syzbot

 sign-in | mailing list | source | docs
🐞 Open [1443]
≡ Subsystems
🐞 Fixed [6891]
🐞 Invalid [17907]
⬇ Missing Backports [224]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in v4l2_ctrl_handler_init_class (2)

Status: upstream: reported C repro on 2025/11/25 07:55
Subsystems: usb media
[Documentation on labels]
Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com
Fix commit: media: radio-keene: fix memory leak in error path
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 69d, last: 18h19m
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH v3] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/29 10:01
[PATCH] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/27 16:56
[PATCH v2] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/26 17:46
[syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (2) 3 (7) 2025/11/25 21:29
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in v4l2_ctrl_handler_init_class usb media 3 C 12 1746d 1799d 20/29 fixed on 2021/11/10 00:50
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/12/09 21:58 19m retest repro upstream report log
2025/12/09 21:58 14m retest repro upstream report log
2025/11/25 20:21 20m ssranevjti@gmail.com patch upstream OK log
2025/11/25 17:03 31m ssranevjti@gmail.com patch upstream OK log
2025/11/25 17:01 16m ssranevjti@gmail.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff8881273ec430 (size 8):
  comm "kworker/1:4", pid 5849, jiffies 4294944693
  hex dump (first 8 bytes):
    40 53 08 11 81 88 ff ff                          @S......
  backtrace (crc 8e968401):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x5ce/0x830 mm/slub.c:7140
    kvmalloc_array_node_noprof include/linux/slab.h:1122 [inline]
    v4l2_ctrl_handler_init_class+0x59/0x90 drivers/media/v4l2-core/v4l2-ctrls-core.c:1706
    msi2500_probe+0x2a9/0x390 drivers/media/usb/msi2500/msi2500.c:1248
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
    usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:291

BUG: memory leak
unreferenced object 0xffff88810e1df300 (size 8):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 8 bytes):
    40 9a 27 11 81 88 ff ff                          @.'.....
  backtrace (crc 21e9e9ba):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x5ce/0x830 mm/slub.c:7140
    kvmalloc_array_node_noprof include/linux/slab.h:1122 [inline]
    v4l2_ctrl_handler_init_class+0x59/0x90 drivers/media/v4l2-core/v4l2-ctrls-core.c:1706
    msi2500_probe+0x2a9/0x390 drivers/media/usb/msi2500/msi2500.c:1248
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
    usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:291

BUG: memory leak
unreferenced object 0xffff888125d52900 (size 256):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 32 bytes):
    58 47 1e 12 81 88 ff ff 58 47 1e 12 81 88 ff ff  XG......XG......
    10 29 d5 25 81 88 ff ff 10 29 d5 25 81 88 ff ff  .).%.....).%....
  backtrace (crc f2f792d8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x5ce/0x830 mm/slub.c:7140
    v4l2_ctrl_new+0x2bb/0x1410 drivers/media/v4l2-core/v4l2-ctrls-core.c:2112
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1853
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2416 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2390
    msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689

BUG: memory leak
unreferenced object 0xffff888111279440 (size 64):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 32 bytes):
    00 94 27 11 81 88 ff ff 68 47 1e 12 81 88 ff ff  ..'.....hG......
    00 00 00 00 00 00 00 00 00 29 d5 25 81 88 ff ff  .........).%....
  backtrace (crc 4f2ef138):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x465/0x680 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1861
    v4l2_ctrl_new+0x69e/0x1410 drivers/media/v4l2-core/v4l2-ctrls-core.c:2195
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1853
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2416 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2390
    msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574

BUG: memory leak
unreferenced object 0xffff888111279400 (size 64):
  comm "kworker/0:0", pid 9, jiffies 4294944810
  hex dump (first 32 bytes):
    80 95 27 11 81 88 ff ff 40 94 27 11 81 88 ff ff  ..'.....@.'.....
    40 94 27 11 81 88 ff ff 00 ca 19 27 81 88 ff ff  @.'........'....
  backtrace (crc e73602b4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x465/0x680 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1861
    v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2416 [inline]
    v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2390
    msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
    usb_probe_interface+0x246/0x540 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:583 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:661
    __driver_probe_device+0xc7/0x160 drivers/base/dd.c:803
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:833
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:961
    bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1033
    device_initial_probe+0x6f/0x80 drivers/base/dd.c:1088
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x97c/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/28 23:07 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/28 23:03 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/28 21:50 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/28 21:48 upstream 1f97d9dcf536 004c195c .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/20 03:10 upstream 24d479d26b25 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 13:26 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 12:01 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 11:40 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:53 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:38 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:07 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 12:46 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 11:46 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 07:51 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
* Struck through repros no longer work on HEAD.