Hello,

syzbot found the following issue on:

HEAD commit: a5e505a99ca7 Merge tag 'platform-drivers-x86-v6.5-5' of gi.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=15eea3e3a80000 kernel config: https://syzkaller.appspot.com/x/.config?x=f3c65e06397a9d58 dashboard link: https://syzkaller.appspot.com/bug?extid=92f9b5fba2df252a3569 compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13597f90680000

Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/c534ce48946f/disk-a5e505a9.raw.... vmlinux: https://storage.googleapis.com/syzbot-assets/724bbdaa3992/vmlinux-a5e505a9.x... kernel image: https://storage.googleapis.com/syzbot-assets/47fba0663891/bzImage-a5e505a9.x...

IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+92f9b5fba2df252a3569@syzkaller.appspotmail.com

2023/08/24 02:03:48 executed programs: 322 2023/08/24 02:03:54 executed programs: 337 BUG: memory leak unreferenced object 0xffff888120ea2600 (size 240): comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s) hex dump (first 32 bytes): 00 22 e3 20 81 88 ff ff 00 00 00 00 00 00 00 00 .". ............ 00 80 ed 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860 [<ffffffff8499f31f>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:387 [inline] [<ffffffff8499f31f>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8499f31f>] batadv_iv_send_outstanding_bat_ogm_packet+0x2ef/0x370 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600 [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751 [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389 [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145 [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

BUG: memory leak unreferenced object 0xffff888120f36c00 (size 1024): comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff81554a79>] __do_kmalloc_node mm/slab_common.c:984 [inline] [<ffffffff81554a79>] __kmalloc_node_track_caller+0x49/0x140 mm/slab_common.c:1005 [<ffffffff83e54735>] kmalloc_reserve+0x95/0x180 net/core/skbuff.c:575 [<ffffffff83e5c6c8>] pskb_expand_head+0xd8/0x5f0 net/core/skbuff.c:2042 [<ffffffff849ccbef>] __skb_cow include/linux/skbuff.h:3571 [inline] [<ffffffff849ccbef>] skb_cow_head include/linux/skbuff.h:3605 [inline] [<ffffffff849ccbef>] batadv_skb_head_push+0x8f/0x110 net/batman-adv/soft-interface.c:72 [<ffffffff849ca643>] batadv_send_skb_packet+0x83/0x1c0 net/batman-adv/send.c:86 [<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] [<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600 [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751 [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389 [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145 [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

BUG: memory leak unreferenced object 0xffff888120ea2000 (size 240): comm "kworker/u4:5", pid 5210, jiffies 4295058872 (age 8.300s) hex dump (first 32 bytes): 00 28 ea 20 81 88 ff ff 00 00 00 00 00 00 00 00 .(. ............ 00 80 ec 1c 81 88 ff ff 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83e5e05a>] skb_clone+0xaa/0x190 net/core/skbuff.c:1860 [<ffffffff83f88552>] netem_enqueue+0xc62/0x1430 net/sched/sch_netem.c:479 [<ffffffff83e80975>] dev_qdisc_enqueue+0x25/0xf0 net/core/dev.c:3732 [<ffffffff83e8b217>] __dev_xmit_skb net/core/dev.c:3821 [inline] [<ffffffff83e8b217>] __dev_queue_xmit+0xdc7/0x17d0 net/core/dev.c:4169 [<ffffffff849ca710>] dev_queue_xmit include/linux/netdevice.h:3088 [inline] [<ffffffff849ca710>] batadv_send_skb_packet+0x150/0x1c0 net/batman-adv/send.c:108 [<ffffffff8499f35a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:392 [inline] [<ffffffff8499f35a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:420 [inline] [<ffffffff8499f35a>] batadv_iv_send_outstanding_bat_ogm_packet+0x32a/0x370 net/batman-adv/bat_iv_ogm.c:1700 [<ffffffff812b8d31>] process_one_work+0x2f1/0x640 kernel/workqueue.c:2600 [<ffffffff812b966c>] worker_thread+0x5c/0x5c0 kernel/workqueue.c:2751 [<ffffffff812c313b>] kthread+0x12b/0x170 kernel/kthread.c:389 [<ffffffff81140a5c>] ret_from_fork+0x2c/0x40 arch/x86/kernel/process.c:145 [<ffffffff81002be1>] ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

--- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the bug is already fixed, let syzbot know by replying with: #syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite bug's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard)

If the bug is a duplicate of another bug, reply with: #syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with: #syz undup