syzbot

 sign-in | mailing list | source | docs
🐞 Open [1468]
≡ Subsystems
🐞 Fixed [6853]
🐞 Invalid [17781]
⬇ Missing Backports [225]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in es58x_open

Status: upstream: reported syz repro on 2025/12/22 05:27
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com
Fix commit: can: etas_es58x: allow partial RX URB allocation to succeed
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 26d, last: 12d
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH net 1/3] can: etas_es58x: allow partial RX URB allocation to succeed 2 (2) 2026/01/12 20:56
[syzbot] [usb?] memory leak in es58x_open 1 (3) 2026/01/12 15:41
Re: [net,2/3] can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak 1 (1) 2026/01/10 22:38
[PATCH] can: etas_es58x: fix memory leak in es58x_open() 5 (5) 2025/12/24 12:02
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/01/12 15:06 33m oneukum@suse.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ea1013c15392 error
2026/01/01 21:06 15m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812623e000 (size 512):
  comm "dhcpcd", pid 5478, jiffies 4294946142
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    hcd_buffer_alloc+0x151/0x190 drivers/usb/core/buffer.c:134
    usb_alloc_coherent+0x44/0x70 drivers/usb/core/usb.c:1010
    es58x_alloc_urb+0x4c/0xc0 drivers/net/can/usb/etas_es58x/es58x_core.c:1553
    es58x_alloc_rx_urbs drivers/net/can/usb/etas_es58x/es58x_core.c:1711 [inline]
    es58x_open+0x1b3/0x470 drivers/net/can/usb/etas_es58x/es58x_core.c:1785
    __dev_open+0x1be/0x3c0 net/core/dev.c:1683
    __dev_change_flags+0x30c/0x380 net/core/dev.c:9734
    netif_change_flags+0x35/0x90 net/core/dev.c:9797
    dev_change_flags+0x64/0xf0 net/core/dev_api.c:68
    devinet_ioctl+0x5bf/0xd30 net/ipv4/devinet.c:1199
    inet_ioctl+0x27c/0x2b0 net/ipv4/af_inet.c:1009
    sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
    sock_ioctl+0x149/0x480 net/socket.c:1375
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126112200 (size 512):
  comm "dhcpcd", pid 5478, jiffies 4294946373
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    hcd_buffer_alloc+0x151/0x190 drivers/usb/core/buffer.c:134
    usb_alloc_coherent+0x44/0x70 drivers/usb/core/usb.c:1010
    es58x_alloc_urb+0x4c/0xc0 drivers/net/can/usb/etas_es58x/es58x_core.c:1553
    es58x_alloc_rx_urbs drivers/net/can/usb/etas_es58x/es58x_core.c:1711 [inline]
    es58x_open+0x1b3/0x470 drivers/net/can/usb/etas_es58x/es58x_core.c:1785
    __dev_open+0x1be/0x3c0 net/core/dev.c:1683
    __dev_change_flags+0x30c/0x380 net/core/dev.c:9734
    netif_change_flags+0x35/0x90 net/core/dev.c:9797
    dev_change_flags+0x64/0xf0 net/core/dev_api.c:68
    devinet_ioctl+0x5bf/0xd30 net/ipv4/devinet.c:1199
    inet_ioctl+0x27c/0x2b0 net/ipv4/af_inet.c:1009
    sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
    sock_ioctl+0x149/0x480 net/socket.c:1375
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126188800 (size 512):
  comm "dhcpcd", pid 5478, jiffies 4294946404
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    hcd_buffer_alloc+0x151/0x190 drivers/usb/core/buffer.c:134
    usb_alloc_coherent+0x44/0x70 drivers/usb/core/usb.c:1010
    es58x_alloc_urb+0x4c/0xc0 drivers/net/can/usb/etas_es58x/es58x_core.c:1553
    es58x_alloc_rx_urbs drivers/net/can/usb/etas_es58x/es58x_core.c:1711 [inline]
    es58x_open+0x1b3/0x470 drivers/net/can/usb/etas_es58x/es58x_core.c:1785
    __dev_open+0x1be/0x3c0 net/core/dev.c:1683
    __dev_change_flags+0x30c/0x380 net/core/dev.c:9734
    netif_change_flags+0x35/0x90 net/core/dev.c:9797
    dev_change_flags+0x64/0xf0 net/core/dev_api.c:68
    devinet_ioctl+0x5bf/0xd30 net/ipv4/devinet.c:1199
    inet_ioctl+0x27c/0x2b0 net/ipv4/af_inet.c:1009
    sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
    sock_ioctl+0x149/0x480 net/socket.c:1375
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/18 20:29 upstream ea1013c15392 d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in es58x_open
* Struck through repros no longer work on HEAD.