memory leak in es58x_open

Status: fixed on 2026/05/06 16:40
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+e8cb6691a7cf68256cb8@syzkaller.appspotmail.com
Fix commit: b1979778e985 can: etas_es58x: allow partial RX URB allocation to succeed
First crash: 218d, last: 204d
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
Re: [net,2/3] can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak 2 (2) 2026/01/16 17:02
[PATCH net 1/3] can: etas_es58x: allow partial RX URB allocation to succeed 2 (2) 2026/01/12 20:56
[syzbot] [usb?] memory leak in es58x_open 1 (3) 2026/01/12 15:41
[PATCH] can: etas_es58x: fix memory leak in es58x_open() 5 (5) 2025/12/24 12:02
▶ ▼ Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/01/12 15:06 33m oneukum@suse.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ea1013c15392 error
2026/01/01 21:06 15m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812623e000 (size 512):
  comm "dhcpcd", pid 5478, jiffies 4294946142
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    hcd_buffer_alloc+0x151/0x190 drivers/usb/core/buffer.c:134
    usb_alloc_coherent+0x44/0x70 drivers/usb/core/usb.c:1010
    es58x_alloc_urb+0x4c/0xc0 drivers/net/can/usb/etas_es58x/es58x_core.c:1553
    es58x_alloc_rx_urbs drivers/net/can/usb/etas_es58x/es58x_core.c:1711 [inline]
    es58x_open+0x1b3/0x470 drivers/net/can/usb/etas_es58x/es58x_core.c:1785
    __dev_open+0x1be/0x3c0 net/core/dev.c:1683
    __dev_change_flags+0x30c/0x380 net/core/dev.c:9734
    netif_change_flags+0x35/0x90 net/core/dev.c:9797
    dev_change_flags+0x64/0xf0 net/core/dev_api.c:68
    devinet_ioctl+0x5bf/0xd30 net/ipv4/devinet.c:1199
    inet_ioctl+0x27c/0x2b0 net/ipv4/af_inet.c:1009
    sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
    sock_ioctl+0x149/0x480 net/socket.c:1375
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126112200 (size 512):
  comm "dhcpcd", pid 5478, jiffies 4294946373
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    hcd_buffer_alloc+0x151/0x190 drivers/usb/core/buffer.c:134
    usb_alloc_coherent+0x44/0x70 drivers/usb/core/usb.c:1010
    es58x_alloc_urb+0x4c/0xc0 drivers/net/can/usb/etas_es58x/es58x_core.c:1553
    es58x_alloc_rx_urbs drivers/net/can/usb/etas_es58x/es58x_core.c:1711 [inline]
    es58x_open+0x1b3/0x470 drivers/net/can/usb/etas_es58x/es58x_core.c:1785
    __dev_open+0x1be/0x3c0 net/core/dev.c:1683
    __dev_change_flags+0x30c/0x380 net/core/dev.c:9734
    netif_change_flags+0x35/0x90 net/core/dev.c:9797
    dev_change_flags+0x64/0xf0 net/core/dev_api.c:68
    devinet_ioctl+0x5bf/0xd30 net/ipv4/devinet.c:1199
    inet_ioctl+0x27c/0x2b0 net/ipv4/af_inet.c:1009
    sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
    sock_ioctl+0x149/0x480 net/socket.c:1375
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126188800 (size 512):
  comm "dhcpcd", pid 5478, jiffies 4294946404
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    hcd_buffer_alloc+0x151/0x190 drivers/usb/core/buffer.c:134
    usb_alloc_coherent+0x44/0x70 drivers/usb/core/usb.c:1010
    es58x_alloc_urb+0x4c/0xc0 drivers/net/can/usb/etas_es58x/es58x_core.c:1553
    es58x_alloc_rx_urbs drivers/net/can/usb/etas_es58x/es58x_core.c:1711 [inline]
    es58x_open+0x1b3/0x470 drivers/net/can/usb/etas_es58x/es58x_core.c:1785
    __dev_open+0x1be/0x3c0 net/core/dev.c:1683
    __dev_change_flags+0x30c/0x380 net/core/dev.c:9734
    netif_change_flags+0x35/0x90 net/core/dev.c:9797
    dev_change_flags+0x64/0xf0 net/core/dev_api.c:68
    devinet_ioctl+0x5bf/0xd30 net/ipv4/devinet.c:1199
    inet_ioctl+0x27c/0x2b0 net/ipv4/af_inet.c:1009
    sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
    sock_ioctl+0x149/0x480 net/socket.c:1375
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/18 20:29 upstream ea1013c15392 d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in es58x_open
* Struck through repros no longer work on HEAD.