memory leak in nci_send_cmd

Status: upstream: reported C repro on 2026/08/30 12:50
Subsystems: usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+b197a0fb4e741cc5030e@syzkaller.appspotmail.com
First crash: 50d, last: 5d04h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
338bde93 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in nci_send_cmd 2026/08/26 12:43 2026/08/26 12:43 2026/08/26 13:42 ee98d2fd
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH RESEND] nfc: nfcmrvl: fix memory leak in nfcmrvl_usb_nci_send() 1 (1) 2026/09/24 09:50
[PATCH] nfc: nfcmrvl: fix memory leak in nfcmrvl_usb_nci_send() 2 (2) 2026/09/08 19:48
[syzbot] [usb?] [nfc?] [net?] memory leak in nci_send_cmd 1 (3) 2026/08/30 17:10
▶ ▼ Last patch testing requests (6)
Created Duration User Patch Repo Result
2026/10/10 09:38 17m retest repro upstream report job log log
2026/09/20 20:52 1m retest repro upstream error job log
2026/09/20 20:52 1m retest repro upstream error job log
2026/09/20 20:52 1m retest repro upstream error job log
2026/09/20 20:52 0m retest repro upstream error job log
2026/08/30 16:24 27m pavankumaryalagada@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73ae59e975966d24e32926247ddb45a537ebe184 OK job log log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810b8a6b00 (size 240):
  comm "syz.0.17", pid 5908, jiffies 4294944002
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 68 97 11 81 88 ff ff 00 00 00 00 00 00 00 00  .h..............
  backtrace (crc 570fb4bf):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    kmem_cache_alloc_node_noprof+0x39f/0x440 mm/slub.c:5068
    __alloc_skb+0xdc/0x4e0 net/core/skbuff.c:704
    alloc_skb include/linux/skbuff.h:1384 [inline]
    nci_skb_alloc include/net/nfc/nci_core.h:330 [inline]
    nci_send_cmd+0x46/0x110 net/nfc/nci/core.c:1397
    nci_reset_req net/nfc/nci/core.c:167 [inline]
    __nci_request net/nfc/nci/core.c:108 [inline]
    nci_open_device net/nfc/nci/core.c:503 [inline]
    nci_dev_up+0x1b6/0x690 net/nfc/nci/core.c:643
    nfc_dev_up+0xca/0x160 net/nfc/core.c:118
    nfc_genl_dev_up+0x3d/0x70 net/nfc/netlink.c:775
    genl_family_rcv_msg_doit+0x12e/0x1a0 net/netlink/genetlink.c:1114
    genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
    genl_rcv_msg+0x302/0x440 net/netlink/genetlink.c:1209
    netlink_rcv_skb+0x89/0x1c0 net/netlink/af_netlink.c:2575
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
    netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
    netlink_unicast+0x38f/0x4e0 net/netlink/af_netlink.c:1364
    netlink_sendmsg+0x335/0x690 net/netlink/af_netlink.c:1919
    sock_sendmsg_nosec net/socket.c:800 [inline]
    __sock_sendmsg net/socket.c:815 [inline]
    ____sys_sendmsg+0x54a/0x580 net/socket.c:2713
    ___sys_sendmsg+0x101/0x140 net/socket.c:2767
    __sys_sendmsg+0xcd/0x140 net/socket.c:2799
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84

BUG: memory leak
unreferenced object 0xffff888109f29340 (size 704):
  comm "syz.0.17", pid 5908, jiffies 4294944002
  hex dump (first 32 bytes):
    20 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00   ...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 40ddf9):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    kmem_cache_alloc_node_noprof+0x39f/0x440 mm/slub.c:5068
    kmalloc_reserve+0xd2/0x1b0 net/core/skbuff.c:615
    __alloc_skb+0x15d/0x4e0 net/core/skbuff.c:715
    alloc_skb include/linux/skbuff.h:1384 [inline]
    nci_skb_alloc include/net/nfc/nci_core.h:330 [inline]
    nci_send_cmd+0x46/0x110 net/nfc/nci/core.c:1397
    nci_reset_req net/nfc/nci/core.c:167 [inline]
    __nci_request net/nfc/nci/core.c:108 [inline]
    nci_open_device net/nfc/nci/core.c:503 [inline]
    nci_dev_up+0x1b6/0x690 net/nfc/nci/core.c:643
    nfc_dev_up+0xca/0x160 net/nfc/core.c:118
    nfc_genl_dev_up+0x3d/0x70 net/nfc/netlink.c:775
    genl_family_rcv_msg_doit+0x12e/0x1a0 net/netlink/genetlink.c:1114
    genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
    genl_rcv_msg+0x302/0x440 net/netlink/genetlink.c:1209
    netlink_rcv_skb+0x89/0x1c0 net/netlink/af_netlink.c:2575
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
    netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
    netlink_unicast+0x38f/0x4e0 net/netlink/af_netlink.c:1364
    netlink_sendmsg+0x335/0x690 net/netlink/af_netlink.c:1919
    sock_sendmsg_nosec net/socket.c:800 [inline]
    __sock_sendmsg net/socket.c:815 [inline]
    ____sys_sendmsg+0x54a/0x580 net/socket.c:2713
    ___sys_sendmsg+0x101/0x140 net/socket.c:2767
    __sys_sendmsg+0xcd/0x140 net/socket.c:2799

BUG: memory leak
unreferenced object 0xffff88810b85b800 (size 240):
  comm "syz.0.19", pid 5981, jiffies 4294944614
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 50 9c 11 81 88 ff ff 00 00 00 00 00 00 00 00  .P..............
  backtrace (crc 60aef04e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    kmem_cache_alloc_node_noprof+0x39f/0x440 mm/slub.c:5068
    __alloc_skb+0xdc/0x4e0 net/core/skbuff.c:704
    alloc_skb include/linux/skbuff.h:1384 [inline]
    nci_skb_alloc include/net/nfc/nci_core.h:330 [inline]
    nci_send_cmd+0x46/0x110 net/nfc/nci/core.c:1397
    nci_reset_req net/nfc/nci/core.c:167 [inline]
    __nci_request net/nfc/nci/core.c:108 [inline]
    nci_open_device net/nfc/nci/core.c:503 [inline]
    nci_dev_up+0x1b6/0x690 net/nfc/nci/core.c:643
    nfc_dev_up+0xca/0x160 net/nfc/core.c:118
    nfc_genl_dev_up+0x3d/0x70 net/nfc/netlink.c:775
    genl_family_rcv_msg_doit+0x12e/0x1a0 net/netlink/genetlink.c:1114
    genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
    genl_rcv_msg+0x302/0x440 net/netlink/genetlink.c:1209
    netlink_rcv_skb+0x89/0x1c0 net/netlink/af_netlink.c:2575
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
    netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
    netlink_unicast+0x38f/0x4e0 net/netlink/af_netlink.c:1364
    netlink_sendmsg+0x335/0x690 net/netlink/af_netlink.c:1919
    sock_sendmsg_nosec net/socket.c:800 [inline]
    __sock_sendmsg net/socket.c:815 [inline]
    ____sys_sendmsg+0x54a/0x580 net/socket.c:2713
    ___sys_sendmsg+0x101/0x140 net/socket.c:2767
    __sys_sendmsg+0xcd/0x140 net/socket.c:2799
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/24 15:45 upstream 62f4c998b297 3c3cdf19 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
2026/09/06 20:00 upstream 1fc5a74b108f 4f7b22a0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
2026/09/06 18:59 upstream 1fc5a74b108f 4f7b22a0 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
2026/08/26 12:45 upstream 73ae59e97596 6a91adb4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
2026/08/26 12:42 upstream 73ae59e97596 6a91adb4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
* Struck through repros no longer work on HEAD.