memory leak in __sock_create

Status: closed as invalid on 2026/08/19 14:30
Subsystems: net
Labels: prio:high
[Documentation on labels]
First crash: 106d, last: 73d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
886ecde4 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in __sock_create 2026/05/24 04:29 2026/05/24 04:29 2026/05/24 05:12 c69befb3
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2026/08/19 13:02 1h10m edumazet@google.com upstream no crash job log log
2026/08/06 04:21 36m retest repro upstream no crash log
2026/06/12 13:22 29m edumazet@google.com upstream report log
2026/05/25 11:05 1h42m retest repro upstream report log
2026/05/25 11:05 1h44m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888111df2080 (size 768):
  comm "syz.6.23", pid 6091, jiffies 4294942811
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 248be118):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    kmem_cache_alloc_lru_noprof+0x377/0x490 mm/slub.c:4917
    sock_alloc_inode+0x25/0xb0 net/socket.c:328
    alloc_inode+0x2e/0x120 fs/inode.c:345
    new_inode_pseudo include/linux/fs.h:3015 [inline]
    sock_alloc+0x1b/0x90 net/socket.c:697
    __sock_create+0xc2/0x2d0 net/socket.c:1628
    sock_create net/socket.c:1722 [inline]
    __sys_socket_create net/socket.c:1759 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1806
    __do_sys_socket net/socket.c:1820 [inline]
    __se_sys_socket net/socket.c:1818 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1818
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812cc38f50 (size 80):
  comm "syz.6.23", pid 6091, jiffies 4294942811
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 494f173f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    kmem_cache_alloc_noprof+0x36c/0x480 mm/slub.c:4905
    lsm_inode_alloc security/security.c:254 [inline]
    security_inode_alloc+0x37/0x260 security/security.c:1215
    inode_init_always_gfp+0x248/0x290 fs/inode.c:305
    inode_init_always include/linux/fs.h:2936 [inline]
    alloc_inode+0x50/0x120 fs/inode.c:352
    new_inode_pseudo include/linux/fs.h:3015 [inline]
    sock_alloc+0x1b/0x90 net/socket.c:697
    __sock_create+0xc2/0x2d0 net/socket.c:1628
    sock_create net/socket.c:1722 [inline]
    __sys_socket_create net/socket.c:1759 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1806
    __do_sys_socket net/socket.c:1820 [inline]
    __se_sys_socket net/socket.c:1818 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1818
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888128868000 (size 2048):
  comm "syz.6.23", pid 6091, jiffies 4294942811
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    10 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace (crc a8fcf002):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    __do_kmalloc_node mm/slub.c:5294 [inline]
    __kmalloc_noprof+0x3b7/0x550 mm/slub.c:5307
    kmalloc_noprof include/linux/slab.h:954 [inline]
    sk_prot_alloc+0xf9/0x1b0 net/core/sock.c:2247
    sk_alloc+0x36/0x3d0 net/core/sock.c:2303
    __netlink_create+0x3b/0xb0 net/netlink/af_netlink.c:626
    netlink_create+0x1c5/0x2f0 net/netlink/af_netlink.c:684
    __sock_create+0x1a9/0x2d0 net/socket.c:1664
    sock_create net/socket.c:1722 [inline]
    __sys_socket_create net/socket.c:1759 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1806
    __do_sys_socket net/socket.c:1820 [inline]
    __se_sys_socket net/socket.c:1818 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1818
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812cd10300 (size 32):
  comm "syz.6.23", pid 6091, jiffies 4294942811
  hex dump (first 32 bytes):
    f8 56 0a 00 81 88 ff ff 00 00 00 00 00 00 00 00  .V..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 79381f4a):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    __do_kmalloc_node mm/slub.c:5294 [inline]
    __kmalloc_noprof+0x3b7/0x550 mm/slub.c:5307
    kmalloc_noprof include/linux/slab.h:954 [inline]
    kzalloc_noprof include/linux/slab.h:1188 [inline]
    lsm_blob_alloc+0x4d/0x80 security/security.c:218
    lsm_sock_alloc security/security.c:4478 [inline]
    security_sk_alloc+0x2d/0x290 security/security.c:4494
    sk_prot_alloc+0x114/0x1b0 net/core/sock.c:2250
    sk_alloc+0x36/0x3d0 net/core/sock.c:2303
    __netlink_create+0x3b/0xb0 net/netlink/af_netlink.c:626
    netlink_create+0x1c5/0x2f0 net/netlink/af_netlink.c:684
    __sock_create+0x1a9/0x2d0 net/socket.c:1664
    sock_create net/socket.c:1722 [inline]
    __sys_socket_create net/socket.c:1759 [inline]
    __sys_socket+0xb7/0x1a0 net/socket.c:1806
    __do_sys_socket net/socket.c:1820 [inline]
    __se_sys_socket net/socket.c:1818 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1818
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881284ee480 (size 192):
  comm "syz.6.23", pid 6091, jiffies 4294942811
  hex dump (first 32 bytes):
    00 00 28 04 02 00 00 00 00 00 00 00 00 00 00 00  ..(.............
    00 00 00 00 00 00 00 00 80 e4 4e 28 81 88 ff ff  ..........N(....
  backtrace (crc 3fa8f3d4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    kmem_cache_alloc_lru_noprof+0x377/0x490 mm/slub.c:4917
    __d_alloc+0x34/0x2d0 fs/dcache.c:1807
    d_alloc_pseudo+0x1c/0x70 fs/dcache.c:1938
    alloc_path_pseudo fs/file_table.c:405 [inline]
    alloc_file_pseudo+0x69/0x140 fs/file_table.c:421
    sock_alloc_file+0x50/0x110 net/socket.c:543
    sock_map_fd net/socket.c:573 [inline]
    __sys_socket+0x129/0x1a0 net/socket.c:1815
    __do_sys_socket net/socket.c:1820 [inline]
    __se_sys_socket net/socket.c:1818 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1818
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810dfa0e40 (size 176):
  comm "syz.6.23", pid 6091, jiffies 4294942811
  hex dump (first 32 bytes):
    00 00 00 00 03 00 2e 0c 60 d2 bc 85 ff ff ff ff  ........`.......
    a8 22 df 11 81 88 ff ff c0 20 df 11 81 88 ff ff  ."....... ......
  backtrace (crc ea5b93be):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    kmem_cache_alloc_noprof+0x36c/0x480 mm/slub.c:4905
    alloc_empty_file+0x57/0x180 fs/file_table.c:262
    alloc_file fs/file_table.c:396 [inline]
    alloc_file_pseudo+0xac/0x140 fs/file_table.c:425
    sock_alloc_file+0x50/0x110 net/socket.c:543
    sock_map_fd net/socket.c:573 [inline]
    __sys_socket+0x129/0x1a0 net/socket.c:1815
    __do_sys_socket net/socket.c:1820 [inline]
    __se_sys_socket net/socket.c:1818 [inline]
    __x64_sys_socket+0x1b/0x30 net/socket.c:1818
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/11 07:40 upstream aa54b1d27fe0 29233ece .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __sock_create
2026/05/11 06:22 upstream aa54b1d27fe0 29233ece .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __sock_create
* Struck through repros no longer work on HEAD.