syzbot] syzbot
2024-10-28 15:49 [syzbot] [bcachefs?] kernel BUG in bch2_btree_write_buffer_flush_locked syzbot
2024-11-28 3:21 ` [syzbot] syzbot
2024-10-27 3:54 [syzbot] [bcachefs?] kernel BUG in bch2_inconsistent_error syzbot
2024-11-08 0:48 ` [syzbot] syzbot
2024-10-27 1:10 [syzbot] [bcachefs?] kernel BUG in bch2_bkey_pack_pos_lossy syzbot
2024-11-08 5:11 ` [syzbot] syzbot
2024-10-25 6:49 [syzbot] [bcachefs?] kernel BUG in __bch2_bkey_cmp_packed_format_checked syzbot
2024-11-08 0:34 ` [syzbot] syzbot
2024-10-25 6:49 [syzbot] [bcachefs?] kernel BUG in bch2_trans_node_iter_init syzbot
2024-11-08 3:21 ` [syzbot] syzbot
2024-10-25 6:48 [syzbot] [bcachefs?] general protection fault in bch2_btree_path_traverse_one syzbot
2024-11-27 8:09 ` [syzbot] syzbot
2024-10-25 6:48 [syzbot] [bcachefs?] kernel BUG in bch2_journal_res_get (2) syzbot
2024-11-08 3:28 ` [syzbot] syzbot
2024-10-24 17:47 [syzbot] [bcachefs?] kernel BUG in bch2_run_recovery_pass syzbot
2024-11-11 4:31 ` [syzbot] syzbot
2024-10-23 18:30 [syzbot] [bcachefs?] possible deadlock in __bch2_trans_relock syzbot
2024-11-28 23:06 ` [syzbot] syzbot
2024-10-23 14:27 [syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in validate_sb_layout syzbot
2024-10-26 0:49 ` [syzbot] syzbot
2024-10-23 11:21 [syzbot] [bcachefs?] kernel BUG in bch2_btree_path_level_init (2) syzbot
2024-11-11 3:14 ` [syzbot] syzbot
2024-10-23 4:12 [syzbot] [bcachefs?] kernel BUG in bch2_ptr_swab syzbot
2024-11-11 21:16 ` [syzbot] syzbot
2024-10-21 13:07 [syzbot] [bcachefs?] kernel BUG in bch2_dev_btree_bitmap_mark syzbot
2024-11-08 4:25 ` [syzbot] syzbot
2024-10-21 6:44 [syzbot] [bcachefs?] UBSAN: shift-out-of-bounds in bch2_alloc_to_text syzbot
2024-10-26 0:47 ` [syzbot] syzbot
2024-10-21 4:31 [syzbot] [bcachefs?] kernel BUG in __bch2_trans_commit syzbot
2024-11-08 0:18 ` [syzbot] syzbot
2024-10-18 7:37 [syzbot] [bcachefs?] kernel BUG in bch2_fs_btree_cache_exit syzbot
2024-11-11 4:46 ` [syzbot] syzbot
2024-10-03 17:42 [syzbot] [bcachefs?] possible deadlock in bch2_replicas_entry_validate syzbot
2024-10-16 6:42 ` [syzbot] syzbot
2024-10-03 8:10 [syzbot] [bcachefs?] kernel BUG in __bch2_btree_node_write syzbot
2024-11-25 6:52 ` [syzbot] syzbot
2024-09-28 2:13 [syzbot] [bcachefs?] kernel BUG in bch2_fs_btree_write_buffer_exit syzbot
2024-11-08 3:04 ` [syzbot] syzbot
2024-09-18 7:28 [syzbot] [bcachefs?] WARNING in bch2_journal_flush_seq_async syzbot
2024-11-28 22:50 ` [syzbot] syzbot
2024-08-27 2:12 [syzbot] [sound?] WARNING in snd_pcm_open syzbot
2024-09-06 10:33 ` [syzbot] syzbot
2024-07-30 1:14 [syzbot] [bcachefs?] KASAN: slab-out-of-bounds Read in journal_entry_dev_usage_to_text syzbot
2024-11-11 21:03 ` [syzbot] syzbot
2024-07-24 8:59 [syzbot] [bluetooth?] KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync syzbot
2024-12-05 1:58 ` [syzbot] syzbot
2024-12-23 22:19 ` [syzbot] syzbot
2024-07-17 13:39 [syzbot] [bcachefs?] general protection fault in bch2_checksum syzbot
2024-11-28 22:59 ` [syzbot] syzbot
2024-07-13 22:54 [syzbot] [bpf?] [trace?] possible deadlock in console_flush_all (3) syzbot
2025-06-19 20:48 ` [syzbot] syzbot
2024-07-10 20:55 [syzbot] [bcachefs?] kernel BUG in bch2_journal_noflush_seq syzbot
2024-11-28 22:12 ` [syzbot] syzbot
2024-06-14 12:16 [syzbot] [crypto?] [bcachefs?] BUG: unable to handle kernel paging request in crypto_skcipher_encrypt syzbot
2024-11-25 7:19 ` [syzbot] syzbot
[not found] <mailman.217.1706634262.2961.pvrusb2@isely.net>
2024-02-15 16:26 ` [syzbot] syzbot
2024-01-12 20:14 [syzbot] upstream build error (21) syzbot
2024-06-20 8:00 ` [syzbot] syzbot
2023-11-16 11:09 [syzbot] [kernel?] inconsistent lock state in __lock_task_sighand syzbot
2024-09-06 10:37 ` [syzbot] syzbot
2023-11-15 9:34 [syzbot] [dri?] divide error in drm_mode_debug_printmodeline syzbot
2023-11-16 2:33 ` [syzbot] syzbot
2023-11-16 3:29 ` [syzbot] syzbot
2023-10-16 7:38 [syzbot] [kernel?] KASAN: slab-use-after-free Read in reweight_entity syzbot
2024-09-06 10:38 ` [syzbot] syzbot
2023-06-05 3:53 [syzbot] [ext4?] WARNING: locking bug in ext4_move_extents syzbot
2024-07-03 7:48 ` [syzbot] syzbot
2022-12-21 8:15 [syzbot] possible deadlock in page_cache_ra_unbounded syzbot
2025-01-08 16:11 ` [syzbot] syzbot
2022-10-17 7:43 [syzbot] possible deadlock in attr_data_get_block syzbot
2024-07-17 8:19 ` [syzbot] syzbot
2022-09-25 11:18 [syzbot] WARNING in __change_page_attr_set_clr syzbot
2024-09-06 10:39 ` [syzbot] syzbot
2022-07-12 12:03 [syzbot] inconsistent lock state in find_vmap_area syzbot
2024-09-06 10:36 ` [syzbot] syzbot
2022-02-10 19:17 [syzbot] general protection fault in blk_mq_free_rqs syzbot
2023-11-10 18:56 ` [syzbot] syzbot
2021-02-26 14:48 general protection fault in try_to_wake_up (2) syzbot
2024-07-25 16:29 ` [syzbot] syzbot
2021-02-01 10:07 BUG: Bad page state (8) syzbot
2024-10-28 14:11 ` [syzbot] syzbot
2020-11-21 1:55 INFO: task can't die in shrink_inactive_list (2) syzbot
2024-09-06 10:39 ` [syzbot] syzbot
2020-10-13 17:02 WARNING in drop_nlink (2) syzbot
2024-11-20 15:35 ` [syzbot] syzbot
2020-08-08 21:27 KASAN: use-after-free Read in __queue_work (3) syzbot
2024-09-06 10:40 ` [syzbot] syzbot
2020-08-04 15:46 KASAN: use-after-free Read in __sco_sock_close syzbot
2024-09-06 10:35 ` [syzbot] syzbot
2018-11-24 19:40 WARNING in csum_and_copy_to_iter syzbot
2023-11-24 10:30 ` [syzbot] syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®