memory leak in can_rx_register

Status: auto-obsoleted due to no activity on 2026/06/17 12:49
Subsystems: can
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+24201717ed2da31b8fae@syzkaller.appspotmail.com
First crash: 180d, last: 180d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c438c1a7 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in can_rx_register 2026/05/17 05:39 2026/05/17 05:39 2026/05/17 06:19 de5aae85
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] can: isotp: hold a reference to the bound netdevice 1 (1) 2026/06/16 12:39
[syzbot] [can?] memory leak in can_rx_register 1 (2) 2026/06/03 12:48
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/06/03 09:16 29m edumazet@google.com patch upstream report log
2026/03/17 13:08 17m retest repro upstream no crash log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888127ebfb40 (size 80):
  comm "syz.5.22", pid 6143, jiffies 4294942019
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 10 8b fd 08 81 88 ff ff  ................
    02 00 00 00 ff 07 00 c0 00 00 00 00 00 00 00 00  ................
  backtrace (crc 976436cd):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_noprof+0x372/0x480 mm/slub.c:4851
    can_rx_register+0xbf/0x220 net/can/af_can.c:461
    isotp_bind+0x470/0x510 net/can/isotp.c:1345
    __sys_bind_socket net/socket.c:1874 [inline]
    __sys_bind_socket net/socket.c:1866 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1905
    __do_sys_bind net/socket.c:1910 [inline]
    __se_sys_bind net/socket.c:1908 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1908
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888127ebfaf0 (size 80):
  comm "syz.5.22", pid 6143, jiffies 4294942019
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 cb fd 08 81 88 ff ff  ................
    00 00 00 80 ff ff ff df 00 00 00 00 00 00 00 00  ................
  backtrace (crc 4af33172):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_noprof+0x372/0x480 mm/slub.c:4851
    can_rx_register+0xbf/0x220 net/can/af_can.c:461
    isotp_bind+0x29f/0x510 net/can/isotp.c:1352
    __sys_bind_socket net/socket.c:1874 [inline]
    __sys_bind_socket net/socket.c:1866 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1905
    __do_sys_bind net/socket.c:1910 [inline]
    __se_sys_bind net/socket.c:1908 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1908
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888127d994b0 (size 80):
  comm "syz.6.23", pid 6176, jiffies 4294942079
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 10 8b a8 13 81 88 ff ff  ................
    02 00 00 00 ff 07 00 c0 00 00 00 00 00 00 00 00  ................
  backtrace (crc 179b079f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_noprof+0x372/0x480 mm/slub.c:4851
    can_rx_register+0xbf/0x220 net/can/af_can.c:461
    isotp_bind+0x470/0x510 net/can/isotp.c:1345
    __sys_bind_socket net/socket.c:1874 [inline]
    __sys_bind_socket net/socket.c:1866 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1905
    __do_sys_bind net/socket.c:1910 [inline]
    __se_sys_bind net/socket.c:1908 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1908
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888127d99460 (size 80):
  comm "syz.6.23", pid 6176, jiffies 4294942079
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 cb a8 13 81 88 ff ff  ................
    00 00 00 80 ff ff ff df 00 00 00 00 00 00 00 00  ................
  backtrace (crc ca0c0020):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_noprof+0x372/0x480 mm/slub.c:4851
    can_rx_register+0xbf/0x220 net/can/af_can.c:461
    isotp_bind+0x29f/0x510 net/can/isotp.c:1352
    __sys_bind_socket net/socket.c:1874 [inline]
    __sys_bind_socket net/socket.c:1866 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1905
    __do_sys_bind net/socket.c:1910 [inline]
    __se_sys_bind net/socket.c:1908 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1908
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/03 12:55 upstream af4e9ef3d784 28b83e23 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in can_rx_register
* Struck through repros no longer work on HEAD.