memory leak in v4l2_ctrl_handler_init_class (3)

Status: upstream: reported C repro on 2026/05/07 23:35
Subsystems: usb media
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+b1de0d5fd8a15fac11aa@syzkaller.appspotmail.com
First crash: 153d, last: 8h32m
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
52697712 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in v4l2_ctrl_handler_init_class (3) 2026/06/01 10:16 2026/06/01 10:16 2026/06/01 11:19 6b4a8443
a6b749b2 assessment-security 💥 memory leak in v4l2_ctrl_handler_init_class (3) 2026/05/15 11:41 2026/05/15 11:41 2026/05/15 11:42 9cd3beaa
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[syzbot] Monthly media report (Oct 2026) 0 (1) 2026/10/06 04:33
[syzbot] Monthly media report (Sep 2026) 0 (1) 2026/09/04 20:33
[syzbot] Monthly media report (Aug 2026) 0 (1) 2026/08/05 00:00
[PATCH] media: msi2500: free controls when video registration fails 1 (1) 2026/06/28 01:00
[syzbot] Monthly media report (Jun 2026) 0 (1) 2026/06/03 04:32
[PATCH v2] media: msi2500: fix memory leak in msi2500_probe error path 1 (1) 2026/05/15 07:25
[PATCH] media: msi2500: fix memory leak in msi2500_probe error path 2 (2) 2026/05/14 16:33
[syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3) 0 (3) 2026/05/08 03:01
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in v4l2_ctrl_handler_init_class usb media 3 syz, C 12 1998d 2050d 20/29 fixed on 2021/11/10 00:50
upstream memory leak in v4l2_ctrl_handler_init_class (2) usb media 3 syz, C 14 252d 316d 29/29 fixed on 2026/05/06 16:40
▶ ▼ Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/10/07 18:29 17m retest repro upstream report job log log
2026/10/07 18:29 58m retest repro upstream report job log log
2026/10/07 18:29 24m retest repro upstream report job log log
2026/10/07 18:29 23m retest repro upstream report job log log
2026/10/07 18:29 18m retest repro upstream report job log log
2026/09/04 12:00 7h34m retest repro upstream report job log log
2026/09/04 12:00 25m retest repro upstream report job log log
2026/09/04 12:00 14m retest repro upstream report job log log
2026/09/04 12:00 14m retest repro upstream report job log log
2026/09/04 12:00 15m retest repro upstream report job log log
2026/05/08 03:01 36m daiky0325@gmail.com patch upstream OK log
2026/05/08 02:56 21m daiky0325@gmail.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888109422ab0 (size 8):
  comm "kworker/1:10", pid 5941, jiffies 4294943890
  hex dump (first 8 bytes):
    40 86 6b 2b 81 88 ff ff                          @.k+....
  backtrace (crc 129c7530):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kvmalloc_node_noprof+0x583/0x700 mm/slub.c:7014
    v4l2_ctrl_handler_init_class+0x59/0x90 drivers/media/v4l2-core/v4l2-ctrls-core.c:1805
    msi2500_probe+0x2f7/0x3a0 drivers/media/usb/msi2500/msi2500.c:1263
    usb_probe_interface+0x1a9/0x3e0 drivers/usb/core/driver.c:399
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3776
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2268
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
    usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:293

BUG: memory leak
unreferenced object 0xffff88812b83b700 (size 256):
  comm "kworker/1:10", pid 5941, jiffies 4294943890
  hex dump (first 32 bytes):
    58 67 93 2a 81 88 ff ff 58 67 93 2a 81 88 ff ff  Xg.*....Xg.*....
    10 b7 83 2b 81 88 ff ff 10 b7 83 2b 81 88 ff ff  ...+.......+....
  backtrace (crc a3874b23):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kvmalloc_node_noprof+0x583/0x700 mm/slub.c:7014
    v4l2_ctrl_new+0x2bb/0x1470 drivers/media/v4l2-core/v4l2-ctrls-core.c:2216
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2370
    handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1951
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2520 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2494
    msi2500_probe+0x32e/0x3a0 drivers/media/usb/msi2500/msi2500.c:1271
    usb_probe_interface+0x1a9/0x3e0 drivers/usb/core/driver.c:399
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3776

BUG: memory leak
unreferenced object 0xffff88812b6b8780 (size 64):
  comm "kworker/1:10", pid 5941, jiffies 4294943890
  hex dump (first 32 bytes):
    40 87 6b 2b 81 88 ff ff 68 67 93 2a 81 88 ff ff  @.k+....hg.*....
    00 00 00 00 00 00 00 00 00 b7 83 2b 81 88 ff ff  ...........+....
  backtrace (crc 3e2a9910):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    _kmalloc_noprof include/linux/slab.h:995 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1959
    v4l2_ctrl_new+0x69e/0x1470 drivers/media/v4l2-core/v4l2-ctrls-core.c:2299
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2370
    handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1951
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2520 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2494
    msi2500_probe+0x32e/0x3a0 drivers/media/usb/msi2500/msi2500.c:1271
    usb_probe_interface+0x1a9/0x3e0 drivers/usb/core/driver.c:399
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620

BUG: memory leak
unreferenced object 0xffff88812b6b8740 (size 64):
  comm "kworker/1:10", pid 5941, jiffies 4294943890
  hex dump (first 32 bytes):
    00 87 6b 2b 81 88 ff ff 80 87 6b 2b 81 88 ff ff  ..k+......k+....
    80 87 6b 2b 81 88 ff ff 00 bd 83 2b 81 88 ff ff  ..k+.......+....
  backtrace (crc 2d007d00):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    _kmalloc_noprof include/linux/slab.h:995 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1959
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2520 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2494
    msi2500_probe+0x32e/0x3a0 drivers/media/usb/msi2500/msi2500.c:1271
    usb_probe_interface+0x1a9/0x3e0 drivers/usb/core/driver.c:399
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:1026
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1098
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1153
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:620
    device_add+0x99f/0xc80 drivers/base/core.c:3776
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2268
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/22 15:29 upstream f0100363d8c3 e12281bd .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/09/22 04:59 upstream f0100363d8c3 e12281bd .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/09/15 09:15 upstream 587858367581 81a27d1a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/09/15 00:47 upstream 704340f1cd0d 924033e8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/09/15 00:15 upstream 704340f1cd0d 924033e8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/09/14 23:59 upstream 704340f1cd0d 924033e8 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/08/16 05:18 upstream 3eb40771c00a 746171ee .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/18 15:09 upstream af5e34a41cd6 72524a66 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/17 03:34 upstream 37e2f878a7a6 8f30cfd7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/17 03:30 upstream 37e2f878a7a6 8f30cfd7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/17 02:49 upstream 37e2f878a7a6 8f30cfd7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/17 02:19 upstream 37e2f878a7a6 8f30cfd7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/17 02:05 upstream 37e2f878a7a6 8f30cfd7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/07/17 01:33 upstream 37e2f878a7a6 8f30cfd7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/06/29 23:59 upstream dc59e4fea9d8 6a0c72dc .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/06/29 23:08 upstream dc59e4fea9d8 6a0c72dc .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/06/29 22:39 upstream dc59e4fea9d8 6a0c72dc .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/06/29 22:22 upstream dc59e4fea9d8 6a0c72dc .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/06/29 21:55 upstream dc59e4fea9d8 6a0c72dc .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/16 20:17 upstream 6916d5703ddf a15a64a6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/16 19:54 upstream 6916d5703ddf a15a64a6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/16 19:52 upstream 6916d5703ddf a15a64a6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/07 16:29 upstream 5862221fdded f250db59 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/07 16:06 upstream 5862221fdded f250db59 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/07 15:43 upstream 5862221fdded f250db59 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/07 15:37 upstream 5862221fdded f250db59 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/05/07 15:33 upstream 5862221fdded f250db59 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
* Struck through repros no longer work on HEAD.