syzbot


memory leak in ldisc_receive

Status: upstream: reported C repro on 2026/01/17 17:34
Subsystems: net input usb
[Documentation on labels]
Reported-by: syzbot+f9d847b2b84164fa69f3@syzkaller.appspotmail.com
First crash: 55d, last: 6d19h
Discussions (3)
Title Replies (including bot) Last reply
[PATCH v2] net: caif: fix memory leak in ldisc_receive 6 (6) 2026/01/24 19:10
[PATCH] net: caif: fix memory leak in ldisc_receive 3 (3) 2026/01/18 17:35
[syzbot] [net?] [input?] [usb?] memory leak in ldisc_receive 0 (1) 2026/01/17 17:34
Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/01/27 17:26 5h31m retest repro upstream report log
2026/01/27 17:24 5h24m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810acab700 (size 240):
  comm "syz.0.17", pid 6116, jiffies 4294943616
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 60 51 0a 81 88 ff ff 00 00 00 00 00 00 00 00  .`Q.............
  backtrace (crc 61c6ec4b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    __alloc_skb+0xdc/0x470 net/core/skbuff.c:702
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881097ff9c0 (size 704):
  comm "syz.0.17", pid 6116, jiffies 4294943616
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 7d4f196):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    kmalloc_reserve+0xd2/0x1b0 net/core/skbuff.c:613
    __alloc_skb+0x15d/0x470 net/core/skbuff.c:713
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810acab200 (size 240):
  comm "syz.5.34", pid 6364, jiffies 4294944702
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 90 9e 2a 81 88 ff ff 00 00 00 00 00 00 00 00  ...*............
  backtrace (crc 9b48f2fe):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    __alloc_skb+0xdc/0x470 net/core/skbuff.c:702
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810be01b80 (size 704):
  comm "syz.5.34", pid 6364, jiffies 4294944702
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 54ce43f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4520 [inline]
    slab_alloc_node mm/slub.c:4844 [inline]
    kmem_cache_alloc_node_noprof+0x373/0x4d0 mm/slub.c:4896
    kmalloc_reserve+0xd2/0x1b0 net/core/skbuff.c:613
    __alloc_skb+0x15d/0x470 net/core/skbuff.c:713
    __netdev_alloc_skb+0x6e/0x260 net/core/skbuff.c:775
    netdev_alloc_skb include/linux/skbuff.h:3485 [inline]
    ldisc_receive+0x7a/0x1e0 drivers/net/caif/caif_serial.c:176
    tiocsti drivers/tty/tty_io.c:2290 [inline]
    tty_ioctl+0x57a/0xda0 drivers/tty/tty_io.c:2706
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/03 10:31 upstream af4e9ef3d784 28b83e23 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in ldisc_receive
2026/01/13 17:23 upstream b71e635feefc d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in ldisc_receive
* Struck through repros no longer work on HEAD.