memory leak in j1939_netdev_start (2)

Status: upstream: reported C repro on 2026/08/22 00:10
Subsystems: can
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+489e907b2a026a6f5fa0@syzkaller.appspotmail.com
First crash: 4d11h, last: 4d11h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
ea616980 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in j1939_netdev_start (2) 2026/08/17 23:28 2026/08/17 23:28 2026/08/18 00:09 1e72964b
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [can?] memory leak in j1939_netdev_start (2) 0 (1) 2026/08/22 00:10
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in j1939_netdev_start can 3 syz, C 2 230d 1001d 0/29 auto-obsoleted due to no activity on 2026/04/14 08:53

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812c9ca000 (size 8192):
  comm "syz.0.17", pid 6047, jiffies 4294942443
  hex dump (first 32 bytes):
    c0 36 87 2e 81 88 ff ff c0 36 87 2e 81 88 ff ff  .6.......6......
    00 00 00 00 00 00 00 00 00 80 77 2e 81 88 ff ff  ..........w.....
  backtrace (crc d013ab57):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812e8736c0 (size 192):
  comm "syz.0.17", pid 6047, jiffies 4294942443
  hex dump (first 32 bytes):
    00 a0 9c 2c 81 88 ff ff 00 a0 9c 2c 81 88 ff ff  ...,.......,....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc 2ba0e4b2):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812c9c8000 (size 8192):
  comm "syz.0.24", pid 6048, jiffies 4294942445
  hex dump (first 32 bytes):
    40 ab e4 12 81 88 ff ff 40 ab e4 12 81 88 ff ff  @.......@.......
    00 00 00 00 00 00 00 00 00 80 77 2e 81 88 ff ff  ..........w.....
  backtrace (crc da7feccc):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888112e4ab40 (size 192):
  comm "syz.0.24", pid 6048, jiffies 4294942445
  hex dump (first 32 bytes):
    00 80 9c 2c 81 88 ff ff 00 80 9c 2c 81 88 ff ff  ...,.......,....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc 73ecd91d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812c9d6000 (size 8192):
  comm "syz.0.25", pid 6050, jiffies 4294942445
  hex dump (first 32 bytes):
    80 3d 69 13 81 88 ff ff 80 3d 69 13 81 88 ff ff  .=i......=i.....
    00 00 00 00 00 00 00 00 00 80 77 2e 81 88 ff ff  ..........w.....
  backtrace (crc cb2b95df):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888113693d80 (size 192):
  comm "syz.0.25", pid 6050, jiffies 4294942445
  hex dump (first 32 bytes):
    00 60 9d 2c 81 88 ff ff 00 60 9d 2c 81 88 ff ff  .`.,.....`.,....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc 35e45c5a):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812c9d4000 (size 8192):
  comm "syz.0.26", pid 6051, jiffies 4294942446
  hex dump (first 32 bytes):
    c0 e3 ed 12 81 88 ff ff c0 e3 ed 12 81 88 ff ff  ................
    00 00 00 00 00 00 00 00 00 80 77 2e 81 88 ff ff  ..........w.....
  backtrace (crc eb403d26):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1920 [inline]
    __sys_bind_socket net/socket.c:1912 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1951
    __do_sys_bind net/socket.c:1956 [inline]
    __se_sys_bind net/socket.c:1954 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1954
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/17 23:28 upstream 8d3ae59288f1 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
* Struck through repros no longer work on HEAD.