memory leak in v4l2_ctrl_handler_init_class (2)

Status: fixed on 2026/05/06 16:40
Subsystems: usb media
[Documentation on labels]
Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com
Fix commit: b8bf939d77c0 media: radio-keene: fix memory leak in error path
First crash: 244d, last: 175d
▶ ▼ Discussions (10)
Title Replies (including bot) Last reply
FAILED: Patch "media: radio-keene: fix memory leak in error path" failed to apply to 5.10-stable tree 1 (1) 2026/03/01 01:59
FAILED: Patch "media: radio-keene: fix memory leak in error path" failed to apply to 5.15-stable tree 1 (1) 2026/03/01 01:49
FAILED: Patch "media: radio-keene: fix memory leak in error path" failed to apply to 6.1-stable tree 1 (1) 2026/03/01 01:41
FAILED: Patch "media: radio-keene: fix memory leak in error path" failed to apply to 6.6-stable tree 1 (1) 2026/03/01 01:31
FAILED: Patch "media: radio-keene: fix memory leak in error path" failed to apply to 6.12-stable tree 1 (1) 2026/03/01 01:19
[PATCH 6.19 570/844] media: radio-keene: fix memory leak in error path 1 (1) 2026/02/28 17:28
[PATCH v3] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/29 10:01
[PATCH] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/27 16:56
[PATCH v2] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/26 17:46
[syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (2) 3 (7) 2025/11/25 21:29
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in v4l2_ctrl_handler_init_class usb media 3 C 12 1921d 1974d 20/29 fixed on 2021/11/10 00:50
upstream memory leak in v4l2_ctrl_handler_init_class (3) prio:high usb media 3 C 20 5d02h 76d 0/29 upstream: reported C repro on 2026/05/07 23:35
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/12/09 21:58 19m retest repro upstream report log
2025/12/09 21:58 14m retest repro upstream report log
2025/11/25 20:21 20m ssranevjti@gmail.com patch upstream OK log
2025/11/25 17:03 31m ssranevjti@gmail.com patch upstream OK log
2025/11/25 17:01 16m ssranevjti@gmail.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff8881273ec430 (size 8):
  comm "kworker/1:4", pid 5849, jiffies 4294944693
  hex dump (first 8 bytes):
    40 53 08 11 81 88 ff ff                          @S......
  backtrace (crc 8e968401):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x5ce/0x830 mm/slub.c:7140
    kvmalloc_array_node_noprof include/linux/slab.h:1122 [inline]
    v4l2_ctrl_handler_init_class+0x59/0x90 drivers/media/v4l2-core/v4l2-ctrls-core.c:1706
    msi2500_probe+0x2a9/0x390 drivers/media/usb/msi2500/msi2500.c:1248
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
    usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:291

BUG: memory leak
unreferenced object 0xffff88810e1df300 (size 8):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 8 bytes):
    40 9a 27 11 81 88 ff ff                          @.'.....
  backtrace (crc 21e9e9ba):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x5ce/0x830 mm/slub.c:7140
    kvmalloc_array_node_noprof include/linux/slab.h:1122 [inline]
    v4l2_ctrl_handler_init_class+0x59/0x90 drivers/media/v4l2-core/v4l2-ctrls-core.c:1706
    msi2500_probe+0x2a9/0x390 drivers/media/usb/msi2500/msi2500.c:1248
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
    usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:291

BUG: memory leak
unreferenced object 0xffff888125d52900 (size 256):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 32 bytes):
    58 47 1e 12 81 88 ff ff 58 47 1e 12 81 88 ff ff  XG......XG......
    10 29 d5 25 81 88 ff ff 10 29 d5 25 81 88 ff ff  .).%.....).%....
  backtrace (crc f2f792d8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x5ce/0x830 mm/slub.c:7140
    v4l2_ctrl_new+0x2bb/0x1410 drivers/media/v4l2-core/v4l2-ctrls-core.c:2112
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1853
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2416 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2390
    msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689

BUG: memory leak
unreferenced object 0xffff888111279440 (size 64):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 32 bytes):
    00 94 27 11 81 88 ff ff 68 47 1e 12 81 88 ff ff  ..'.....hG......
    00 00 00 00 00 00 00 00 00 29 d5 25 81 88 ff ff  .........).%....
  backtrace (crc 4f2ef138):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x465/0x680 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1861
    v4l2_ctrl_new+0x69e/0x1410 drivers/media/v4l2-core/v4l2-ctrls-core.c:2195
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1853
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2416 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2390
    msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574

BUG: memory leak
unreferenced object 0xffff888111279400 (size 64):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 32 bytes):
    80 95 27 11 81 88 ff ff 40 94 27 11 81 88 ff ff  ..'.....@.'.....
    40 94 27 11 81 88 ff ff 00 ca 19 27 81 88 ff ff  @.'........'....
  backtrace (crc e73602b4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x465/0x680 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1861
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2416 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2390
    msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/28 23:07 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/28 23:03 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/28 21:50 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/28 21:48 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/20 03:10 upstream 24d479d26b25 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 13:26 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 12:01 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 11:40 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:53 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:38 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:07 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 12:46 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 11:46 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 07:51 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
* Struck through repros no longer work on HEAD.