memory leak in __usbhid_submit_report (2)

Status: upstream: reported C repro on 2026/08/19 06:50
Subsystems: input usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+e2c057ea576d2644e2be@syzkaller.appspotmail.com
First crash: 50d, last: 2d17h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c48c4522 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in __usbhid_submit_report (2) 2026/08/15 06:44 2026/08/15 06:44 2026/08/15 07:24 746171ee
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH v2 2/2] HID: usbhid: free unsent raw output reports in usbhid_stop() 1 (1) 2026/08/19 11:12
[PATCH v2 1/2] HID: usbhid: adjust output pipe FIFO size 1 (1) 2026/08/19 11:12
[syzbot] [input?] [usb?] memory leak in __usbhid_submit_report (2) 0 (3) 2026/08/19 10:56
[PATCH] HID: usbhid: free unsent raw output reports in usbhid_stop() 1 (1) 2026/08/19 09:09
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in __usbhid_submit_report input usb 3 syz, C 129 1860d 2153d 20/29 fixed on 2021/11/10 00:50
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/08/31 07:23 54m retest repro upstream report job log log
2026/08/19 10:56 22m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bd5f485f3f026225b86573e559af0b7254ef4184 OK job log log
2026/08/19 08:01 22m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bd5f485f3f026225b86573e559af0b7254ef4184 OK job log log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810e302fb0 (size 8):
  comm "syz.6.23", pid 6050, jiffies 4294944097
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812b65d0f0 (size 8):
  comm "syz.5.22", pid 6058, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129618148 (size 8):
  comm "syz.2.19", pid 6052, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129dc5518 (size 8):
  comm "syz.4.21", pid 6055, jiffies 4294944103
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812b65d100 (size 8):
  comm "syz.1.24", pid 6065, jiffies 4294944233
  hex dump (first 8 bytes):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __do_kmalloc_node mm/slub.c:5413 [inline]
    __kmalloc_noprof+0x3fb/0x540 mm/slub.c:5439
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2531
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/02 09:12 upstream d24e8ac715de 6d32eb1f .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __usbhid_submit_report
2026/08/15 06:44 upstream 2f1baf1fc892 746171ee .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __usbhid_submit_report
* Struck through repros no longer work on HEAD.