memory leak in napi_skb_cache

memory leak in napi_skb_cache_get (2)

Status: upstream: reported C repro on 2026/01/15 20:48
Subsystems: net virt
[Documentation on labels]
Reported-by: syzbot+7ff4013eabad1407b70a@syzkaller.appspotmail.com
Fix commit: 21e4271e6509 Bluetooth: purge error queues in socket destructors
Patched on: [ci-upstream-bpf-next-kasan-gce ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce ci2-upstream-usb]
First crash: 51d, last: 51d

▶ ▼ Discussions (4)

Title	Replies (including bot)	Last reply
[PATCH] Bluetooth: purge error queues in socket destructors	2 (2)	2026/02/11 19:40
On managing socket's error queue	1 (1)	2026/01/20 16:25
[syzbot] Monthly virt report (Jan 2026)	0 (1)	2026/01/20 08:45
[syzbot] [net?] [virt?] memory leak in napi_skb_cache_get (2)	0 (3)	2026/01/19 10:42

▶ ▼ Similar bugs (1)

Kernel	Title	Rank 🛈	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	memory leak in napi_skb_cache_get virt net	3	C			109	1211d	1189d	0/29	auto-obsoleted due to no activity on 2023/11/14 13:11

▶ ▼ Last patch testing requests (3)


Created	Duration	User	Patch	Repo	Result
2026/01/27 07:53	39m	retest repro		upstream	report log
2026/01/19 10:42	21m	dmantipov@yandex.ru	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7	OK log
2026/01/16 13:03	20m	dmantipov@yandex.ru	patch	https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 983d014aafb14ee5e4915465bf8948e8f3a723b5	error

Sample crash report:

BUG: memory leak
unreferenced object 0xffff88810a03e300 (size 240):
  comm "softirq", pid 0, jiffies 4294943617
  hex dump (first 32 bytes):
    90 dc d8 12 81 88 ff ff 90 dc d8 12 81 88 ff ff  ................
    00 00 00 00 00 00 00 00 00 dc d8 12 81 88 ff ff  ................
  backtrace (crc 2f85baf):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    kmem_cache_alloc_bulk_noprof+0x22d/0x3e0 mm/slub.c:7521
    napi_skb_cache_get+0xa9/0xd0 net/core/skbuff.c:291
    __alloc_skb+0x214/0x2b0 net/core/skbuff.c:668
    napi_alloc_skb+0x118/0x180 net/core/skbuff.c:832
    page_to_skb+0xee/0x5e0 drivers/net/virtio_net.c:904
    receive_mergeable drivers/net/virtio_net.c:2514 [inline]
    receive_buf+0x49f/0x2670 drivers/net/virtio_net.c:2660
    virtnet_receive_packets drivers/net/virtio_net.c:3023 [inline]
    virtnet_receive drivers/net/virtio_net.c:3047 [inline]
    virtnet_poll+0x7d6/0x16e0 drivers/net/virtio_net.c:3136
    __napi_poll+0x44/0x3a0 net/core/dev.c:7668
    napi_poll net/core/dev.c:7731 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7883
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
    common_interrupt+0x87/0xa0 arch/x86/kernel/irq.c:319
    asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688

BUG: memory leak
unreferenced object 0xffff88810adf5e40 (size 704):
  comm "kworker/u9:0", pid 51, jiffies 4294943617
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc f18cfd82):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    __skb_tstamp_tx+0x162/0x4c0 net/core/skbuff.c:5677
    hci_conn_tx_queue+0x11c/0x1d0 net/bluetooth/hci_conn.c:3049
    hci_send_conn_frame net/bluetooth/hci_core.c:3086 [inline]
    hci_sched_acl_pkt net/bluetooth/hci_core.c:3701 [inline]
    hci_sched_acl net/bluetooth/hci_core.c:3726 [inline]
    hci_tx_work+0x437/0x570 net/bluetooth/hci_core.c:3820
    process_one_work+0x26b/0x620 kernel/workqueue.c:3257
    process_scheduled_works kernel/workqueue.c:3340 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3421
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x2cf/0x300 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/01/13 01:42	upstream	0f61b1860cc3	d6526ea3	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image]	ci-upstream-gce-leak	memory leak in napi_skb_cache_get

* ~~Struck through~~ repros no longer work on HEAD.