memory leak in j1939_netdev_start (2)

Status: upstream: reported C repro on 2026/08/22 00:10
Subsystems: can
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+489e907b2a026a6f5fa0@syzkaller.appspotmail.com
First crash: 66d, last: 2d01h
▶ ▼ ✨ AI Patch Versions (2)
Version Stage Reported Report Link Job
1 upstream 2026/09/01 07:04 Discussion c118979e-3d39-430b-b07e-608d26aeaa70
1 moderation 2026/08/27 00:17 Discussion c118979e-3d39-430b-b07e-608d26aeaa70
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
c118979e patching ✅ memory leak in j1939_netdev_start (2) 2026/08/26 18:30 2026/08/26 22:35 2026/08/27 00:17 a2b77b9e
ea616980 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in j1939_netdev_start (2) 2026/08/17 23:28 2026/08/17 23:28 2026/08/18 00:09 1e72964b
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [can?] memory leak in j1939_netdev_start (2) 0 (5) 2026/10/02 08:45
[PATCH] can: j1939: fix memory leaks caused by pending address claim timer 1 (1) 2026/09/01 07:05
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in j1939_netdev_start can 3 syz, C 2 292d 1063d 0/29 auto-obsoleted due to no activity on 2026/04/14 08:53
▶ ▼ Last patch testing requests (8)
Created Duration User Patch Repo Result
2026/10/16 07:38 14m retest repro upstream report job log log
2026/10/16 07:38 16m retest repro upstream report job log log
2026/10/02 08:44 24m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git ce1e0223d8ad4211275c82a17ed6d43ab81e13d9 OK job log log
2026/09/20 10:43 0m retest repro upstream error job log
2026/09/20 10:43 1m retest repro upstream error job log
2026/08/27 17:02 5h07m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73e3f0710014fe6d4ed98cfc02292f6121db7558 OK job log log
2026/08/27 05:33 1h25m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73e3f0710014fe6d4ed98cfc02292f6121db7558 OK job log log
2026/08/24 14:19 19m dmantipov@yandex.ru patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 0a0d1d55dad570724bf8c7ea83409639cfb4be9b OK job log log

Sample crash report:
2026/10/21 21:28:13 executed programs: 15
2026/10/21 21:28:19 executed programs: 17
BUG: memory leak
unreferenced object 0xffff888122ae2000 (size 8192):
  comm "syz.0.25", pid 6005, jiffies 4294948679
  hex dump (first 32 bytes):
    40 a2 25 0a 81 88 ff ff 40 a2 25 0a 81 88 ff ff  @.%.....@.%.....
    00 00 00 00 00 00 00 00 00 80 5c 19 81 88 ff ff  ..........\.....
  backtrace (crc 61ec8c53):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x35f/0x3f0 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a25a240 (size 192):
  comm "syz.0.25", pid 6005, jiffies 4294948679
  hex dump (first 32 bytes):
    00 20 ae 22 81 88 ff ff 00 20 ae 22 81 88 ff ff  . ."..... ."....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc df484a3b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x35f/0x3f0 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888122ae6000 (size 8192):
  comm "syz.0.27", pid 6007, jiffies 4294949281
  hex dump (first 32 bytes):
    00 4f 7f 11 81 88 ff ff 00 4f 7f 11 81 88 ff ff  .O.......O......
    00 00 00 00 00 00 00 00 00 80 5c 19 81 88 ff ff  ..........\.....
  backtrace (crc 75b1d009):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x35f/0x3f0 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x168/0x710 net/can/j1939/main.c:268
    j1939_sk_bind+0x223/0x5a0 net/can/j1939/socket.c:506
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881117f4f00 (size 192):
  comm "syz.0.27", pid 6007, jiffies 4294949281
  hex dump (first 32 bytes):
    00 60 ae 22 81 88 ff ff 00 60 ae 22 81 88 ff ff  .`.".....`."....
    08 07 06 05 04 03 02 01 20 00 00 00 00 00 00 00  ........ .......
  backtrace (crc 97f82afe):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    __kmalloc_cache_noprof+0x35f/0x3f0 mm/slub.c:5559
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    j1939_ecu_create_locked+0x5c/0x200 net/can/j1939/bus.c:155
    j1939_local_ecu_get+0x102/0x140 net/can/j1939/bus.c:293
    j1939_sk_bind+0x38c/0x5a0 net/can/j1939/socket.c:529
    __sys_bind_socket net/socket.c:1945 [inline]
    __sys_bind_socket net/socket.c:1937 [inline]
    __sys_bind+0x131/0x160 net/socket.c:1976
    __do_sys_bind net/socket.c:1981 [inline]
    __se_sys_bind net/socket.c:1979 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1979
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/21 21:28 upstream 9e947d96915a 61c200c7 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/09/29 08:26 upstream 72d3fcf802c4 7bf4ea23 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/09/28 04:15 upstream efb44d93a620 a3c7249d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/08/17 23:28 upstream 8d3ae59288f1 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
2026/08/24 19:17 upstream 0a0d1d55dad5 23caa175 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
* Struck through repros no longer work on HEAD.