[syzbot] [hams?] memory leak in nr_create (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 33f2b5785a2b Merge tag 'drm-fixes-2023-06-09' of git://ano..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=127f61b3280000
kernel config: https://syzkaller.appspot.com/x/.config?x=ee975febba574924
dashboard link: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=110a6ef1280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/33eb581c818f/disk-33f2b578.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0bcbec3a83cf/vmlinux-33f2b578.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0e577c2e8783/bzImage-33f2b578.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d327a1...@syzkaller.appspotmail.com

2023/06/09 19:03:53 executed programs: 18
BUG: memory leak
unreferenced object 0xffff888114e76800 (size 2048):
comm "syz-executor.3", pid 5156, jiffies 4294942146 (age 20.470s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<ffffffff815461aa>] __do_kmalloc_node mm/slab_common.c:965 [inline]
[<ffffffff815461aa>] __kmalloc+0x4a/0x120 mm/slab_common.c:979
[<ffffffff83dbe78d>] kmalloc include/linux/slab.h:563 [inline]
[<ffffffff83dbe78d>] sk_prot_alloc+0xcd/0x1b0 net/core/sock.c:2035
[<ffffffff83dc0f06>] sk_alloc+0x36/0x300 net/core/sock.c:2088
[<ffffffff843dea54>] nr_create+0x84/0x1c0 net/netrom/af_netrom.c:438
[<ffffffff83db6e3e>] __sock_create+0x1de/0x300 net/socket.c:1547
[<ffffffff83dba452>] sock_create net/socket.c:1598 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1635 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1620 [inline]
[<ffffffff83dba452>] __sys_socket+0xa2/0x190 net/socket.c:1663
[<ffffffff83dba55e>] __do_sys_socket net/socket.c:1676 [inline]
[<ffffffff83dba55e>] __se_sys_socket net/socket.c:1674 [inline]
[<ffffffff83dba55e>] __x64_sys_socket+0x1e/0x30 net/socket.c:1674
[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff8881185accc0 (size 32):
comm "syz-executor.3", pid 5156, jiffies 4294942146 (age 20.470s)
hex dump (first 32 bytes):
a8 d1 a3 00 81 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81545ac4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
[<ffffffff823168c2>] kmalloc include/linux/slab.h:559 [inline]
[<ffffffff823168c2>] kzalloc include/linux/slab.h:680 [inline]
[<ffffffff823168c2>] apparmor_sk_alloc_security+0x52/0xd0 security/apparmor/lsm.c:828
[<ffffffff822dbe95>] security_sk_alloc+0x35/0x70 security/security.c:4372
[<ffffffff83dbe7be>] sk_prot_alloc+0xfe/0x1b0 net/core/sock.c:2038
[<ffffffff83dc0f06>] sk_alloc+0x36/0x300 net/core/sock.c:2088
[<ffffffff843dea54>] nr_create+0x84/0x1c0 net/netrom/af_netrom.c:438
[<ffffffff83db6e3e>] __sock_create+0x1de/0x300 net/socket.c:1547
[<ffffffff83dba452>] sock_create net/socket.c:1598 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1635 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1620 [inline]
[<ffffffff83dba452>] __sys_socket+0xa2/0x190 net/socket.c:1663
[<ffffffff83dba55e>] __do_sys_socket net/socket.c:1676 [inline]
[<ffffffff83dba55e>] __se_sys_socket net/socket.c:1674 [inline]
[<ffffffff83dba55e>] __x64_sys_socket+0x1e/0x30 net/socket.c:1674
[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff888115867800 (size 2048):
comm "syz-executor.0", pid 5159, jiffies 4294942269 (age 19.240s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:
[<ffffffff815461aa>] __do_kmalloc_node mm/slab_common.c:965 [inline]
[<ffffffff815461aa>] __kmalloc+0x4a/0x120 mm/slab_common.c:979
[<ffffffff83dbe78d>] kmalloc include/linux/slab.h:563 [inline]
[<ffffffff83dbe78d>] sk_prot_alloc+0xcd/0x1b0 net/core/sock.c:2035
[<ffffffff83dc0f06>] sk_alloc+0x36/0x300 net/core/sock.c:2088
[<ffffffff843dea54>] nr_create+0x84/0x1c0 net/netrom/af_netrom.c:438
[<ffffffff83db6e3e>] __sock_create+0x1de/0x300 net/socket.c:1547
[<ffffffff83dba452>] sock_create net/socket.c:1598 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1635 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1620 [inline]
[<ffffffff83dba452>] __sys_socket+0xa2/0x190 net/socket.c:1663
[<ffffffff83dba55e>] __do_sys_socket net/socket.c:1676 [inline]
[<ffffffff83dba55e>] __se_sys_socket net/socket.c:1674 [inline]
[<ffffffff83dba55e>] __x64_sys_socket+0x1e/0x30 net/socket.c:1674
[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88811896cae0 (size 32):
comm "syz-executor.0", pid 5159, jiffies 4294942269 (age 19.240s)
hex dump (first 32 bytes):
a8 d1 a3 00 81 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81545ac4>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
[<ffffffff823168c2>] kmalloc include/linux/slab.h:559 [inline]
[<ffffffff823168c2>] kzalloc include/linux/slab.h:680 [inline]
[<ffffffff823168c2>] apparmor_sk_alloc_security+0x52/0xd0 security/apparmor/lsm.c:828
[<ffffffff822dbe95>] security_sk_alloc+0x35/0x70 security/security.c:4372
[<ffffffff83dbe7be>] sk_prot_alloc+0xfe/0x1b0 net/core/sock.c:2038
[<ffffffff83dc0f06>] sk_alloc+0x36/0x300 net/core/sock.c:2088
[<ffffffff843dea54>] nr_create+0x84/0x1c0 net/netrom/af_netrom.c:438
[<ffffffff83db6e3e>] __sock_create+0x1de/0x300 net/socket.c:1547
[<ffffffff83dba452>] sock_create net/socket.c:1598 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1635 [inline]
[<ffffffff83dba452>] __sys_socket_create net/socket.c:1620 [inline]
[<ffffffff83dba452>] __sys_socket+0xa2/0x190 net/socket.c:1663
[<ffffffff83dba55e>] __do_sys_socket net/socket.c:1676 [inline]
[<ffffffff83dba55e>] __se_sys_socket net/socket.c:1674 [inline]
[<ffffffff83dba55e>] __x64_sys_socket+0x1e/0x30 net/socket.c:1674
[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to change bug's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: fb054096aea0 Merge tag 'mm-hotfixes-stable-2023-06-12-12-2..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17042a9d280000
kernel config: https://syzkaller.appspot.com/x/.config?x=62c3855f0661c072

dashboard link: https://syzkaller.appspot.com/bug?extid=d327a1f3b12e1e206c16
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=166d8d2d280000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=102f213b280000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/193c8ae2af09/disk-fb054096.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eaa8cc7d62e7/vmlinux-fb054096.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4209ce6abb1d/bzImage-fb054096.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d327a1...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff8881160a5800 (size 2048):
comm "syz-executor386", pid 5102, jiffies 4294948540 (age 23.020s)

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
06 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............
backtrace:

[<ffffffff8154621a>] __do_kmalloc_node mm/slab_common.c:965 [inline]
[<ffffffff8154621a>] __kmalloc+0x4a/0x120 mm/slab_common.c:979
[<ffffffff83dbed6d>] kmalloc include/linux/slab.h:563 [inline]
[<ffffffff83dbed6d>] sk_prot_alloc+0xcd/0x1b0 net/core/sock.c:2035
[<ffffffff83dc14e6>] sk_alloc+0x36/0x300 net/core/sock.c:2088
[<ffffffff843df034>] nr_create+0x84/0x1c0 net/netrom/af_netrom.c:438
[<ffffffff83db741e>] __sock_create+0x1de/0x300 net/socket.c:1547
[<ffffffff83dbaa32>] sock_create net/socket.c:1598 [inline]
[<ffffffff83dbaa32>] __sys_socket_create net/socket.c:1635 [inline]
[<ffffffff83dbaa32>] __sys_socket_create net/socket.c:1620 [inline]
[<ffffffff83dbaa32>] __sys_socket+0xa2/0x190 net/socket.c:1663
[<ffffffff83dbab3e>] __do_sys_socket net/socket.c:1676 [inline]
[<ffffffff83dbab3e>] __se_sys_socket net/socket.c:1674 [inline]
[<ffffffff83dbab3e>] __x64_sys_socket+0x1e/0x30 net/socket.c:1674

[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
BUG: memory leak
unreferenced object 0xffff8881115ddde0 (size 32):
comm "syz-executor386", pid 5003, jiffies 4294947794 (age 35.370s)

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81545b34>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1057
[<ffffffff83de7abc>] kmalloc include/linux/slab.h:559 [inline]
[<ffffffff83de7abc>] kzalloc include/linux/slab.h:680 [inline]
[<ffffffff83de7abc>] net_alloc net/core/net_namespace.c:422 [inline]
[<ffffffff83de7abc>] copy_net_ns+0xdc/0x450 net/core/net_namespace.c:476
[<ffffffff812bf009>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<ffffffff812bf9bf>] unshare_nsproxy_namespaces+0x9f/0x120 kernel/nsproxy.c:228
[<ffffffff81279ae2>] ksys_unshare+0x302/0x600 kernel/fork.c:3441
[<ffffffff81279df6>] __do_sys_unshare kernel/fork.c:3512 [inline]
[<ffffffff81279df6>] __se_sys_unshare kernel/fork.c:3510 [inline]
[<ffffffff81279df6>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:3510

[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak

unreferenced object 0xffff888109e8a600 (size 512):
comm "syz-executor386", pid 5003, jiffies 4294947794 (age 35.370s)

hex dump (first 32 bytes):

00 98 e8 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 ea ff ff ff ff ff ff ff ................
backtrace:
[<ffffffff8154621a>] __do_kmalloc_node mm/slab_common.c:965 [inline]
[<ffffffff8154621a>] __kmalloc+0x4a/0x120 mm/slab_common.c:979
[<ffffffff8176619f>] kmalloc include/linux/slab.h:563 [inline]
[<ffffffff8176619f>] kzalloc include/linux/slab.h:680 [inline]
[<ffffffff8176619f>] __register_sysctl_table+0x7f/0xac0 fs/proc/proc_sysctl.c:1376
[<ffffffff83f75c50>] netfilter_log_sysctl_init net/netfilter/nf_log.c:490 [inline]
[<ffffffff83f75c50>] nf_log_net_init+0xc0/0x1e0 net/netfilter/nf_log.c:539
[<ffffffff83de6184>] ops_init+0x54/0x1d0 net/core/net_namespace.c:136
[<ffffffff83de64d2>] setup_net+0x1d2/0x3f0 net/core/net_namespace.c:339
[<ffffffff83de7bed>] copy_net_ns+0x20d/0x450 net/core/net_namespace.c:491
[<ffffffff812bf009>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<ffffffff812bf9bf>] unshare_nsproxy_namespaces+0x9f/0x120 kernel/nsproxy.c:228
[<ffffffff81279ae2>] ksys_unshare+0x302/0x600 kernel/fork.c:3441
[<ffffffff81279df6>] __do_sys_unshare kernel/fork.c:3512 [inline]
[<ffffffff81279df6>] __se_sys_unshare kernel/fork.c:3510 [inline]
[<ffffffff81279df6>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:3510

[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak

unreferenced object 0xffff88810e12b400 (size 256):
comm "syz-executor386", pid 5003, jiffies 4294947794 (age 35.370s)

hex dump (first 32 bytes):

78 b4 12 0e 81 88 ff ff 00 00 00 00 00 00 00 00 x...............
00 00 00 00 00 00 00 00 ea ff ff ff ff ff ff ff ................
backtrace:
[<ffffffff8154621a>] __do_kmalloc_node mm/slab_common.c:965 [inline]
[<ffffffff8154621a>] __kmalloc+0x4a/0x120 mm/slab_common.c:979
[<ffffffff81766883>] kmalloc include/linux/slab.h:563 [inline]
[<ffffffff81766883>] kzalloc include/linux/slab.h:680 [inline]
[<ffffffff81766883>] new_dir fs/proc/proc_sysctl.c:970 [inline]
[<ffffffff81766883>] get_subdir fs/proc/proc_sysctl.c:1014 [inline]
[<ffffffff81766883>] sysctl_mkdir_p fs/proc/proc_sysctl.c:1307 [inline]
[<ffffffff81766883>] __register_sysctl_table+0x763/0xac0 fs/proc/proc_sysctl.c:1392
[<ffffffff83f75c50>] netfilter_log_sysctl_init net/netfilter/nf_log.c:490 [inline]
[<ffffffff83f75c50>] nf_log_net_init+0xc0/0x1e0 net/netfilter/nf_log.c:539
[<ffffffff83de6184>] ops_init+0x54/0x1d0 net/core/net_namespace.c:136
[<ffffffff83de64d2>] setup_net+0x1d2/0x3f0 net/core/net_namespace.c:339
[<ffffffff83de7bed>] copy_net_ns+0x20d/0x450 net/core/net_namespace.c:491
[<ffffffff812bf009>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<ffffffff812bf9bf>] unshare_nsproxy_namespaces+0x9f/0x120 kernel/nsproxy.c:228
[<ffffffff81279ae2>] ksys_unshare+0x302/0x600 kernel/fork.c:3441
[<ffffffff81279df6>] __do_sys_unshare kernel/fork.c:3512 [inline]
[<ffffffff81279df6>] __se_sys_unshare kernel/fork.c:3510 [inline]
[<ffffffff81279df6>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:3510

[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak

unreferenced object 0xffff88810b613180 (size 192):
comm "syz-executor386", pid 5003, jiffies 4294947794 (age 35.370s)

hex dump (first 32 bytes):

00 1a 62 0a 81 88 ff ff 00 00 00 00 00 00 00 00 ..b.............
00 00 00 00 00 00 00 00 ea ff ff ff ff ff ff ff ................
backtrace:
[<ffffffff8154621a>] __do_kmalloc_node mm/slab_common.c:965 [inline]
[<ffffffff8154621a>] __kmalloc+0x4a/0x120 mm/slab_common.c:979
[<ffffffff8176619f>] kmalloc include/linux/slab.h:563 [inline]
[<ffffffff8176619f>] kzalloc include/linux/slab.h:680 [inline]
[<ffffffff8176619f>] __register_sysctl_table+0x7f/0xac0 fs/proc/proc_sysctl.c:1376
[<ffffffff83decbae>] sysctl_core_net_init+0x8e/0x130 net/core/sysctl_net_core.c:715
[<ffffffff83de6184>] ops_init+0x54/0x1d0 net/core/net_namespace.c:136
[<ffffffff83de64d2>] setup_net+0x1d2/0x3f0 net/core/net_namespace.c:339
[<ffffffff83de7bed>] copy_net_ns+0x20d/0x450 net/core/net_namespace.c:491
[<ffffffff812bf009>] create_new_namespaces+0x199/0x4f0 kernel/nsproxy.c:110
[<ffffffff812bf9bf>] unshare_nsproxy_namespaces+0x9f/0x120 kernel/nsproxy.c:228
[<ffffffff81279ae2>] ksys_unshare+0x302/0x600 kernel/fork.c:3441
[<ffffffff81279df6>] __do_sys_unshare kernel/fork.c:3512 [inline]
[<ffffffff81279df6>] __se_sys_unshare kernel/fork.c:3510 [inline]
[<ffffffff81279df6>] __x64_sys_unshare+0x16/0x20 kernel/fork.c:3510

[<ffffffff84a17749>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84a17749>] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd



---