net/8021q: memory leak in register_vlan_dev

[Dmitry Vyukov]

Hello,

syzkaller has hit the following memory leak on 4.15-rc7:

unreferenced object 0xffff88007b704140 (size 256):
comm "syz-executor6", pid 5661, jiffies 4294856803 (age 9.848s)
hex dump (first 32 bytes):
00 40 b7 2c 00 88 ff ff 00 00 00 00 00 00 00 00 .@.,............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000050f8eb54>] kmemleak_alloc_recursive
include/linux/kmemleak.h:55 [inline]
[<0000000050f8eb54>] slab_post_alloc_hook mm/slab.h:440 [inline]
[<0000000050f8eb54>] slab_alloc_node mm/slub.c:2725 [inline]
[<0000000050f8eb54>] slab_alloc mm/slub.c:2733 [inline]
[<0000000050f8eb54>] kmem_cache_alloc_trace+0x126/0x290 mm/slub.c:2750
[<000000004d4e9ef7>] kmalloc include/linux/slab.h:499 [inline]
[<000000004d4e9ef7>] kzalloc include/linux/slab.h:688 [inline]
[<000000004d4e9ef7>] vlan_info_alloc net/8021q/vlan_core.c:152 [inline]
[<000000004d4e9ef7>] vlan_vid_add+0x710/0xb20 net/8021q/vlan_core.c:244
[<000000000e87916f>] register_vlan_dev+0xbf/0x600 net/8021q/vlan.c:150
[<00000000b2f0a3d2>] register_vlan_device net/8021q/vlan.c:273 [inline]
[<00000000b2f0a3d2>] vlan_ioctl_handler+0xbac/0x140d net/8021q/vlan.c:593
[<00000000c951ea6d>] sock_ioctl+0x2f8/0x460 net/socket.c:1039
[<00000000e2a8e27a>] vfs_ioctl fs/ioctl.c:46 [inline]
[<00000000e2a8e27a>] file_ioctl fs/ioctl.c:500 [inline]
[<00000000e2a8e27a>] do_vfs_ioctl+0x1cf/0x16b0 fs/ioctl.c:684
[<00000000ec28ff91>] SYSC_ioctl fs/ioctl.c:701 [inline]
[<00000000ec28ff91>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:692

unreferenced object 0xffff88007c49aea0 (size 32):
comm "syz-executor6", pid 5661, jiffies 4294856803 (age 9.862s)
hex dump (first 32 bytes):
e0 41 70 7b 00 88 ff ff e0 41 70 7b 00 88 ff ff .Ap{.....Ap{....
81 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000050f8eb54>] kmemleak_alloc_recursive
include/linux/kmemleak.h:55 [inline]
[<0000000050f8eb54>] slab_post_alloc_hook mm/slab.h:440 [inline]
[<0000000050f8eb54>] slab_alloc_node mm/slub.c:2725 [inline]
[<0000000050f8eb54>] slab_alloc mm/slub.c:2733 [inline]
[<0000000050f8eb54>] kmem_cache_alloc_trace+0x126/0x290 mm/slub.c:2750
[<000000003d983c2c>] kmalloc include/linux/slab.h:499 [inline]
[<000000003d983c2c>] kzalloc include/linux/slab.h:688 [inline]
[<000000003d983c2c>] vlan_vid_info_alloc net/8021q/vlan_core.c:196 [inline]
[<000000003d983c2c>] __vlan_vid_add net/8021q/vlan_core.c:213 [inline]
[<000000003d983c2c>] vlan_vid_add+0x45a/0xb20 net/8021q/vlan_core.c:251
[<000000000e87916f>] register_vlan_dev+0xbf/0x600 net/8021q/vlan.c:150
[<00000000b2f0a3d2>] register_vlan_device net/8021q/vlan.c:273 [inline]
[<00000000b2f0a3d2>] vlan_ioctl_handler+0xbac/0x140d net/8021q/vlan.c:593
[<00000000c951ea6d>] sock_ioctl+0x2f8/0x460 net/socket.c:1039
[<00000000e2a8e27a>] vfs_ioctl fs/ioctl.c:46 [inline]
[<00000000e2a8e27a>] file_ioctl fs/ioctl.c:500 [inline]
[<00000000e2a8e27a>] do_vfs_ioctl+0x1cf/0x16b0 fs/ioctl.c:684
[<00000000ec28ff91>] SYSC_ioctl fs/ioctl.c:701 [inline]
[<00000000ec28ff91>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:692

unreferenced object 0xffff88007d87a200 (size 4096):
comm "syz-executor6", pid 5661, jiffies 4294856803 (age 9.863s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<0000000050f8eb54>] kmemleak_alloc_recursive
include/linux/kmemleak.h:55 [inline]
[<0000000050f8eb54>] slab_post_alloc_hook mm/slab.h:440 [inline]
[<0000000050f8eb54>] slab_alloc_node mm/slub.c:2725 [inline]
[<0000000050f8eb54>] slab_alloc mm/slub.c:2733 [inline]
[<0000000050f8eb54>] kmem_cache_alloc_trace+0x126/0x290 mm/slub.c:2750
[<00000000b52b3185>] kmalloc include/linux/slab.h:499 [inline]
[<00000000b52b3185>] kzalloc include/linux/slab.h:688 [inline]
[<00000000b52b3185>] vlan_group_prealloc_vid net/8021q/vlan.c:70 [inline]
[<00000000b52b3185>] register_vlan_dev+0x4ac/0x600 net/8021q/vlan.c:168
[<00000000b2f0a3d2>] register_vlan_device net/8021q/vlan.c:273 [inline]
[<00000000b2f0a3d2>] vlan_ioctl_handler+0xbac/0x140d net/8021q/vlan.c:593
[<00000000c951ea6d>] sock_ioctl+0x2f8/0x460 net/socket.c:1039
[<00000000e2a8e27a>] vfs_ioctl fs/ioctl.c:46 [inline]
[<00000000e2a8e27a>] file_ioctl fs/ioctl.c:500 [inline]
[<00000000e2a8e27a>] do_vfs_ioctl+0x1cf/0x16b0 fs/ioctl.c:684
[<00000000ec28ff91>] SYSC_ioctl fs/ioctl.c:701 [inline]
[<00000000ec28ff91>] SyS_ioctl+0xb6/0xe0 fs/ioctl.c:692


Reproducer:

// autogenerated by syzkaller (http://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <fcntl.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <unistd.h>

int main()
{
long r[2];
syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0);
r[0] = syscall(__NR_open, "/dev/net/tun", 0);
*(uint8_t*)0x20927fd8 = 0x73;
*(uint8_t*)0x20927fd9 = 0x79;
*(uint8_t*)0x20927fda = 0x7a;
*(uint8_t*)0x20927fdb = 0x30;
*(uint8_t*)0x20927fdc = 0;
*(uint32_t*)0x20927fe8 = 5;
*(uint32_t*)0x20927fec = 0;
*(uint64_t*)0x20927ff0 = 0x20c15000;
*(uint32_t*)0x20c15000 = 0;
*(uint32_t*)0x20c15004 = 0;
*(uint16_t*)0x20c15008 = 0;
syscall(__NR_ioctl, r[0], 0x400454ca, 0x20927fd8);
r[1] = syscall(__NR_socket, 2, 2, 0);
memcpy((void*)0x20006000,
"\x1b\x52\x03\x10\xb5\x64\xc4\x23\x54\xe2\xd0\xb8\xa1\x4e\x1a\xd7", 16);
*(uint32_t*)0x20006010 = 0;
*(uint32_t*)0x20006014 = 0;
*(uint64_t*)0x20006018 = 0x20006000;
*(uint32_t*)0x20006000 = 0;
*(uint8_t*)0x20006004 = 0x73;
*(uint8_t*)0x20006005 = 0x79;
*(uint8_t*)0x20006006 = 0x7a;
*(uint8_t*)0x20006007 = 0x30;
*(uint8_t*)0x20006008 = 0;
syscall(__NR_ioctl, r[1], 0x8983, 0x20006000);
return 0;
}