memory leak in r8712_init_recv_priv

memory leak in r8712_init_recv_priv

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    467f8165 Merge tag 'close-range-cloexec-unshare-v5.11' of ..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=142b5745500000
kernel config:  https://syzkaller.appspot.com/x/.config?x=37c889fb8b2761af
dashboard link: https://syzkaller.appspot.com/bug?extid=1c46f3771695bccbdb3a
compiler:       gcc (GCC) 10.1.0-syz 20200507
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1265cb37500000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1763527b500000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1c46f3771695bccbdb3a@syzkaller.appspotmail.com

executing program
BUG: memory leak
unreferenced object 0xffff88810ecc26c0 (size 192):
  comm "kworker/1:1", pid 35, jiffies 4294942461 (age 18.010s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 d8 26 cc 0e 81 88 ff ff  .........&......
  backtrace:
    [<000000005aecb941>] kmalloc include/linux/slab.h:557 [inline]
    [<000000005aecb941>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007c4331ea>] r8712_os_recvbuf_resource_alloc+0x1b/0x80 drivers/staging/rtl8712/recv_linux.c:46
    [<0000000026fac6b7>] r8712_init_recv_priv+0x96/0x210 drivers/staging/rtl8712/rtl8712_recv.c:54
    [<000000004dbac0de>] _r8712_init_recv_priv+0x134/0x150 drivers/staging/rtl8712/rtl871x_recv.c:78
    [<000000009f37c02e>] r8712_init_drv_sw+0xa0/0x1d0 drivers/staging/rtl8712/os_intfs.c:312
    [<00000000439d06d7>] r871xu_drv_init.cold+0x104/0x7d1 drivers/staging/rtl8712/usb_intf.c:391
    [<00000000a5c43c27>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000106f93f1>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<00000000856556bd>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<00000000789974b2>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000003b6b23b1>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000d916cd73>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<000000000aa7621e>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000c2fd5fd8>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<00000000d7a5749a>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000197a0613>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff88810ecc2600 (size 192):
  comm "kworker/1:1", pid 35, jiffies 4294942461 (age 18.010s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 18 26 cc 0e 81 88 ff ff  .........&......
  backtrace:
    [<000000005aecb941>] kmalloc include/linux/slab.h:557 [inline]
    [<000000005aecb941>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007c4331ea>] r8712_os_recvbuf_resource_alloc+0x1b/0x80 drivers/staging/rtl8712/recv_linux.c:46
    [<0000000026fac6b7>] r8712_init_recv_priv+0x96/0x210 drivers/staging/rtl8712/rtl8712_recv.c:54
    [<000000004dbac0de>] _r8712_init_recv_priv+0x134/0x150 drivers/staging/rtl8712/rtl871x_recv.c:78
    [<000000009f37c02e>] r8712_init_drv_sw+0xa0/0x1d0 drivers/staging/rtl8712/os_intfs.c:312
    [<00000000439d06d7>] r871xu_drv_init.cold+0x104/0x7d1 drivers/staging/rtl8712/usb_intf.c:391
    [<00000000a5c43c27>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000106f93f1>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<00000000856556bd>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<00000000789974b2>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000003b6b23b1>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000d916cd73>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<000000000aa7621e>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000c2fd5fd8>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<00000000d7a5749a>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000197a0613>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238

BUG: memory leak
unreferenced object 0xffff88810ecc2540 (size 192):
  comm "kworker/1:1", pid 35, jiffies 4294942461 (age 18.010s)
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 58 25 cc 0e 81 88 ff ff  ........X%......
  backtrace:
    [<000000005aecb941>] kmalloc include/linux/slab.h:557 [inline]
    [<000000005aecb941>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<000000007c4331ea>] r8712_os_recvbuf_resource_alloc+0x1b/0x80 drivers/staging/rtl8712/recv_linux.c:46
    [<0000000026fac6b7>] r8712_init_recv_priv+0x96/0x210 drivers/staging/rtl8712/rtl8712_recv.c:54
    [<000000004dbac0de>] _r8712_init_recv_priv+0x134/0x150 drivers/staging/rtl8712/rtl871x_recv.c:78
    [<000000009f37c02e>] r8712_init_drv_sw+0xa0/0x1d0 drivers/staging/rtl8712/os_intfs.c:312
    [<00000000439d06d7>] r871xu_drv_init.cold+0x104/0x7d1 drivers/staging/rtl8712/usb_intf.c:391
    [<00000000a5c43c27>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
    [<00000000106f93f1>] really_probe+0x159/0x480 drivers/base/dd.c:561
    [<00000000856556bd>] driver_probe_device+0x84/0x100 drivers/base/dd.c:745
    [<00000000789974b2>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:851
    [<000000003b6b23b1>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
    [<00000000d916cd73>] __device_attach+0x122/0x250 drivers/base/dd.c:919
    [<000000000aa7621e>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
    [<00000000c2fd5fd8>] device_add+0x5be/0xc30 drivers/base/core.c:3091
    [<00000000d7a5749a>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
    [<00000000197a0613>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

Re: memory leak in r8712_init_recv_priv

[Nikita Zhandarovich]

Hi,

I am pretty sure this issue is close to obsolete.
Original error, I imagine, has been fixed in some other commit,
while the latest bug iteration refers to a similar but technically
different issue [1] with a trace:

BUG: memory leak
unreferenced object 0xffff88810891f000 (size 4096):
  comm "kworker/0:4", pid 5084, jiffies 4294944455
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    [<ffffffff8166d8d2>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline]
    [<ffffffff8166d8d2>] slab_post_alloc_hook mm/slub.c:3944 [inline]
    [<ffffffff8166d8d2>] slab_alloc_node mm/slub.c:4000 [inline]
    [<ffffffff8166d8d2>] kmalloc_trace_noprof+0x282/0x320 mm/slub.c:4147
    [<ffffffff84171382>] kmalloc_noprof include/linux/slab.h:660 [inline]
    [<ffffffff84171382>] _r8712_init_xmit_priv+0x2b2/0x6e0 drivers/staging/rtl8712/rtl871x_xmit.c:130
    [<ffffffff8416bb57>] r8712_init_drv_sw+0xc7/0x2a0 drivers/staging/rtl8712/os_intfs.c:311
    [<ffffffff8416a6d6>] r871xu_drv_init+0x1c6/0x930 drivers/staging/rtl8712/usb_intf.c:386
    [<ffffffff836c72bf>] usb_probe_interface+0x16f/0x3f0 drivers/usb/core/driver.c:399
    [<ffffffff82fafe8c>] call_driver_probe drivers/base/dd.c:578 [inline]
    [<ffffffff82fafe8c>] really_probe+0x12c/0x430 drivers/base/dd.c:656
    [<ffffffff82fb0263>] __driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:79

[1] Other issue in question can be found here:
Link: https://syzkaller.appspot.com/bug?extid=83763e624cfec6b462cb

Patch to fix the error in [1] was sent by
Nam Cao <namcao@linutronix.de>.
Link: https://lore.kernel.org/all/20240525073229.4144612-1-namcao@linutronix.de/T/

Once that change is pushed, this issue should most likely be closed,
since none of the old or newer reproducers trigger original bug.

Regards,
Nikita