Hello, syzbot found the following issue on: HEAD commit: 98b1cc82c4af Linux 6.7-rc2 git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=1286e3d4e80000 kernel config: https://syzkaller.appspot.com/x/.config?x=f1b9d95ada516af dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c8f8cce80000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/6b6d520f592c/disk-98b1cc82.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/c2cb6183fd56/vmlinux-98b1cc82.xz kernel image: https://storage.googleapis.com/syzbot-assets/de520cfc8b93/bzImage-98b1cc82.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+1d37bef05da87b99c5a6@xxxxxxxxxxxxxxxxxxxxxxxxx BUG: memory leak unreferenced object 0xffff88811f324000 (size 8192): comm "syz-executor.7", pid 5245, jiffies 4294947603 (age 10.860s) hex dump (first 32 bytes): 00 40 32 1f 81 88 ff ff 00 40 32 1f 81 88 ff ff .@2......@2..... 00 00 00 00 00 00 00 00 00 80 0f 1b 81 88 ff ff ................ backtrace: [<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [<ffffffff8453e829>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff8453e829>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff8453e829>] j1939_priv_create net/can/j1939/main.c:135 [inline] [<ffffffff8453e829>] j1939_netdev_start+0x159/0x6f0 net/can/j1939/main.c:272 [<ffffffff8454046e>] j1939_sk_bind+0x21e/0x550 net/can/j1939/socket.c:485 [<ffffffff83ec4dac>] __sys_bind+0x11c/0x130 net/socket.c:1845 [<ffffffff83ec4ddc>] __do_sys_bind net/socket.c:1856 [inline] [<ffffffff83ec4ddc>] __se_sys_bind net/socket.c:1854 [inline] [<ffffffff83ec4ddc>] __x64_sys_bind+0x1c/0x20 net/socket.c:1854 [<ffffffff84b6bd8f>] do_syscall_x64 arch/x86/entry/common.c:51 [inline] [<ffffffff84b6bd8f>] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:82 [<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: memory leak unreferenced object 0xffff88811f0bf300 (size 240): comm "softirq", pid 0, jiffies 4294947604 (age 10.850s) hex dump (first 32 bytes): 68 74 bb 1d 81 88 ff ff 68 74 bb 1d 81 88 ff ff ht......ht...... 00 80 0f 1b 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81631427>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff81631427>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff81631427>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff81631427>] kmem_cache_alloc_node+0x2c7/0x450 mm/slub.c:3523 [<ffffffff83ed869f>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:641 [<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline] [<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline] [<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline] [<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735 [<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline] [<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144 [<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112 [<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline] [<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606 [<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663 [<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687 [<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529 [<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643 [<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971 [<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533 [<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline] [<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735 [<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88811f340000 (size 131072): comm "softirq", pid 0, jiffies 4294947604 (age 10.850s) hex dump (first 32 bytes): 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8157e703>] __kmalloc_large_node+0xe3/0x170 mm/slab_common.c:1157 [<ffffffff8157ecbb>] __do_kmalloc_node mm/slab_common.c:995 [inline] [<ffffffff8157ecbb>] __kmalloc_node_track_caller+0xbb/0x150 mm/slab_common.c:1027 [<ffffffff83ed49a6>] kmalloc_reserve+0x96/0x170 net/core/skbuff.c:582 [<ffffffff83ed8585>] __alloc_skb+0xd5/0x230 net/core/skbuff.c:651 [<ffffffff845473ef>] alloc_skb include/linux/skbuff.h:1286 [inline] [<ffffffff845473ef>] j1939_session_fresh_new net/can/j1939/transport.c:1535 [inline] [<ffffffff845473ef>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline] [<ffffffff845473ef>] j1939_xtp_rx_rts+0x49f/0xa50 net/can/j1939/transport.c:1735 [<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline] [<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144 [<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112 [<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline] [<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606 [<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663 [<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687 [<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529 [<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643 [<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971 [<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533 [<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline] [<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735 [<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553 BUG: memory leak unreferenced object 0xffff88811dbb7400 (size 512): comm "softirq", pid 0, jiffies 4294947604 (age 10.850s) hex dump (first 32 bytes): 00 40 32 1f 81 88 ff ff 28 50 32 1f 81 88 ff ff .@2.....(P2..... 28 50 32 1f 81 88 ff ff 18 74 bb 1d 81 88 ff ff (P2......t...... backtrace: [<ffffffff816339bd>] kmemleak_alloc_recursive include/linux/kmemleak.h:42 [inline] [<ffffffff816339bd>] slab_post_alloc_hook mm/slab.h:766 [inline] [<ffffffff816339bd>] slab_alloc_node mm/slub.c:3478 [inline] [<ffffffff816339bd>] __kmem_cache_alloc_node+0x2dd/0x3f0 mm/slub.c:3517 [<ffffffff8157e845>] kmalloc_trace+0x25/0x90 mm/slab_common.c:1098 [<ffffffff84542463>] kmalloc include/linux/slab.h:600 [inline] [<ffffffff84542463>] kzalloc include/linux/slab.h:721 [inline] [<ffffffff84542463>] j1939_session_new+0x53/0x140 net/can/j1939/transport.c:1494 [<ffffffff84547485>] j1939_session_fresh_new net/can/j1939/transport.c:1546 [inline] [<ffffffff84547485>] j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1631 [inline] [<ffffffff84547485>] j1939_xtp_rx_rts+0x535/0xa50 net/can/j1939/transport.c:1735 [<ffffffff84547ea5>] j1939_tp_cmd_recv net/can/j1939/transport.c:2057 [inline] [<ffffffff84547ea5>] j1939_tp_recv+0x1b5/0x7f0 net/can/j1939/transport.c:2144 [<ffffffff8453e3f9>] j1939_can_recv+0x349/0x4e0 net/can/j1939/main.c:112 [<ffffffff8452eea4>] deliver net/can/af_can.c:572 [inline] [<ffffffff8452eea4>] can_rcv_filter+0xd4/0x290 net/can/af_can.c:606 [<ffffffff8452f560>] can_receive+0xf0/0x140 net/can/af_can.c:663 [<ffffffff8452f6a0>] can_rcv+0xf0/0x130 net/can/af_can.c:687 [<ffffffff83f10bf6>] __netif_receive_skb_one_core+0x66/0x90 net/core/dev.c:5529 [<ffffffff83f10c6d>] __netif_receive_skb+0x1d/0x90 net/core/dev.c:5643 [<ffffffff83f10fcc>] process_backlog+0xbc/0x190 net/core/dev.c:5971 [<ffffffff83f1215e>] __napi_poll+0x3e/0x310 net/core/dev.c:6533 [<ffffffff83f12b78>] napi_poll net/core/dev.c:6602 [inline] [<ffffffff83f12b78>] net_rx_action+0x3d8/0x510 net/core/dev.c:6735 [<ffffffff84b8974d>] __do_softirq+0xbd/0x2b0 kernel/softirq.c:553 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup
