Syzkaller hit 'memory leak in attach_auth_trunc' bug.

2026/05/06 04:31:30 executed programs: 2
BUG: memory leak
unreferenced object 0xffff888108da9800 (size 96):
  comm "syz.1.17", pid 925, jiffies 4294792845
  hex dump (first 32 bytes):
    63 6d 61 63 28 61 65 73 29 00 00 00 00 00 00 00  cmac(aes).......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 32e34902):
    create_object mm/kmemleak.c:794 [inline]
    kmemleak_alloc+0x39/0x70 mm/kmemleak.c:1098
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    __do_kmalloc_node mm/slub.c:5649 [inline]
    __kmalloc_node_track_caller_noprof+0x5c9/0xd90 mm/slub.c:5759
    kmemdup_noprof+0x3b/0xd0 mm/util.c:138
    kmemdup_noprof include/linux/fortify-string.h:765 [inline]
    attach_auth_trunc+0x190/0x510 net/xfrm/xfrm_user.c:683
    xfrm_state_construct net/xfrm/xfrm_user.c:916 [inline]
    xfrm_add_sa+0xb2e/0x2760 net/xfrm/xfrm_user.c:1022
    xfrm_user_rcv_msg+0x46d/0xe30 net/xfrm/xfrm_user.c:3507
    netlink_rcv_skb+0x17f/0x510 net/netlink/af_netlink.c:2552
    xfrm_netlink_rcv+0x8c/0xc0 net/xfrm/xfrm_user.c:3529
    netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
    netlink_unicast+0x776/0xcb0 net/netlink/af_netlink.c:1346
    netlink_sendmsg+0xacf/0x1140 net/netlink/af_netlink.c:1896
    sock_sendmsg_nosec+0x1fe/0x250 net/socket.c:727
    __sock_sendmsg+0x89/0xb0 net/socket.c:742
    ____sys_sendmsg+0x6fd/0x9e0 net/socket.c:2630
    ___sys_sendmsg+0x140/0x200 net/socket.c:2684
    __sys_sendmsg+0x180/0x2c0 net/socket.c:2716
    __do_sys_sendmsg net/socket.c:2721 [inline]
    __se_sys_sendmsg net/socket.c:2719 [inline]
    __x64_sys_sendmsg+0x7f/0xc0 net/socket.c:2719

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


Syzkaller reproducer:
# {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:true NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}
sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0)
socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$netlink(0xffffffffffffffff, 0x0, 0x17dfbee45c65ac92)
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000840)=@updsa={0x184, 0x1a, 0x1, 0x70bd27, 0x25dfdbfe, {{@in=@loopback, @in=@dev={0xac, 0x14, 0x14, 0x3f}, 0xce1e, 0xffff, 0x4e20, 0x2, 0xa, 0x60, 0x80, 0x21}, {@in=@multicast1, 0x4d6, 0x32}, @in6=@empty, {0x8000, 0x6, 0x9, 0x2, 0x80005, 0xa3a7, 0xa}, {0x5, 0x3, 0x2, 0x7}, {0x1, 0x0, 0x10000}, 0x70bd2c, 0x0, 0xa, 0x1, 0x0, 0x21}, [@algo_auth={0x48, 0x1, {{'cmac(aes)\x00'}}}, @algo_auth_trunc={0x4c, 0x14, {{'cmac(aes)\x00'}, 0x0, 0x60}}]}, 0x184}, 0x1, 0x0, 0x0, 0x40400c5}, 0x88d0)


C reproducer:
// autogenerated by syzkaller (https://github.com/google/syzkaller)

#define _GNU_SOURCE 

#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>

static void sleep_ms(uint64_t ms)
{
	usleep(ms * 1000);
}

static uint64_t current_time_ms(void)
{
	struct timespec ts;
	if (clock_gettime(CLOCK_MONOTONIC, &ts))
	exit(1);
	return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}

static bool write_file(const char* file, const char* what, ...)
{
	char buf[1024];
	va_list args;
	va_start(args, what);
	vsnprintf(buf, sizeof(buf), what, args);
	va_end(args);
	buf[sizeof(buf) - 1] = 0;
	int len = strlen(buf);
	int fd = open(file, O_WRONLY | O_CLOEXEC);
	if (fd == -1)
		return false;
	if (write(fd, buf, len) != len) {
		int err = errno;
		close(fd);
		errno = err;
		return false;
	}
	close(fd);
	return true;
}

static void kill_and_wait(int pid, int* status)
{
	kill(-pid, SIGKILL);
	kill(pid, SIGKILL);
	for (int i = 0; i < 100; i++) {
		if (waitpid(-1, status, WNOHANG | __WALL) == pid)
			return;
		usleep(1000);
	}
	DIR* dir = opendir("/sys/fs/fuse/connections");
	if (dir) {
		for (;;) {
			struct dirent* ent = readdir(dir);
			if (!ent)
				break;
			if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
				continue;
			char abort[300];
			snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort", ent->d_name);
			int fd = open(abort, O_WRONLY);
			if (fd == -1) {
				continue;
			}
			if (write(fd, abort, 1) < 0) {
			}
			close(fd);
		}
		closedir(dir);
	} else {
	}
	while (waitpid(-1, status, __WALL) != pid) {
	}
}

static void setup_test()
{
	prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
	setpgrp();
	write_file("/proc/self/oom_score_adj", "1000");
}

#define KMEMLEAK_FILE "/sys/kernel/debug/kmemleak"

static const char* setup_leak()
{
	if (!write_file(KMEMLEAK_FILE, "scan=off")) {
		if (errno == EBUSY)
			return "KMEMLEAK disabled: increase CONFIG_DEBUG_KMEMLEAK_EARLY_LOG_SIZE"
			       " or unset CONFIG_DEBUG_KMEMLEAK_DEFAULT_OFF";
		return "failed to write(kmemleak, \"scan=off\")";
	}
	if (!write_file(KMEMLEAK_FILE, "scan"))
		return "failed to write(kmemleak, \"scan\")";
	sleep(5);
	if (!write_file(KMEMLEAK_FILE, "scan"))
		return "failed to write(kmemleak, \"scan\")";
	if (!write_file(KMEMLEAK_FILE, "clear"))
		return "failed to write(kmemleak, \"clear\")";
	return NULL;
}

static void check_leaks(void)
{
	int fd = open(KMEMLEAK_FILE, O_RDWR);
	if (fd == -1)
	exit(1);
	uint64_t start = current_time_ms();
	if (write(fd, "scan", 4) != 4)
	exit(1);
	sleep(1);
	while (current_time_ms() - start < 4 * 1000)
		sleep(1);
	if (write(fd, "scan", 4) != 4)
	exit(1);
	static char buf[128 << 10];
	ssize_t n = read(fd, buf, sizeof(buf) - 1);
	if (n < 0)
	exit(1);
	int nleaks = 0;
	if (n != 0) {
		sleep(1);
		if (write(fd, "scan", 4) != 4)
	exit(1);
		if (lseek(fd, 0, SEEK_SET) < 0)
	exit(1);
		n = read(fd, buf, sizeof(buf) - 1);
		if (n < 0)
	exit(1);
		buf[n] = 0;
		char* pos = buf;
		char* end = buf + n;
		while (pos < end) {
			char* next = strstr(pos + 1, "unreferenced object");
			if (!next)
				next = end;
			char prev = *next;
			*next = 0;
			fprintf(stderr, "BUG: memory leak\n%s\n", pos);
			*next = prev;
			pos = next;
			nleaks++;
		}
	}
	if (write(fd, "clear", 5) != 5)
	exit(1);
	close(fd);
	if (nleaks)
		exit(1);
}

static void execute_one(void);

#define WAIT_FLAGS __WALL

static void loop(void)
{
	int iter = 0;
	for (;; iter++) {
		int pid = fork();
		if (pid < 0)
	exit(1);
		if (pid == 0) {
			setup_test();
			execute_one();
			exit(0);
		}
		int status = 0;
		uint64_t start = current_time_ms();
		for (;;) {
			sleep_ms(10);
			if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
				break;
			if (current_time_ms() - start < 5000)
				continue;
			kill_and_wait(pid, &status);
			break;
		}
		check_leaks();
	}
}

uint64_t r[1] = {0xffffffffffffffff};

void execute_one(void)
{
		intptr_t res = 0;
	if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {}
//  sendmsg$nl_xfrm arguments: [
//    fd: sock_nl_xfrm (resource)
//    msg: nil
//    f: send_flags = 0x0 (8 bytes)
//  ]
	syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0ul, /*f=*/0ul);
//  socket$nl_xfrm arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: const = 0x6 (4 bytes)
//  ]
//  returns sock_nl_xfrm
	syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
//  sendmsg$netlink arguments: [
//    fd: sock_netlink (resource)
//    msg: nil
//    f: send_flags = 0x17dfbee45c65ac92 (8 bytes)
//  ]
	syscall(__NR_sendmsg, /*fd=*/(intptr_t)-1, /*msg=*/0ul, /*f=MSG_ZEROCOPY|MSG_BATCH|MSG_PROBE|MSG_MORE|MSG_EOR|MSG_CONFIRM|0x17dfbee458612402*/0x17dfbee45c65ac92ul);
//  socket$nl_xfrm arguments: [
//    domain: const = 0x10 (8 bytes)
//    type: const = 0x3 (8 bytes)
//    proto: const = 0x6 (4 bytes)
//  ]
//  returns sock_nl_xfrm
	res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/6);
	if (res != -1)
		r[0] = res;
//  sendmsg$nl_xfrm arguments: [
//    fd: sock_nl_xfrm (resource)
//    msg: ptr[in, msghdr_netlink[netlink_msg_xfrm]] {
//      msghdr_netlink[netlink_msg_xfrm] {
//        addr: nil
//        addrlen: len = 0x0 (4 bytes)
//        pad = 0x0 (4 bytes)
//        vec: ptr[in, iovec[in, netlink_msg_xfrm]] {
//          iovec[in, netlink_msg_xfrm] {
//            addr: ptr[in, netlink_msg_xfrm] {
//              union netlink_msg_xfrm {
//                updsa: netlink_msg_t[const[XFRM_MSG_UPDSA, int16], xfrm_usersa_info, xfrma_policy] {
//                  len: len = 0x184 (4 bytes)
//                  type: const = 0x1a (2 bytes)
//                  flags: netlink_msg_flags = 0x1 (2 bytes)
//                  seq: int32 = 0x70bd27 (4 bytes)
//                  pid: int32 = 0x25dfdbfe (4 bytes)
//                  payload: xfrm_usersa_info {
//                    sel: xfrm_selector {
//                      daddr: union xfrm_address_t {
//                        in: union ipv4_addr {
//                          loopback: const = 0x7f000001 (4 bytes)
//                        }
//                      }
//                      saddr: union xfrm_address_t {
//                        in: union ipv4_addr {
//                          dev: ipv4_addr_t[netdev_addr_id] {
//                            a0: const = 0xac (1 bytes)
//                            a1: const = 0x14 (1 bytes)
//                            a2: const = 0x14 (1 bytes)
//                            a3: int8 = 0x3f (1 bytes)
//                          }
//                        }
//                      }
//                      dport: int16be = 0xce1e (2 bytes)
//                      dport_mask: int16be = 0xffff (2 bytes)
//                      sport: int16be = 0x4e20 (2 bytes)
//                      sport_mask: int16be = 0x2 (2 bytes)
//                      family: xfrm_family = 0xa (2 bytes)
//                      prefixlen_d: xfrm_prefixlens = 0x60 (1 bytes)
//                      prefixlen_s: xfrm_prefixlens = 0x80 (1 bytes)
//                      proto: ipv6_types = 0x21 (1 bytes)
//                      pad = 0x0 (3 bytes)
//                      ifindex: ifindex (resource)
//                      user: uid (resource)
//                    }
//                    id: xfrm_id {
//                      daddr: union xfrm_address_t {
//                        in: union ipv4_addr {
//                          multicast1: const = 0xe0000001 (4 bytes)
//                        }
//                      }
//                      spi: int32be = 0x4d6 (4 bytes)
//                      proto: xfrm_proto = 0x32 (1 bytes)
//                      pad = 0x0 (3 bytes)
//                    }
//                    saddr: union xfrm_address_t {
//                      in6: union ipv6_addr {
//                        empty: ipv6_addr_empty {
//                          a0: buffer: {00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x10)
//                        }
//                      }
//                    }
//                    lft: xfrm_lifetime_cfg {
//                      soft_byte_limit: int64 = 0x8000 (8 bytes)
//                      hard_byte_limit: int64 = 0x6 (8 bytes)
//                      soft_packet_limit: int64 = 0x9 (8 bytes)
//                      hard_packet_limit: int64 = 0x2 (8 bytes)
//                      soft_add_expires_seconds: int64 = 0x80005 (8 bytes)
//                      hard_add_expires_seconds: int64 = 0xa3a7 (8 bytes)
//                      soft_use_expires_seconds: int64 = 0xa (8 bytes)
//                      hard_use_expires_seconds: int64 = 0x0 (8 bytes)
//                    }
//                    curlft: xfrm_lifetime_cur {
//                      bytes: int64 = 0x5 (8 bytes)
//                      packets: int64 = 0x3 (8 bytes)
//                      add_time: int64 = 0x2 (8 bytes)
//                      use_time: int64 = 0x7 (8 bytes)
//                    }
//                    stats: xfrm_stats {
//                      replay_window: int32 = 0x1 (4 bytes)
//                      replay: int32 = 0x0 (4 bytes)
//                      integrity_failed: int32 = 0x10000 (4 bytes)
//                    }
//                    seq: int32 = 0x70bd2c (4 bytes)
//                    reqid: int32 = 0x0 (4 bytes)
//                    family: xfrm_family = 0xa (2 bytes)
//                    mode: xfrm_mode = 0x1 (1 bytes)
//                    replay_window: int8 = 0x0 (1 bytes)
//                    flags: xfrm_state = 0x21 (1 bytes)
//                    pad = 0x0 (7 bytes)
//                  }
//                  attrs: array[xfrma_policy] {
//                    union xfrma_policy {
//                      algo_auth: nlattr_t[const[XFRMA_ALG_AUTH, int16], xfrm_algo_hash] {
//                        nla_len: offsetof = 0x48 (2 bytes)
//                        nla_type: const = 0x1 (2 bytes)
//                        payload: xfrm_algo_hash {
//                          alg_name: alg_hash_name {
//                            name: buffer: {63 6d 61 63 28 61 65 73 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x40)
//                          }
//                          alg_key_len: bitsize = 0x0 (4 bytes)
//                          alg_key: buffer: {} (length 0x0)
//                        }
//                        size: buffer: {} (length 0x0)
//                      }
//                    }
//                    union xfrma_policy {
//                      algo_auth_trunc: nlattr_t[const[XFRMA_ALG_AUTH_TRUNC, int16], xfrm_algo_auth] {
//                        nla_len: offsetof = 0x4c (2 bytes)
//                        nla_type: const = 0x14 (2 bytes)
//                        payload: xfrm_algo_auth {
//                          alg_name: alg_hash_name {
//                            name: buffer: {63 6d 61 63 28 61 65 73 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00} (length 0x40)
//                          }
//                          alg_key_len: bitsize = 0x0 (4 bytes)
//                          alg_icv_len: xfrm_algo_truncbits = 0x60 (4 bytes)
//                          alg_key: buffer: {} (length 0x0)
//                        }
//                        size: buffer: {} (length 0x0)
//                      }
//                    }
//                  }
//                }
//              }
//            }
//            len: len = 0x184 (8 bytes)
//          }
//        }
//        vlen: const = 0x1 (8 bytes)
//        ctrl: const = 0x0 (8 bytes)
//        ctrllen: const = 0x0 (8 bytes)
//        f: send_flags = 0x40400c5 (4 bytes)
//        pad = 0x0 (4 bytes)
//      }
//    }
//    f: send_flags = 0x88d0 (8 bytes)
//  ]
*(uint64_t*)0x200000000000 = 0;
*(uint32_t*)0x200000000008 = 0;
*(uint64_t*)0x200000000010 = 0x200000000800;
*(uint64_t*)0x200000000800 = 0x200000000840;
*(uint32_t*)0x200000000840 = 0x184;
*(uint16_t*)0x200000000844 = 0x1a;
*(uint16_t*)0x200000000846 = 1;
*(uint32_t*)0x200000000848 = 0x70bd27;
*(uint32_t*)0x20000000084c = 0x25dfdbfe;
*(uint32_t*)0x200000000850 = htobe32(0x7f000001);
*(uint8_t*)0x200000000860 = 0xac;
*(uint8_t*)0x200000000861 = 0x14;
*(uint8_t*)0x200000000862 = 0x14;
*(uint8_t*)0x200000000863 = 0x3f;
*(uint16_t*)0x200000000870 = htobe16(0xce1e);
*(uint16_t*)0x200000000872 = htobe16(-1);
*(uint16_t*)0x200000000874 = htobe16(0x4e20);
*(uint16_t*)0x200000000876 = htobe16(2);
*(uint16_t*)0x200000000878 = 0xa;
*(uint8_t*)0x20000000087a = 0x60;
*(uint8_t*)0x20000000087b = 0x80;
*(uint8_t*)0x20000000087c = 0x21;
*(uint32_t*)0x200000000880 = 0;
*(uint32_t*)0x200000000884 = 0;
*(uint32_t*)0x200000000888 = htobe32(0xe0000001);
*(uint32_t*)0x200000000898 = htobe32(0x4d6);
*(uint8_t*)0x20000000089c = 0x32;
memset((void*)0x2000000008a0, 0, 16);
*(uint64_t*)0x2000000008b0 = 0x8000;
*(uint64_t*)0x2000000008b8 = 6;
*(uint64_t*)0x2000000008c0 = 9;
*(uint64_t*)0x2000000008c8 = 2;
*(uint64_t*)0x2000000008d0 = 0x80005;
*(uint64_t*)0x2000000008d8 = 0xa3a7;
*(uint64_t*)0x2000000008e0 = 0xa;
*(uint64_t*)0x2000000008e8 = 0;
*(uint64_t*)0x2000000008f0 = 5;
*(uint64_t*)0x2000000008f8 = 3;
*(uint64_t*)0x200000000900 = 2;
*(uint64_t*)0x200000000908 = 7;
*(uint32_t*)0x200000000910 = 1;
*(uint32_t*)0x200000000914 = 0;
*(uint32_t*)0x200000000918 = 0x10000;
*(uint32_t*)0x20000000091c = 0x70bd2c;
*(uint32_t*)0x200000000920 = 0;
*(uint16_t*)0x200000000924 = 0xa;
*(uint8_t*)0x200000000926 = 1;
*(uint8_t*)0x200000000927 = 0;
*(uint8_t*)0x200000000928 = 0x21;
*(uint16_t*)0x200000000930 = 0x48;
*(uint16_t*)0x200000000932 = 1;
memcpy((void*)0x200000000934, "cmac(aes)\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 64);
*(uint32_t*)0x200000000974 = 0;
*(uint16_t*)0x200000000978 = 0x4c;
*(uint16_t*)0x20000000097a = 0x14;
memcpy((void*)0x20000000097c, "cmac(aes)\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000", 64);
*(uint32_t*)0x2000000009bc = 0;
*(uint32_t*)0x2000000009c0 = 0x60;
*(uint64_t*)0x200000000808 = 0x184;
*(uint64_t*)0x200000000018 = 1;
*(uint64_t*)0x200000000020 = 0;
*(uint64_t*)0x200000000028 = 0;
*(uint32_t*)0x200000000030 = 0x40400c5;
	syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x200000000000ul, /*f=MSG_PROBE|MSG_MORE|MSG_EOR|MSG_DONTWAIT|MSG_CONFIRM*/0x88d0ul);

}
int main(void)
{
		syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000ul, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul);
	const char* reason;
	(void)reason;
	if ((reason = setup_leak()))
		printf("the reproducer may not work as expected: leak checking setup failed: %s\n", reason);
			loop();
	return 0;
}