memory leak in nci_send_cmd

Status: upstream: reported C repro on 2026/08/30 12:50
Subsystems: usb nfc net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+b197a0fb4e741cc5030e@syzkaller.appspotmail.com
First crash: 4d08h, last: 4d08h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
338bde93 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in nci_send_cmd 2026/08/26 12:43 2026/08/26 12:43 2026/08/26 13:42 ee98d2fd
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] nfc: nfcmrvl: fix memory leak in nfcmrvl_usb_nci_send() 1 (1) 2026/08/30 18:11
[syzbot] [usb?] [nfc?] [net?] memory leak in nci_send_cmd 1 (3) 2026/08/30 17:10
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/08/30 16:24 27m pavankumaryalagada@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 73ae59e975966d24e32926247ddb45a537ebe184 OK job log log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88810a94e600 (size 240):
  comm "syz.6.23", pid 5954, jiffies 4294942380
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 40 38 2b 81 88 ff ff 00 00 00 00 00 00 00 00  .@8+............
  backtrace (crc 98a4d7):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    kmem_cache_alloc_node_noprof+0x39f/0x440 mm/slub.c:5068
    __alloc_skb+0xdc/0x4e0 net/core/skbuff.c:704
    alloc_skb include/linux/skbuff.h:1384 [inline]
    nci_skb_alloc include/net/nfc/nci_core.h:330 [inline]
    nci_send_cmd+0x46/0x110 net/nfc/nci/core.c:1397
    nci_reset_req net/nfc/nci/core.c:167 [inline]
    __nci_request net/nfc/nci/core.c:108 [inline]
    nci_open_device net/nfc/nci/core.c:503 [inline]
    nci_dev_up+0x1b6/0x690 net/nfc/nci/core.c:643
    nfc_dev_up+0xca/0x160 net/nfc/core.c:118
    nfc_genl_dev_up+0x3d/0x70 net/nfc/netlink.c:775
    genl_family_rcv_msg_doit+0x12e/0x1a0 net/netlink/genetlink.c:1114
    genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
    genl_rcv_msg+0x302/0x440 net/netlink/genetlink.c:1209
    netlink_rcv_skb+0x89/0x1c0 net/netlink/af_netlink.c:2556
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
    netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
    netlink_unicast+0x38f/0x4e0 net/netlink/af_netlink.c:1345
    netlink_sendmsg+0x335/0x690 net/netlink/af_netlink.c:1900
    sock_sendmsg_nosec net/socket.c:800 [inline]
    __sock_sendmsg net/socket.c:815 [inline]
    ____sys_sendmsg+0x54a/0x580 net/socket.c:2713
    ___sys_sendmsg+0x101/0x140 net/socket.c:2767
    __sys_sendmsg+0xcd/0x140 net/socket.c:2799
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84

BUG: memory leak
unreferenced object 0xffff888109c4bc80 (size 704):
  comm "syz.6.23", pid 5954, jiffies 4294942380
  hex dump (first 32 bytes):
    20 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00   ...............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 40ddf9):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    kmem_cache_alloc_node_noprof+0x39f/0x440 mm/slub.c:5068
    kmalloc_reserve+0xd2/0x1b0 net/core/skbuff.c:615
    __alloc_skb+0x15d/0x4e0 net/core/skbuff.c:715
    alloc_skb include/linux/skbuff.h:1384 [inline]
    nci_skb_alloc include/net/nfc/nci_core.h:330 [inline]
    nci_send_cmd+0x46/0x110 net/nfc/nci/core.c:1397
    nci_reset_req net/nfc/nci/core.c:167 [inline]
    __nci_request net/nfc/nci/core.c:108 [inline]
    nci_open_device net/nfc/nci/core.c:503 [inline]
    nci_dev_up+0x1b6/0x690 net/nfc/nci/core.c:643
    nfc_dev_up+0xca/0x160 net/nfc/core.c:118
    nfc_genl_dev_up+0x3d/0x70 net/nfc/netlink.c:775
    genl_family_rcv_msg_doit+0x12e/0x1a0 net/netlink/genetlink.c:1114
    genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
    genl_rcv_msg+0x302/0x440 net/netlink/genetlink.c:1209
    netlink_rcv_skb+0x89/0x1c0 net/netlink/af_netlink.c:2556
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
    netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
    netlink_unicast+0x38f/0x4e0 net/netlink/af_netlink.c:1345
    netlink_sendmsg+0x335/0x690 net/netlink/af_netlink.c:1900
    sock_sendmsg_nosec net/socket.c:800 [inline]
    __sock_sendmsg net/socket.c:815 [inline]
    ____sys_sendmsg+0x54a/0x580 net/socket.c:2713
    ___sys_sendmsg+0x101/0x140 net/socket.c:2767
    __sys_sendmsg+0xcd/0x140 net/socket.c:2799

BUG: memory leak
unreferenced object 0xffff88810aa0d700 (size 240):
  comm "syz.0.26", pid 5976, jiffies 4294942681
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 a0 5b 28 81 88 ff ff 00 00 00 00 00 00 00 00  ..[(............
  backtrace (crc cdb4723c):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4696 [inline]
    slab_alloc_node mm/slub.c:4996 [inline]
    kmem_cache_alloc_node_noprof+0x39f/0x440 mm/slub.c:5068
    __alloc_skb+0xdc/0x4e0 net/core/skbuff.c:704
    alloc_skb include/linux/skbuff.h:1384 [inline]
    nci_skb_alloc include/net/nfc/nci_core.h:330 [inline]
    nci_send_cmd+0x46/0x110 net/nfc/nci/core.c:1397
    nci_reset_req net/nfc/nci/core.c:167 [inline]
    __nci_request net/nfc/nci/core.c:108 [inline]
    nci_open_device net/nfc/nci/core.c:503 [inline]
    nci_dev_up+0x1b6/0x690 net/nfc/nci/core.c:643
    nfc_dev_up+0xca/0x160 net/nfc/core.c:118
    nfc_genl_dev_up+0x3d/0x70 net/nfc/netlink.c:775
    genl_family_rcv_msg_doit+0x12e/0x1a0 net/netlink/genetlink.c:1114
    genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
    genl_rcv_msg+0x302/0x440 net/netlink/genetlink.c:1209
    netlink_rcv_skb+0x89/0x1c0 net/netlink/af_netlink.c:2556
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
    netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
    netlink_unicast+0x38f/0x4e0 net/netlink/af_netlink.c:1345
    netlink_sendmsg+0x335/0x690 net/netlink/af_netlink.c:1900
    sock_sendmsg_nosec net/socket.c:800 [inline]
    __sock_sendmsg net/socket.c:815 [inline]
    ____sys_sendmsg+0x54a/0x580 net/socket.c:2713
    ___sys_sendmsg+0x101/0x140 net/socket.c:2767
    __sys_sendmsg+0xcd/0x140 net/socket.c:2799
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/26 12:45 upstream 73ae59e97596 6a91adb4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
2026/08/26 12:42 upstream 73ae59e97596 6a91adb4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in nci_send_cmd
* Struck through repros no longer work on HEAD.