syzbot


memory leak in skb_clone (3)

Status: upstream: reported C repro on 2026/01/07 17:34
Subsystems: bluetooth batman
[Documentation on labels]
Reported-by: syzbot+6e76aa21aaf2d8be6034@syzkaller.appspotmail.com
Fix commit: 21e4271e6509 Bluetooth: purge error queues in socket destructors
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64 ci-upstream-gce-arm64]
First crash: 133d, last: 23d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [batman?] [bluetooth?] memory leak in skb_clone (3) 0 (7) 2026/03/09 15:05
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in skb_clone wpan 3 C 2 1700d 1805d 20/29 fixed on 2021/11/10 00:50
upstream memory leak in skb_clone (2) batman 3 syz 2 880d 935d 0/29 auto-obsoleted due to no activity on 2024/01/29 21:56
Last patch testing requests (12)
Created Duration User Patch Repo Result
2026/03/09 14:06 19m halves@igalia.com git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 21e4271e65094172aadd5beb8caea95dd0fbf6d7 OK log
2026/02/25 12:54 22m halves@igalia.com git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git master OK log
2026/02/25 11:54 14m retest repro upstream report log
2026/02/25 11:54 18m retest repro upstream report log
2026/01/30 23:09 2h26m retest repro upstream report log
2026/01/09 01:53 1h03m kartikey406@gmail.com patch upstream report log
2026/01/08 08:56 15m kartikey406@gmail.com patch upstream error
2026/01/08 08:31 18m kartikey406@gmail.com patch upstream error
2025/12/17 01:23 24m retest repro upstream report log
2025/12/17 01:23 24m retest repro upstream report log
2025/12/11 18:48 17m edumazet@google.com patch upstream report log
2025/11/21 22:16 17m retest repro upstream report log

Sample crash report:
2025/12/03 00:25:54 executed programs: 5
BUG: memory leak
unreferenced object 0xffff88811a1e1100 (size 240):
  comm "kworker/u9:0", pid 51, jiffies 4294944590
  hex dump (first 32 bytes):
    90 50 50 42 81 88 ff ff 90 50 50 42 81 88 ff ff  .PPB.....PPB....
    00 00 00 00 00 00 00 00 00 50 50 42 81 88 ff ff  .........PPB....
  backtrace (crc eed28d2d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    slab_alloc_node mm/slub.c:5288 [inline]
    kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
    skb_clone+0xae/0x2b0 net/core/skbuff.c:2050
    __skb_tstamp_tx+0x3a0/0x4c0 net/core/skbuff.c:5636
    hci_conn_tx_queue+0x11c/0x1d0 net/bluetooth/hci_conn.c:3026
    hci_send_conn_frame net/bluetooth/hci_core.c:3086 [inline]
    hci_sched_acl_pkt net/bluetooth/hci_core.c:3701 [inline]
    hci_sched_acl net/bluetooth/hci_core.c:3726 [inline]
    hci_tx_work+0x437/0x570 net/bluetooth/hci_core.c:3820
    process_one_work+0x26b/0x620 kernel/workqueue.c:3263
    process_scheduled_works kernel/workqueue.c:3346 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3427
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x2af/0x2e0 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/03 00:26 upstream 4a26e7032d7d d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in skb_clone
2025/12/02 18:17 upstream 4a26e7032d7d d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in skb_clone
2025/11/07 17:01 upstream 4a0c9b339199 4e1406b4 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in skb_clone
* Struck through repros no longer work on HEAD.