syzbot

 sign-in | mailing list | source | docs
🐞 Open [1443]
≡ Subsystems
🐞 Fixed [6891]
🐞 Invalid [17907]
⬇ Missing Backports [224]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in llcp_sock_create

Status: upstream: reported C repro on 2026/01/25 00:54
Subsystems: nfc net
[Documentation on labels]
Reported-by: syzbot+f2d245f1d76bbfa50e4c@syzkaller.appspotmail.com
Fix commit: nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame().
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 82d, last: 22d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH v1 net] nfc: llcp: Fix memleak in nfc_llcp_send_ui_frame(). 3 (3) 2026/01/27 04:00
[syzbot] [nfc?] [net?] memory leak in llcp_sock_create 0 (1) 2026/01/25 00:54
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2026/01/24 21:57 36m kuniyu@google.com patch upstream OK log
2026/01/07 12:52 15m edumazet@google.com upstream report log
2025/12/06 14:26 13m retest repro upstream report log
2025/11/22 12:17 22m retest repro upstream report log
2025/11/22 12:17 23m retest repro upstream report log
2025/11/22 12:17 19m retest repro upstream report log
2025/11/22 12:17 22m retest repro upstream report log
2025/11/22 12:17 12m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888100919400 (size 1024):
  comm "syz.0.33", pid 6225, jiffies 4294951961
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    27 00 03 40 00 00 00 00 00 00 00 00 00 00 00 00  '..@............
  backtrace (crc b7b16b39):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __do_kmalloc_node mm/slub.c:5645 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658
    kmalloc_noprof include/linux/slab.h:961 [inline]
    sk_prot_alloc+0x11a/0x1b0 net/core/sock.c:2239
    sk_alloc+0x36/0x360 net/core/sock.c:2295
    nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979
    llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044
    nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31
    __sock_create+0x1a9/0x340 net/socket.c:1605
    sock_create net/socket.c:1663 [inline]
    __sys_socket_create net/socket.c:1700 [inline]
    __sys_socket+0xb9/0x1a0 net/socket.c:1747
    __do_sys_socket net/socket.c:1761 [inline]
    __se_sys_socket net/socket.c:1759 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1759
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888146745b80 (size 32):
  comm "syz.0.33", pid 6225, jiffies 4294951961
  hex dump (first 32 bytes):
    f8 f2 85 00 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc e7cc8a40):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __do_kmalloc_node mm/slub.c:5645 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5658
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    lsm_blob_alloc+0x4d/0x70 security/security.c:690
    lsm_sock_alloc security/security.c:4922 [inline]
    security_sk_alloc+0x30/0x270 security/security.c:4938
    sk_prot_alloc+0x135/0x1b0 net/core/sock.c:2242
    sk_alloc+0x36/0x360 net/core/sock.c:2295
    nfc_llcp_sock_alloc+0x37/0x130 net/nfc/llcp_sock.c:979
    llcp_sock_create+0x71/0xd0 net/nfc/llcp_sock.c:1044
    nfc_sock_create+0xc9/0xf0 net/nfc/af_nfc.c:31
    __sock_create+0x1a9/0x340 net/socket.c:1605
    sock_create net/socket.c:1663 [inline]
    __sys_socket_create net/socket.c:1700 [inline]
    __sys_socket+0xb9/0x1a0 net/socket.c:1747
    __do_sys_socket net/socket.c:1761 [inline]
    __se_sys_socket net/socket.c:1759 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1759
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888100919000 (size 1024):
  comm "syz.0.33", pid 6225, jiffies 4294951961
  hex dump (first 32 bytes):
    03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 01 00 00 00 d8 8a 17 1a 81 88 ff ff  ................
  backtrace (crc 8562c5d7):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    nfc_allocate_device+0xa1/0x1e0 net/nfc/core.c:1065
    nci_allocate_device+0xf5/0x180 net/nfc/nci/core.c:1190
    virtual_ncidev_open+0x4a/0x100 drivers/nfc/virtual_ncidev.c:145
    misc_open+0x12a/0x1f0 drivers/char/misc.c:163
    chrdev_open+0x10a/0x310 fs/char_dev.c:414
    do_dentry_open+0x388/0x800 fs/open.c:965
    vfs_open+0x3d/0x1b0 fs/open.c:1097
    do_open fs/namei.c:3975 [inline]
    path_openat+0x11aa/0x1eb0 fs/namei.c:4134
    do_filp_open+0x102/0x1f0 fs/namei.c:4161
    do_sys_openat2+0xc1/0x140 fs/open.c:1437
    do_sys_open fs/open.c:1452 [inline]
    __do_sys_openat fs/open.c:1468 [inline]
    __se_sys_openat fs/open.c:1463 [inline]
    __x64_sys_openat+0xb2/0x100 fs/open.c:1463
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811a178ad8 (size 8):
  comm "syz.0.33", pid 6225, jiffies 4294951961
  hex dump (first 8 bytes):
    6e 66 63 33 00 00 00 00                          nfc3....
  backtrace (crc 45e674f4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __do_kmalloc_node mm/slub.c:5645 [inline]
    __kmalloc_node_track_caller_noprof+0x3aa/0x6b0 mm/slub.c:5755
    kvasprintf+0x70/0xf0 lib/kasprintf.c:25
    kvasprintf_const+0x5c/0x110 lib/kasprintf.c:49
    kobject_set_name_vargs+0x40/0xd0 lib/kobject.c:274
    dev_set_name+0x6d/0x90 drivers/base/core.c:3492
    nfc_allocate_device+0x109/0x1e0 net/nfc/core.c:1075
    nci_allocate_device+0xf5/0x180 net/nfc/nci/core.c:1190
    virtual_ncidev_open+0x4a/0x100 drivers/nfc/virtual_ncidev.c:145
    misc_open+0x12a/0x1f0 drivers/char/misc.c:163
    chrdev_open+0x10a/0x310 fs/char_dev.c:414
    do_dentry_open+0x388/0x800 fs/open.c:965
    vfs_open+0x3d/0x1b0 fs/open.c:1097
    do_open fs/namei.c:3975 [inline]
    path_openat+0x11aa/0x1eb0 fs/namei.c:4134
    do_filp_open+0x102/0x1f0 fs/namei.c:4161
    do_sys_openat2+0xc1/0x140 fs/open.c:1437
    do_sys_open fs/open.c:1452 [inline]
    __do_sys_openat fs/open.c:1468 [inline]
    __se_sys_openat fs/open.c:1463 [inline]
    __x64_sys_openat+0xb2/0x100 fs/open.c:1463

BUG: memory leak
unreferenced object 0xffff88812493d900 (size 256):
  comm "syz.0.33", pid 6225, jiffies 4294951961
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 08 d9 93 24 81 88 ff ff  ...........$....
    08 d9 93 24 81 88 ff ff 00 b3 19 83 ff ff ff ff  ...$............
  backtrace (crc c71a4960):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4979 [inline]
    slab_alloc_node mm/slub.c:5284 [inline]
    __kmalloc_cache_noprof+0x3a6/0x5b0 mm/slub.c:5762
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    device_private_init drivers/base/core.c:3534 [inline]
    device_add+0x72a/0xc80 drivers/base/core.c:3585
    nfc_register_device+0x31/0x150 net/nfc/core.c:1118
    nci_register_device+0x2af/0x340 net/nfc/nci/core.c:1277
    virtual_ncidev_open+0x9f/0x100 drivers/nfc/virtual_ncidev.c:157
    misc_open+0x12a/0x1f0 drivers/char/misc.c:163
    chrdev_open+0x10a/0x310 fs/char_dev.c:414
    do_dentry_open+0x388/0x800 fs/open.c:965
    vfs_open+0x3d/0x1b0 fs/open.c:1097
    do_open fs/namei.c:3975 [inline]
    path_openat+0x11aa/0x1eb0 fs/namei.c:4134
    do_filp_open+0x102/0x1f0 fs/namei.c:4161
    do_sys_openat2+0xc1/0x140 fs/open.c:1437
    do_sys_open fs/open.c:1452 [inline]
    __do_sys_openat fs/open.c:1468 [inline]
    __se_sys_openat fs/open.c:1463 [inline]
    __x64_sys_openat+0xb2/0x100 fs/open.c:1463
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/08 10:45 upstream da32d155f4a8 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in llcp_sock_create
2025/11/08 09:19 upstream da32d155f4a8 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in llcp_sock_create
2025/11/08 06:39 upstream da32d155f4a8 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in llcp_sock_create
2025/11/08 05:29 upstream da32d155f4a8 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in llcp_sock_create
2025/11/08 05:28 upstream da32d155f4a8 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in llcp_sock_create
2025/11/08 05:08 upstream da32d155f4a8 4e1406b4 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in llcp_sock_create
* Struck through repros no longer work on HEAD.