memory leak in percpu_ref_init

Status: fixed on 2026/05/06 16:40
Subsystems: nfs
[Documentation on labels]
Reported-by: syzbot+6ee3b889bdeada0a6226@syzkaller.appspotmail.com
Fix commit: 0b88bfa42e54 NFSD: net ref data still needs to be freed even if net hasn't startup
First crash: 227d, last: 213d
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH 6.12] NFSD: net ref data still needs to be freed even if net hasn't startup 2 (2) 2026/01/12 21:06
[PATCH] NFSD: net ref data still needs to be freed even if net hasn't startup 2 (2) 2025/12/16 16:02
[syzbot] [nfs?] memory leak in percpu_ref_init 0 (3) 2025/12/16 10:22
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2025/12/26 07:24 20m retest repro upstream report log
2025/12/16 10:22 23m kartikey406@gmail.com patch upstream OK log
2025/12/16 08:02 14m kartikey406@gmail.com patch upstream report log

Sample crash report:
BUG: memory leak
unreferenced object (percpu) 0x607e4d6bd360 (size 8):
  comm "syz.0.17", pid 6093, jiffies 4294942369
  hex dump (first 8 bytes on cpu 0):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    pcpu_alloc_noprof+0x82c/0xd60 mm/percpu.c:1890
    percpu_ref_init+0x36/0x1e0 lib/percpu-refcount.c:72
    nfsd_create_serv+0xbe/0x260 fs/nfsd/nfssvc.c:605
    nfsd_nl_listener_set_doit+0x62/0xb00 fs/nfsd/nfsctl.c:1882
    genl_family_rcv_msg_doit+0x11e/0x190 net/netlink/genetlink.c:1115
    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
    genl_rcv_msg+0x2fd/0x440 net/netlink/genetlink.c:1210
    netlink_rcv_skb+0x93/0x1d0 net/netlink/af_netlink.c:2550
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
    netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
    netlink_unicast+0x3a3/0x4f0 net/netlink/af_netlink.c:1344
    netlink_sendmsg+0x335/0x6b0 net/netlink/af_netlink.c:1894
    sock_sendmsg_nosec net/socket.c:727 [inline]
    __sock_sendmsg net/socket.c:742 [inline]
    ____sys_sendmsg+0x562/0x5a0 net/socket.c:2592
    ___sys_sendmsg+0xc8/0x130 net/socket.c:2646
    __sys_sendmsg+0xc7/0x140 net/socket.c:2678
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812a39dfc0 (size 64):
  comm "syz.0.17", pid 6093, jiffies 4294942369
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 80 80 59 d7 81 ff ff ff ff  .........Y......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a2262fc6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    percpu_ref_init+0x94/0x1e0 lib/percpu-refcount.c:76
    nfsd_create_serv+0xbe/0x260 fs/nfsd/nfssvc.c:605
    nfsd_nl_listener_set_doit+0x62/0xb00 fs/nfsd/nfsctl.c:1882
    genl_family_rcv_msg_doit+0x11e/0x190 net/netlink/genetlink.c:1115
    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
    genl_rcv_msg+0x2fd/0x440 net/netlink/genetlink.c:1210
    netlink_rcv_skb+0x93/0x1d0 net/netlink/af_netlink.c:2550
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
    netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
    netlink_unicast+0x3a3/0x4f0 net/netlink/af_netlink.c:1344
    netlink_sendmsg+0x335/0x6b0 net/netlink/af_netlink.c:1894
    sock_sendmsg_nosec net/socket.c:727 [inline]
    __sock_sendmsg net/socket.c:742 [inline]
    ____sys_sendmsg+0x562/0x5a0 net/socket.c:2592
    ___sys_sendmsg+0xc8/0x130 net/socket.c:2646
    __sys_sendmsg+0xc7/0x140 net/socket.c:2678
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object (percpu) 0x607e4d6bd368 (size 8):
  comm "syz.0.18", pid 6095, jiffies 4294942370
  hex dump (first 8 bytes on cpu 0):
    00 00 00 00 00 00 00 00                          ........
  backtrace (crc 0):
    pcpu_alloc_noprof+0x82c/0xd60 mm/percpu.c:1890
    percpu_ref_init+0x36/0x1e0 lib/percpu-refcount.c:72
    nfsd_create_serv+0xbe/0x260 fs/nfsd/nfssvc.c:605
    nfsd_nl_listener_set_doit+0x62/0xb00 fs/nfsd/nfsctl.c:1882
    genl_family_rcv_msg_doit+0x11e/0x190 net/netlink/genetlink.c:1115
    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
    genl_rcv_msg+0x2fd/0x440 net/netlink/genetlink.c:1210
    netlink_rcv_skb+0x93/0x1d0 net/netlink/af_netlink.c:2550
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
    netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
    netlink_unicast+0x3a3/0x4f0 net/netlink/af_netlink.c:1344
    netlink_sendmsg+0x335/0x6b0 net/netlink/af_netlink.c:1894
    sock_sendmsg_nosec net/socket.c:727 [inline]
    __sock_sendmsg net/socket.c:742 [inline]
    ____sys_sendmsg+0x562/0x5a0 net/socket.c:2592
    ___sys_sendmsg+0xc8/0x130 net/socket.c:2646
    __sys_sendmsg+0xc7/0x140 net/socket.c:2678
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812833c840 (size 64):
  comm "syz.0.18", pid 6095, jiffies 4294942370
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 80 80 59 d7 81 ff ff ff ff  .........Y......
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc a2262fc6):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    percpu_ref_init+0x94/0x1e0 lib/percpu-refcount.c:76
    nfsd_create_serv+0xbe/0x260 fs/nfsd/nfssvc.c:605
    nfsd_nl_listener_set_doit+0x62/0xb00 fs/nfsd/nfsctl.c:1882
    genl_family_rcv_msg_doit+0x11e/0x190 net/netlink/genetlink.c:1115
    genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
    genl_rcv_msg+0x2fd/0x440 net/netlink/genetlink.c:1210
    netlink_rcv_skb+0x93/0x1d0 net/netlink/af_netlink.c:2550
    genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
    netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
    netlink_unicast+0x3a3/0x4f0 net/netlink/af_netlink.c:1344
    netlink_sendmsg+0x335/0x6b0 net/netlink/af_netlink.c:1894
    sock_sendmsg_nosec net/socket.c:727 [inline]
    __sock_sendmsg net/socket.c:742 [inline]
    ____sys_sendmsg+0x562/0x5a0 net/socket.c:2592
    ___sys_sendmsg+0xc8/0x130 net/socket.c:2646
    __sys_sendmsg+0xc7/0x140 net/socket.c:2678
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: read tcp 127.0.0.1:36571->127.0.0.1:45172: read: connection reset by peer

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/12 07:22 upstream d358e5254674 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in percpu_ref_init
* Struck through repros no longer work on HEAD.