memory leak in dvb_register_frontend

Status: upstream: reported syz repro on 2026/08/24 03:35
Subsystems: media
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+32f018fd65e799f79ae0@syzkaller.appspotmail.com
Fix commit: media: vidtv: fix frontend reference leak on unbind
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 52d, last: 21d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
3d6d3b0f assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in dvb_register_frontend 2026/08/20 03:23 2026/08/20 03:23 2026/08/20 03:58 1e72964b
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] media: vidtv: fix frontend reference leak on unbind 1 (1) 2026/08/24 13:51
[syzbot] [media?] memory leak in dvb_register_frontend 0 (2) 2026/08/24 06:59
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2026/09/20 04:31 29m retest repro upstream report job log log
2026/09/20 04:31 25m retest repro upstream report job log log
2026/09/20 04:31 26m retest repro upstream report job log log
2026/09/20 04:31 1h36m retest repro upstream report job log log
2026/09/20 04:31 28m retest repro upstream report job log log
2026/08/24 06:59 59m piyushpatle228@gmail.com patch upstream OK job log log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888104d8ec00 (size 1024):
  comm "swapper/0", pid 1, jiffies 4294937925
  hex dump (first 32 bytes):
    00 cf b9 05 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 284558ee):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4599 [inline]
    slab_alloc_node mm/slub.c:4919 [inline]
    __kmalloc_cache_noprof+0x359/0x440 mm/slub.c:5480
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dvb_register_frontend+0xad/0x2b0 drivers/media/dvb-core/dvb_frontend.c:3047
    vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline]
    vidtv_bridge_probe+0x1f6/0x420 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510
    platform_probe+0x86/0xf0 drivers/base/platform.c:1507
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602
    do_one_initcall+0x74/0x430 init/main.c:1353
    do_initcall_level init/main.c:1415 [inline]
    do_initcalls init/main.c:1431 [inline]
    do_basic_setup init/main.c:1451 [inline]
    kernel_init_freeable+0x2a9/0x340 init/main.c:1666
    kernel_init+0x20/0x1d0 init/main.c:1556
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158

BUG: memory leak
unreferenced object 0xffff888105b9cf00 (size 192):
  comm "swapper/0", pid 1, jiffies 4294937926
  hex dump (first 32 bytes):
    00 01 00 00 00 00 ad de 22 01 00 00 00 00 ad de  ........".......
    01 00 00 00 00 00 00 00 00 3a 95 03 81 88 ff ff  .........:......
  backtrace (crc 9bd60cfd):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4599 [inline]
    slab_alloc_node mm/slub.c:4919 [inline]
    __kmalloc_cache_noprof+0x359/0x440 mm/slub.c:5480
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dvb_register_device+0x117/0xac0 drivers/media/dvb-core/dvbdev.c:472
    dvb_register_frontend+0x1d0/0x2b0 drivers/media/dvb-core/dvb_frontend.c:3074
    vidtv_bridge_dvb_init drivers/media/test-drivers/vidtv/vidtv_bridge.c:438 [inline]
    vidtv_bridge_probe+0x1f6/0x420 drivers/media/test-drivers/vidtv/vidtv_bridge.c:510
    platform_probe+0x86/0xf0 drivers/base/platform.c:1507
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    vidtv_bridge_init+0x52/0x80 drivers/media/test-drivers/vidtv/vidtv_bridge.c:602
    do_one_initcall+0x74/0x430 init/main.c:1353
    do_initcall_level init/main.c:1415 [inline]
    do_initcalls init/main.c:1431 [inline]
    do_basic_setup init/main.c:1451 [inline]
    kernel_init_freeable+0x2a9/0x340 init/main.c:1666
    kernel_init+0x20/0x1d0 init/main.c:1556

connection error: failed to recv *flatrpc.ExecutorMessageRawT: read tcp 127.0.0.1:35893->127.0.0.1:38908: read: connection reset by peer

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/22 15:18 upstream 26260251022f 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in dvb_register_frontend
2026/08/22 02:47 upstream 818bebeb63dd 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in dvb_register_frontend
2026/08/22 02:15 upstream 818bebeb63dd 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in dvb_register_frontend
2026/08/22 01:40 upstream 818bebeb63dd 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in dvb_register_frontend
2026/08/20 03:23 upstream 98f21c54f995 1e72964b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in dvb_register_frontend
* Struck through repros no longer work on HEAD.