memory leak in __skb_tstamp_tx

Status: fixed on 2026/05/06 16:40
Subsystems: bluetooth
[Documentation on labels]
Fix commit: 21e4271e6509 Bluetooth: purge error queues in socket destructors
First crash: 206d, last: 206d
▶ ▼ Last patch testing requests (3)
Created Duration User Patch Repo Result
2026/03/21 00:45 44m willemb@google.com upstream OK log
2026/01/21 20:11 2m retest repro upstream error
2026/01/08 12:49 15m edumazet@google.com patch upstream report log

Sample crash report:
2026/01/07 20:01:38 executed programs: 68
BUG: memory leak
unreferenced object 0xffff88812613a700 (size 240):
  comm "kworker/u9:3", pid 5942, jiffies 4294950945
  hex dump (first 32 bytes):
    90 9c 35 14 81 88 ff ff 90 9c 35 14 81 88 ff ff  ..5.......5.....
    00 00 00 00 00 00 00 00 00 9c 35 14 81 88 ff ff  ..........5.....
  backtrace (crc 66d58c95):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    __alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
    alloc_skb include/linux/skbuff.h:1383 [inline]
    __skb_tstamp_tx+0x162/0x4c0 net/core/skbuff.c:5675
    hci_conn_tx_queue+0x11c/0x1d0 net/bluetooth/hci_conn.c:3049
    hci_send_conn_frame net/bluetooth/hci_core.c:3086 [inline]
    hci_sched_acl_pkt net/bluetooth/hci_core.c:3701 [inline]
    hci_sched_acl net/bluetooth/hci_core.c:3726 [inline]
    hci_tx_work+0x437/0x570 net/bluetooth/hci_core.c:3820
    process_one_work+0x26b/0x620 kernel/workqueue.c:3257
    process_scheduled_works kernel/workqueue.c:3340 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3421
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x2cf/0x300 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

BUG: memory leak
unreferenced object 0xffff88812c776940 (size 704):
  comm "kworker/u9:3", pid 5942, jiffies 4294950945
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc f18cfd82):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    __skb_tstamp_tx+0x162/0x4c0 net/core/skbuff.c:5675
    hci_conn_tx_queue+0x11c/0x1d0 net/bluetooth/hci_conn.c:3049
    hci_send_conn_frame net/bluetooth/hci_core.c:3086 [inline]
    hci_sched_acl_pkt net/bluetooth/hci_core.c:3701 [inline]
    hci_sched_acl net/bluetooth/hci_core.c:3726 [inline]
    hci_tx_work+0x437/0x570 net/bluetooth/hci_core.c:3820
    process_one_work+0x26b/0x620 kernel/workqueue.c:3257
    process_scheduled_works kernel/workqueue.c:3340 [inline]
    worker_thread+0x2c4/0x4f0 kernel/workqueue.c:3421
    kthread+0x15b/0x310 kernel/kthread.c:463
    ret_from_fork+0x2cf/0x300 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/07 20:02 upstream f0b9d8eb98df d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in __skb_tstamp_tx
* Struck through repros no longer work on HEAD.