memory leak in __usbhid_submit_report (2)

Status: upstream: reported C repro on 2026/08/19 06:50
Subsystems: input usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+e2c057ea576d2644e2be@syzkaller.appspotmail.com
First crash: 5d12h, last: 5d12h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c48c4522 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in __usbhid_submit_report (2) 2026/08/15 06:44 2026/08/15 06:44 2026/08/15 07:24 746171ee
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH v2 2/2] HID: usbhid: free unsent raw output reports in usbhid_stop() 1 (1) 2026/08/19 11:12
[PATCH v2 1/2] HID: usbhid: adjust output pipe FIFO size 1 (1) 2026/08/19 11:12
[syzbot] [input?] [usb?] memory leak in __usbhid_submit_report (2) 0 (3) 2026/08/19 10:56
[PATCH] HID: usbhid: free unsent raw output reports in usbhid_stop() 1 (1) 2026/08/19 09:09
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in __usbhid_submit_report input usb 3 syz, C 129 1814d 2108d 20/29 fixed on 2021/11/10 00:50
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/08/19 10:56 22m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bd5f485f3f026225b86573e559af0b7254ef4184 OK job log log
2026/08/19 08:01 22m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bd5f485f3f026225b86573e559af0b7254ef4184 OK job log log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff8881279df600 (size 16):
  comm "syz.5.22", pid 6103, jiffies 4294942311
  hex dump (first 16 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __do_kmalloc_node mm/slub.c:5333 [inline]
    __kmalloc_noprof+0x3bf/0x550 mm/slub.c:5359
    __usbhid_submit_report+0x362/0x4c0 drivers/hid/usbhid/hid-core.c:541
    usbhid_submit_report drivers/hid/usbhid/hid-core.c:640 [inline]
    usbhid_request+0x5b/0xa0 drivers/hid/usbhid/hid-core.c:1303
    hid_hw_request+0x3c/0x70 drivers/hid/hid-core.c:2521
    hiddev_ioctl+0x33e/0x9d0 drivers/hid/usbhid/hiddev.c:726
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xf8/0x610 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/15 06:44 upstream 2f1baf1fc892 746171ee .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __usbhid_submit_report
* Struck through repros no longer work on HEAD.