memory leak in cfg80211_inform_single_bss_frame_data

Status: auto-obsoleted due to no activity on 2025/10/25 07:37
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+7a942657a255a9d9b18a@syzkaller.appspotmail.com
First crash: 1900d, last: 1125d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] memory leak in cfg80211_inform_single_bss_frame_data 4 (9) 2025/04/22 11:18
▶ ▼ Last patch testing requests (19)
Created Duration User Patch Repo Result
2025/10/25 07:19 17m retest repro upstream no crash log
2025/08/16 06:49 16m retest repro upstream report log
2025/06/06 05:51 54m retest repro upstream report log
2025/04/22 11:18 1h47m richard120310@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 2772d7df3c93 report log
2025/03/28 04:54 23m retest repro upstream report log
2025/01/17 02:55 15m retest repro upstream report log
2024/11/07 21:58 24m retest repro upstream report log
2024/08/29 21:40 16m retest repro upstream log
2024/06/20 19:47 17m retest repro upstream report log
2024/04/10 06:43 16m retest repro upstream report log
2024/01/14 08:31 18m retest repro upstream report log
2022/07/13 10:26 8m code@siddh.me upstream report log
2022/07/13 08:58 8m code@siddh.me upstream report log
2021/10/26 10:48 9m fmdefrancesco@gmail.com patch upstream report log
2021/06/24 06:57 13m phind.uet@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next.git master log
2021/06/23 15:52 14m phind.uet@gmail.com upstream log
2021/06/22 11:42 13m phind.uet@gmail.com upstream log
2021/06/21 12:59 15m phind.uet@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master error
2021/06/04 06:00 14m mudongliangabcd@gmail.com upstream log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810477b480 (size 96):
  comm "kworker/u4:0", pid 8, jiffies 4294962865 (age 11.010s)
  hex dump (first 32 bytes):
    f0 50 d7 27 da df 05 00 00 00 00 00 00 00 00 00  .P.'............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff8403ca16>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8403cf7b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff840de2f6>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff840ecab2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff840ecab2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff840ecab2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff840ef551>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff840ef551>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8126e14f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff8126ea79>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff812786f5>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

BUG: memory leak
unreferenced object 0xffff888105f50100 (size 96):
  comm "kworker/u4:0", pid 8, jiffies 4294962865 (age 11.010s)
  hex dump (first 32 bytes):
    00 51 d7 27 da df 05 00 00 00 00 00 00 00 00 00  .Q.'............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff8403ca16>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8403cf7b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff840de2f6>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff840ecab2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff840ecab2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff840ecab2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff840ef551>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff840ef551>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8126e14f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff8126ea79>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff812786f5>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

BUG: memory leak
unreferenced object 0xffff88810477b680 (size 96):
  comm "kworker/u4:3", pid 782, jiffies 4294962875 (age 10.910s)
  hex dump (first 32 bytes):
    03 e1 d8 27 da df 05 00 00 00 00 00 00 00 00 00  ...'............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff8403ca16>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8403cf7b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff840de2f6>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff840ecab2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff840ecab2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff840ecab2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff840ef551>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff840ef551>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8126e14f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff8126ea79>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff812786f5>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

BUG: memory leak
unreferenced object 0xffff88810477b600 (size 96):
  comm "kworker/u4:3", pid 782, jiffies 4294962875 (age 10.910s)
  hex dump (first 32 bytes):
    17 e1 d8 27 da df 05 00 00 00 00 00 00 00 00 00  ...'............
    00 00 00 00 00 00 00 00 28 00 00 00 01 00 06 10  ........(.......
  backtrace:
    [<ffffffff8403ca16>] cfg80211_inform_single_bss_frame_data+0x186/0x6a0 net/wireless/scan.c:2445
    [<ffffffff8403cf7b>] cfg80211_inform_bss_frame_data+0x4b/0x460 net/wireless/scan.c:2506
    [<ffffffff840de2f6>] ieee80211_bss_info_update+0x196/0x440 net/mac80211/scan.c:190
    [<ffffffff840ecab2>] ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
    [<ffffffff840ecab2>] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
    [<ffffffff840ecab2>] ieee80211_ibss_rx_queued_mgmt+0x7d2/0x11a0 net/mac80211/ibss.c:1639
    [<ffffffff840ef551>] ieee80211_iface_process_skb net/mac80211/iface.c:1527 [inline]
    [<ffffffff840ef551>] ieee80211_iface_work+0x601/0x780 net/mac80211/iface.c:1581
    [<ffffffff8126e14f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
    [<ffffffff8126ea79>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
    [<ffffffff812786f5>] kthread+0x125/0x160 kernel/kthread.c:376
    [<ffffffff8100222f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302

[

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/05/25 18:23 upstream fdaf9a5840ac 647c0e27 .config console log report syz C ci-upstream-gce-leak memory leak in cfg80211_inform_single_bss_frame_data
2021/10/25 22:32 upstream 87066fdd2e30 4f0000ee .config console log report syz C ci-upstream-gce-leak memory leak in cfg80211_inform_single_bss_frame_data
2023/03/19 14:02 upstream a3671bd86a97 7939252e .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in cfg80211_inform_single_bss_frame_data
2021/09/09 08:55 upstream 730bf31b8fc8 e2776ee4 .config console log report syz ci-upstream-gce-leak memory leak in cfg80211_inform_single_bss_frame_data
2021/05/30 18:36 upstream b90e90f40b4f 325a8dab .config console log report syz ci-upstream-gce-leak memory leak in cfg80211_inform_single_bss_frame_data
2023/07/15 06:12 upstream 2772d7df3c93 35d9ecc5 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in cfg80211_inform_single_bss_frame_data
* Struck through repros no longer work on HEAD.