memory leak in napi_skb_cache_get (2)

Status: fixed on 2026/05/06 16:40
Subsystems: net virt
[Documentation on labels]
Reported-by: syzbot+7ff4013eabad1407b70a@syzkaller.appspotmail.com
Fix commit: 21e4271e6509 Bluetooth: purge error queues in socket destructors
First crash: 193d, last: 193d
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH] Bluetooth: purge error queues in socket destructors 2 (2) 2026/02/11 19:40
On managing socket's error queue 1 (1) 2026/01/20 16:25
[syzbot] Monthly virt report (Jan 2026) 0 (1) 2026/01/20 08:45
[syzbot] [net?] [virt?] memory leak in napi_skb_cache_get (2) 0 (3) 2026/01/19 10:42
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in napi_skb_cache_get virt net 3 C 109 1352d 1331d 0/29 auto-obsoleted due to no activity on 2023/11/14 13:11
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/01/27 07:53 39m retest repro upstream report log
2026/01/19 10:42 21m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 24d479d26b25bce5faea3ddd9fa8f3a6c3129ea7 OK log
2026/01/16 13:03 20m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 983d014aafb14ee5e4915465bf8948e8f3a723b5 error

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810a03e300 (size 240):
  comm "softirq", pid 0, jiffies 4294943617
  hex dump (first 32 bytes):
    90 dc d8 12 81 88 ff ff 90 dc d8 12 81 88 ff ff  ................
    00 00 00 00 00 00 00 00 00 dc d8 12 81 88 ff ff  ................
  backtrace (crc 2f85baf):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    kmem_cache_alloc_bulk_noprof+0x22d/0x3e0 mm/slub.c:7521
    napi_skb_cache_get+0xa9/0xd0 net/core/skbuff.c:291
    __alloc_skb+0x214/0x2b0 net/core/skbuff.c:668
    napi_alloc_skb+0x118/0x180 net/core/skbuff.c:832
    page_to_skb+0xee/0x5e0 drivers/net/virtio_net.c:904
    receive_mergeable drivers/net/virtio_net.c:2514 [inline]
    receive_buf+0x49f/0x2670 drivers/net/virtio_net.c:2660
    virtnet_receive_packets drivers/net/virtio_net.c:3023 [inline]
    virtnet_receive drivers/net/virtio_net.c:3047 [inline]
    virtnet_poll+0x7d6/0x16e0 drivers/net/virtio_net.c:3136
    __napi_poll+0x44/0x3a0 net/core/dev.c:7668
    napi_poll net/core/dev.c:7731 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7883
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
    common_interrupt+0x87/0xa0 arch/x86/kernel/irq.c:319
    asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:688

BUG: memory leak
unreferenced object 0xffff88810adf5e40 (size 704):
  comm "kworker/u9:0", pid 51, jiffies 4294943617
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc f18cfd82):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    __skb_tstamp_tx+0x162/0x4c0 net/core/skbuff.c:5677
    hci_conn_tx_queue+0x11c/0x1d0 net/bluetooth/hci_conn.c:3049
    hci_send_conn_frame net/bluetooth/hci_core.c:3086 [inline]
    hci_sched_acl_pkt net/bluetooth/hci_core.c:3701 [inline]
    hci_sched_acl net/bluetooth/hci_core.c:3726 [inline]
    hci_tx_work+0x437/0x570 net/bluetooth/hci_core.c:3820
    process_one_work+0x26b/0x620 kernel/workqueue.c:3257
    process_scheduled_works kernel/workqueue.c:3340 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3421
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x2cf/0x300 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/13 01:42 upstream 0f61b1860cc3 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in napi_skb_cache_get
* Struck through repros no longer work on HEAD.