memory leak in hidg_bind

Status: upstream: reported C repro on 2026/08/09 19:13
Subsystems: usb
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+60740c6a17a5b5eb1f5a@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
461a5539 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in hidg_bind 2026/08/09 01:09 2026/08/09 01:09 2026/08/09 02:03 5d63f80b
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] USB: gadget: f_hid: Release get report req upon unsetup 1 (1) 2026/08/10 10:25
[syzbot] [usb?] memory leak in hidg_bind 4 (9) 2026/08/10 08:31
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2026/08/10 07:24 1h04m eadavis@qq.com patch upstream OK log
2026/08/10 04:34 28m eadavis@qq.com patch upstream OK log
2026/08/10 03:14 32m eadavis@qq.com patch upstream report log
2026/08/10 01:24 1h05m eadavis@qq.com patch upstream report log

Sample crash report:
2026/08/08 09:35:22 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888112450300 (size 128):
  comm "syz.0.18", pid 5923, jiffies 4294943868
  hex dump (first 32 bytes):
    00 03 45 12 81 88 ff ff 00 03 45 12 81 88 ff ff  ..E.......E.....
    30 00 b2 03 81 88 ff ff 00 00 00 00 00 00 00 00  0...............
  backtrace (crc 18381426):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    hidg_bind+0x2b/0x490 drivers/usb/gadget/function/f_hid.c:1154
    usb_add_function+0xca/0x270 drivers/usb/gadget/composite.c:333
    configfs_composite_bind+0x667/0x9b0 drivers/usb/gadget/configfs.c:1802
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    usb_gadget_register_driver_owner+0x69/0xe0 drivers/usb/gadget/udc/core.c:1752
    gadget_dev_desc_UDC_store+0x153/0x1e0 drivers/usb/gadget/configfs.c:300

BUG: memory leak
unreferenced object 0xffff888112c7bf00 (size 128):
  comm "syz.0.20", pid 5967, jiffies 4294944502
  hex dump (first 32 bytes):
    00 bf c7 12 81 88 ff ff 00 bf c7 12 81 88 ff ff  ................
    30 00 b2 03 81 88 ff ff 00 00 00 00 00 00 00 00  0...............
  backtrace (crc cd50bb2e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4597 [inline]
    slab_alloc_node mm/slub.c:4917 [inline]
    __kmalloc_cache_noprof+0x356/0x440 mm/slub.c:5485
    _kmalloc_noprof include/linux/slab.h:988 [inline]
    _kzalloc_noprof include/linux/slab.h:1309 [inline]
    dummy_alloc_request+0x65/0xf0 drivers/usb/gadget/udc/dummy_hcd.c:693
    usb_ep_alloc_request+0x2e/0xd0 drivers/usb/gadget/udc/core.c:197
    hidg_bind+0x2b/0x490 drivers/usb/gadget/function/f_hid.c:1154
    usb_add_function+0xca/0x270 drivers/usb/gadget/composite.c:333
    configfs_composite_bind+0x667/0x9b0 drivers/usb/gadget/configfs.c:1802
    gadget_bind_driver+0xed/0x390 drivers/usb/gadget/udc/core.c:1662
    call_driver_probe drivers/base/dd.c:628 [inline]
    really_probe+0x12f/0x3a0 drivers/base/dd.c:706
    __driver_probe_device+0xe9/0x1a0 drivers/base/dd.c:868
    driver_probe_device+0x28/0xf0 drivers/base/dd.c:898
    __driver_attach drivers/base/dd.c:1292 [inline]
    __driver_attach+0x10a/0x200 drivers/base/dd.c:1232
    bus_for_each_dev+0xb8/0x120 drivers/base/bus.c:383
    bus_add_driver+0x122/0x280 drivers/base/bus.c:763
    driver_register+0xb1/0x140 drivers/base/driver.c:174
    usb_gadget_register_driver_owner+0x69/0xe0 drivers/usb/gadget/udc/core.c:1752
    gadget_dev_desc_UDC_store+0x153/0x1e0 drivers/usb/gadget/configfs.c:300

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/08 09:35 upstream 9a143525f62b e4ef95d6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in hidg_bind
2026/08/08 09:04 upstream 9a143525f62b e4ef95d6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in hidg_bind
* Struck through repros no longer work on HEAD.