memory leak in ldisc_receive

Status: auto-obsoleted due to no activity on 2026/07/17 01:08
Subsystems: usb net
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+f9d847b2b84164fa69f3@syzkaller.appspotmail.com
First crash: 194d, last: 110d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
bef7d78e assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in ldisc_receive 2026/05/17 23:08 2026/05/17 23:08 2026/05/17 23:17 de5aae85 

			
				
	

	
	



			

		

	

	
	

		

			▶
			▼
			Discussions (3)
		

		

			
			
			



	
	

		Title
		Replies (including bot)
		Last reply
	

	
	
	
		

			[PATCH v2] net: caif: fix memory leak in ldisc_receive
			6 (6)
			2026/01/24 19:10
		

	
		

			[PATCH] net: caif: fix memory leak in ldisc_receive
			3 (3)
			2026/01/18 17:35
		

	
		

			[syzbot] [net?] [input?] [usb?] memory leak in ldisc_receive
			0 (1)
			2026/01/17 17:34
		

	
	




			
			
		

	

	
	

		

			▶
			▼
			Last patch testing requests (8)
		

		

			
			

	

		
		
		

			
			Created
			Duration
			User
			Patch
			Repo
			
			Result
		

		
		
		
			

				
				2026/06/19 11:48
				
					1h12m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						OK
						
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/05/26 20:46
				
					2h47m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						OK
						
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/04/07 23:36
				
					1h31m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						report
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/04/07 23:16
				
					1h43m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						report
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/03/17 12:25
				
					12m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						report
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/03/17 12:14
				
					12m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						report
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/01/27 17:26
				
					5h31m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						report
					
					
					
						log
					
					
					
				
			

		
			

				
				2026/01/27 17:24
				
					5h24m
				
				
					
						retest repro
					
				
				
				upstream
				
				
					
						report
					
					
					
						log
					
					
					
				
			

		
		
	



			
			
			
		

	

	

	
	
Sample crash report:

	
BUG: memory leak
unreferenced object 0xffff88810acab700 (size 240):
  comm "syz.0.17", pid 6116, jiffies 4294943616
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 60 51 0a 81 88 ff ff 00 00 00 00 00 00 00 00  .`Q.............
  backtrace (crc 61c6ec4b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    __alloc_skb+0xdc/0x470 net/core/skbuff.c:702
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881097ff9c0 (size 704):
  comm "syz.0.17", pid 6116, jiffies 4294943616
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 7d4f196):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    kmalloc_reserve+0xd2/0x1b0 net/core/skbuff.c:613
    __alloc_skb+0x15d/0x470 net/core/skbuff.c:713
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810acab200 (size 240):
  comm "syz.5.34", pid 6364, jiffies 4294944702
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 90 9e 2a 81 88 ff ff 00 00 00 00 00 00 00 00  ...*............
  backtrace (crc 9b48f2fe):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    __alloc_skb+0xdc/0x470 net/core/skbuff.c:702
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810be01b80 (size 704):
  comm "syz.5.34", pid 6364, jiffies 4294944702
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 54ce43f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    kmalloc_reserve+0xd2/0x1b0 net/core/skbuff.c:613
    __alloc_skb+0x15d/0x470 net/core/skbuff.c:713
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF



	

	



	Crashes (2):
		
		

			Time
			Kernel
			Commit
			Syzkaller
			Config
			Log
			Report
			Syz repro
			C repro
			VM info
			Assets (help?)
			Manager
			Title
		

		
		
		
		

			2026/03/03 10:31
			upstream
			af4e9ef3d784
			28b83e23
			.config
			console log
			report
			syz / log
			C
			
			
				[disk image]
			
				[vmlinux]
			
				[kernel image]
			
			ci-upstream-gce-leak
			memory leak in ldisc_receive
		

		
		

			2026/01/13 17:23
			upstream
			b71e635feefc
			d6526ea3
			.config
			console log
			report
			syz / log
			C
			
			
				[disk image]
			
				[vmlinux]
			
				[kernel image]
			
			ci-upstream-gce-leak
			memory leak in ldisc_receive
		

		
		


* Struck through repros no longer work on HEAD.