memory leak in __hci_cmd_sync_sk

Status: auto-obsoleted due to no activity on 2026/03/02 14:39
Subsystems: bluetooth usb
[Documentation on labels]
Reported-by: syzbot+f098d64cc684b8dbaf65@syzkaller.appspotmail.com
First crash: 274d, last: 265d
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [bluetooth?] [usb?] memory leak in __hci_cmd_sync_sk 19 (38) 2025/11/23 16:30
▶ ▼ Last patch testing requests (19)
Created Duration User Patch Repo Result
2026/01/31 16:00 20m retest repro upstream no crash log
2025/11/23 15:08 21m eadavis@qq.com patch upstream report log
2025/11/23 14:33 46m eadavis@qq.com patch upstream report log
2025/11/23 14:05 1h07m eadavis@qq.com patch upstream OK log
2025/11/22 14:14 24m eadavis@qq.com upstream report log
2025/11/22 07:09 50m eadavis@qq.com patch upstream OK log
2025/11/21 09:07 49m eadavis@qq.com patch upstream error
2025/11/21 06:17 1h49m eadavis@qq.com patch upstream error
2025/11/21 00:57 59m eadavis@qq.com patch upstream OK log
2025/11/21 00:55 1h11m eadavis@qq.com patch upstream error
2025/11/21 00:05 27m eadavis@qq.com patch upstream report log
2025/11/20 14:54 18m eadavis@qq.com patch upstream report log
2025/11/20 14:11 20m eadavis@qq.com patch upstream report log
2025/11/20 13:27 20m eadavis@qq.com patch upstream report log
2025/11/19 18:46 18m ssranevjti@gmail.com patch upstream report log
2025/11/19 03:22 14m eadavis@qq.com patch upstream report log
2025/11/18 03:56 27m eadavis@qq.com patch upstream OK log
2025/11/18 03:40 12m eadavis@qq.com patch upstream error
2025/11/18 02:53 21m eadavis@qq.com patch upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888112c22900 (size 240):
  comm "kworker/u9:1", pid 5133, jiffies 4294947154
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 6c5ee80a):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5340
    __alloc_skb+0x203/0x240 net/core/skbuff.c:660
    alloc_skb include/linux/skbuff.h:1383 [inline]
    bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
    hci_cmd_sync_alloc+0x30/0x140 net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x84/0x290 net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_ev+0x3e/0x50 net/bluetooth/hci_sync.c:250
    send_hci_cmd_sync+0x5e/0xf0 net/bluetooth/mgmt.c:2615
    hci_cmd_sync_work+0xd5/0x160 net/bluetooth/hci_sync.c:332
    process_one_work+0x26b/0x620 kernel/workqueue.c:3263
    process_scheduled_works kernel/workqueue.c:3346 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3427
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x210/0x240 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff88810b0ee3c0 (size 704):
  comm "kworker/u9:1", pid 5133, jiffies 4294947154
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 4e765d9f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5340
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:579
    __alloc_skb+0xd4/0x240 net/core/skbuff.c:670
    alloc_skb include/linux/skbuff.h:1383 [inline]
    bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
    hci_cmd_sync_alloc+0x30/0x140 net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x84/0x290 net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_ev+0x3e/0x50 net/bluetooth/hci_sync.c:250
    send_hci_cmd_sync+0x5e/0xf0 net/bluetooth/mgmt.c:2615
    hci_cmd_sync_work+0xd5/0x160 net/bluetooth/hci_sync.c:332
    process_one_work+0x26b/0x620 kernel/workqueue.c:3263
    process_scheduled_works kernel/workqueue.c:3346 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3427
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x210/0x240 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888112c22b00 (size 240):
  comm "kworker/u9:1", pid 5133, jiffies 4294947360
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a204b710):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5340
    __alloc_skb+0x203/0x240 net/core/skbuff.c:660
    alloc_skb include/linux/skbuff.h:1383 [inline]
    bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
    hci_cmd_sync_alloc+0x30/0x140 net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x84/0x290 net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_ev+0x3e/0x50 net/bluetooth/hci_sync.c:250
    send_hci_cmd_sync+0x5e/0xf0 net/bluetooth/mgmt.c:2615
    hci_cmd_sync_work+0xd5/0x160 net/bluetooth/hci_sync.c:332
    process_one_work+0x26b/0x620 kernel/workqueue.c:3263
    process_scheduled_works kernel/workqueue.c:3346 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3427
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x210/0x240 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff88810b0edb80 (size 704):
  comm "kworker/u9:1", pid 5133, jiffies 4294947360
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 4e765d9f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_node_noprof+0x36f/0x5e0 mm/slub.c:5340
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:579
    __alloc_skb+0xd4/0x240 net/core/skbuff.c:670
    alloc_skb include/linux/skbuff.h:1383 [inline]
    bt_skb_alloc include/net/bluetooth/bluetooth.h:510 [inline]
    hci_cmd_sync_alloc+0x30/0x140 net/bluetooth/hci_sync.c:58
    hci_cmd_sync_add net/bluetooth/hci_sync.c:99 [inline]
    __hci_cmd_sync_sk+0x84/0x290 net/bluetooth/hci_sync.c:168
    __hci_cmd_sync_ev+0x3e/0x50 net/bluetooth/hci_sync.c:250
    send_hci_cmd_sync+0x5e/0xf0 net/bluetooth/mgmt.c:2615
    hci_cmd_sync_work+0xd5/0x160 net/bluetooth/hci_sync.c:332
    process_one_work+0x26b/0x620 kernel/workqueue.c:3263
    process_scheduled_works kernel/workqueue.c:3346 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3427
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x210/0x240 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/13 14:21 upstream e927c520e1ba 07e030de .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __hci_cmd_sync_sk
* Struck through repros no longer work on HEAD.