memory leak in j1939_netdev_start (2)

Status: upstream: reported C repro on 2026/08/22 00:10
Subsystems: can
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+489e907b2a026a6f5fa0@syzkaller.appspotmail.com
First crash: 49d, last: 7d06h
▶ ▼ ✨ AI Patch Versions (2)
Version Stage Reported Report Link Job
1 upstream 2026/09/01 07:04 Discussion c118979e-3d39-430b-b07e-608d26aeaa70
1 moderation 2026/08/27 00:17 Discussion c118979e-3d39-430b-b07e-608d26aeaa70
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
c118979e patching ✅ memory leak in j1939_netdev_start (2) 2026/08/26 18:30 2026/08/26 22:35 2026/08/27 00:17 a2b77b9e
ea616980 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in j1939_netdev_start (2) 2026/08/17 23:28 2026/08/17 23:28 2026/08/18 00:09 1e72964b
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [can?] memory leak in j1939_netdev_start (2) 0 (5) 2026/10/02 08:45
[PATCH] can: j1939: fix memory leaks caused by pending address claim timer 1 (1) 2026/09/01 07:05
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in j1939_netdev_start can 3 syz, C 2 275d 1046d 0/29 auto-obsoleted due to no activity on 2026/04/14 08:53
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2026/10/02 08:44 24m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ce1e0223d8ad4211275c82a17ed6d43ab81e13d9 OK job log log
2026/09/20 10:43 0m retest repro upstream error job log
2026/09/20 10:43 1m retest repro upstream error job log
2026/08/27 17:02 5h07m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73e3f0710014fe6d4ed98cfc02292f6121db7558 OK job log log
2026/08/27 05:33 1h25m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73e3f0710014fe6d4ed98cfc02292f6121db7558 OK job log log
2026/08/24 14:19 19m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 0a0d1d55dad570724bf8c7ea83409639cfb4be9b OK job log log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff8881294c2000 (size 8192):
  comm "syz.0.17", pid 5974, jiffies 4294943627
  hex dump (first 32 bytes):
    00 0f 34 28 81 88 ff ff 00 0f 34 28 81 88 ff ff  ..4(......4(....
    00 00 00 00 00 00 00 00 00 80 d1 2c 81 88 ff ff  ...........,....
  backtrace (crc 949ec409):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888128340f00 (size 192):
  comm "syz.0.17", pid 5974, jiffies 4294943627
  hex dump (first 32 bytes):
    00 20 4c 29 81 88 ff ff 00 20 4c 29 81 88 ff ff  . L)..... L)....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc f9dd8fc5):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129d94000 (size 8192):
  comm "syz.0.24", pid 5976, jiffies 4294943629
  hex dump (first 32 bytes):
    00 5c 62 2c 81 88 ff ff 00 5c 62 2c 81 88 ff ff  .\b,.....\b,....
    00 00 00 00 00 00 00 00 00 80 d1 2c 81 88 ff ff  ...........,....
  backtrace (crc b239976f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812c625c00 (size 192):
  comm "syz.0.24", pid 5976, jiffies 4294943629
  hex dump (first 32 bytes):
    00 40 d9 29 81 88 ff ff 00 40 d9 29 81 88 ff ff  .@.).....@.)....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc d9f34805):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129d92000 (size 8192):
  comm "syz.2.19", pid 5977, jiffies 4294943630
  hex dump (first 32 bytes):
    80 aa 6a 29 81 88 ff ff 80 aa 6a 29 81 88 ff ff  ..j)......j)....
    00 00 00 00 00 00 00 00 00 80 d7 2c 81 88 ff ff  ...........,....
  backtrace (crc 1fcabdc1):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881296aaa80 (size 192):
  comm "syz.2.19", pid 5977, jiffies 4294943630
  hex dump (first 32 bytes):
    00 20 d9 29 81 88 ff ff 00 20 d9 29 81 88 ff ff  . .)..... .)....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc ad47c1c6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129d90000 (size 8192):
  comm "syz.0.25", pid 5978, jiffies 4294943631
  hex dump (first 32 bytes):
    80 57 62 2c 81 88 ff ff 80 57 62 2c 81 88 ff ff  .Wb,.....Wb,....
    00 00 00 00 00 00 00 00 00 80 d1 2c 81 88 ff ff  ...........,....
  backtrace (crc 96725ea4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x38f/0x420 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/29 08:26 upstream 72d3fcf802c4 7bf4ea23 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/09/28 04:15 upstream efb44d93a620 a3c7249d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/08/17 23:28 upstream 8d3ae59288f1 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/08/24 19:17 upstream 0a0d1d55dad5 23caa175 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
* Struck through repros no longer work on HEAD.