memory leak in ip_frag_next

Status: closed as invalid on 2026/02/18 04:33
Subsystems: net
[Documentation on labels]
First crash: 225d, last: 210d
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2026/01/16 22:38 15m retest repro upstream error
2026/01/16 22:38 15m retest repro upstream report log
2026/01/16 22:38 25m retest repro upstream report log
2026/01/16 22:38 21m retest repro upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888126f29f00 (size 240):
  comm "syz.0.17", pid 6074, jiffies 4294945169
  hex dump (first 32 bytes):
    00 9f f2 26 81 88 ff ff 00 00 00 00 00 00 00 00  ...&............
    00 a0 5b 1a 81 88 ff ff 00 00 00 00 00 00 00 00  ..[.............
  backtrace (crc 3eb171da):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    __alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
    alloc_skb include/linux/skbuff.h:1383 [inline]
    ip_frag_next+0x62/0x290 net/ipv4/ip_output.c:694
    ip_do_fragment+0x354/0x820 net/ipv4/ip_output.c:904
    ip_fragment.constprop.0+0x8b/0x100 net/ipv4/ip_output.c:583
    __ip_finish_output.part.0+0x8f/0x1c0 net/ipv4/ip_output.c:313
    __ip_finish_output net/ipv4/ip_output.c:444 [inline]
    ip_finish_output net/ipv4/ip_output.c:325 [inline]
    NF_HOOK_COND include/linux/netfilter.h:307 [inline]
    ip_output+0xf5/0x200 net/ipv4/ip_output.c:438
    dst_output include/net/dst.h:464 [inline]
    ip_local_out+0x9d/0xc0 net/ipv4/ip_output.c:131
    __ip_queue_xmit+0x2b0/0x770 net/ipv4/ip_output.c:534
    sctp_v4_xmit+0x360/0x3d0 net/sctp/protocol.c:1060
    sctp_packet_transmit+0xa0d/0xd30 net/sctp/output.c:653
    sctp_outq_flush_transports net/sctp/outqueue.c:1173 [inline]
    sctp_outq_flush+0x4ff/0x1080 net/sctp/outqueue.c:1221
    sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1824 [inline]
    sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
    sctp_do_sm+0xdf1/0x24b0 net/sctp/sm_sideeffect.c:1175
    sctp_primitive_SEND+0x59/0x70 net/sctp/primitive.c:163
    sctp_sendmsg_to_asoc+0x6d2/0xbc0 net/sctp/socket.c:1872
    sctp_sendmsg+0x86f/0x1020 net/sctp/socket.c:2030

BUG: memory leak
unreferenced object 0xffff888126da42c0 (size 704):
  comm "syz.0.17", pid 6074, jiffies 4294945169
  hex dump (first 32 bytes):
    00 00 aa aa aa aa aa 0a aa aa aa aa aa 0a 08 00  ................
    45 03 00 44 d0 d1 31 76 40 84 79 e9 7f 00 00 01  E..D..1v@.y.....
  backtrace (crc 1cb278fd):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    ip_frag_next+0x62/0x290 net/ipv4/ip_output.c:694
    ip_do_fragment+0x354/0x820 net/ipv4/ip_output.c:904
    ip_fragment.constprop.0+0x8b/0x100 net/ipv4/ip_output.c:583
    __ip_finish_output.part.0+0x8f/0x1c0 net/ipv4/ip_output.c:313
    __ip_finish_output net/ipv4/ip_output.c:444 [inline]
    ip_finish_output net/ipv4/ip_output.c:325 [inline]
    NF_HOOK_COND include/linux/netfilter.h:307 [inline]
    ip_output+0xf5/0x200 net/ipv4/ip_output.c:438
    dst_output include/net/dst.h:464 [inline]
    ip_local_out+0x9d/0xc0 net/ipv4/ip_output.c:131
    __ip_queue_xmit+0x2b0/0x770 net/ipv4/ip_output.c:534
    sctp_v4_xmit+0x360/0x3d0 net/sctp/protocol.c:1060
    sctp_packet_transmit+0xa0d/0xd30 net/sctp/output.c:653
    sctp_outq_flush_transports net/sctp/outqueue.c:1173 [inline]
    sctp_outq_flush+0x4ff/0x1080 net/sctp/outqueue.c:1221
    sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1824 [inline]
    sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
    sctp_do_sm+0xdf1/0x24b0 net/sctp/sm_sideeffect.c:1175
    sctp_primitive_SEND+0x59/0x70 net/sctp/primitive.c:163
    sctp_sendmsg_to_asoc+0x6d2/0xbc0 net/sctp/socket.c:1872

BUG: memory leak
unreferenced object 0xffff88812760c000 (size 240):
  comm "syz.0.17", pid 6074, jiffies 4294945169
  hex dump (first 32 bytes):
    00 c0 60 27 81 88 ff ff 00 00 00 00 00 00 00 00  ..`'............
    00 a0 5b 1a 81 88 ff ff 00 00 00 00 00 00 00 00  ..[.............
  backtrace (crc c5ea9f34):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    __alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
    alloc_skb include/linux/skbuff.h:1383 [inline]
    ip_frag_next+0x62/0x290 net/ipv4/ip_output.c:694
    ip_do_fragment+0x354/0x820 net/ipv4/ip_output.c:904
    ip_fragment.constprop.0+0x8b/0x100 net/ipv4/ip_output.c:583
    __ip_finish_output.part.0+0x8f/0x1c0 net/ipv4/ip_output.c:313
    __ip_finish_output net/ipv4/ip_output.c:444 [inline]
    ip_finish_output net/ipv4/ip_output.c:325 [inline]
    NF_HOOK_COND include/linux/netfilter.h:307 [inline]
    ip_output+0xf5/0x200 net/ipv4/ip_output.c:438
    dst_output include/net/dst.h:464 [inline]
    ip_local_out+0x9d/0xc0 net/ipv4/ip_output.c:131
    __ip_queue_xmit+0x2b0/0x770 net/ipv4/ip_output.c:534
    sctp_v4_xmit+0x360/0x3d0 net/sctp/protocol.c:1060
    sctp_packet_transmit+0xa0d/0xd30 net/sctp/output.c:653
    sctp_outq_flush_transports net/sctp/outqueue.c:1173 [inline]
    sctp_outq_flush+0x4ff/0x1080 net/sctp/outqueue.c:1221
    sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1824 [inline]
    sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
    sctp_do_sm+0xdf1/0x24b0 net/sctp/sm_sideeffect.c:1175
    sctp_primitive_SEND+0x59/0x70 net/sctp/primitive.c:163
    sctp_sendmsg_to_asoc+0x6d2/0xbc0 net/sctp/socket.c:1872
    sctp_sendmsg+0x86f/0x1020 net/sctp/socket.c:2030

BUG: memory leak
unreferenced object 0xffff888126da4580 (size 704):
  comm "syz.0.17", pid 6074, jiffies 4294945169
  hex dump (first 32 bytes):
    00 00 aa aa aa aa aa 0a aa aa aa aa aa 0a 08 00  ................
    45 03 00 44 d0 d1 31 7c 40 84 79 e3 7f 00 00 01  E..D..1|@.y.....
  backtrace (crc fa778469):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    ip_frag_next+0x62/0x290 net/ipv4/ip_output.c:694
    ip_do_fragment+0x354/0x820 net/ipv4/ip_output.c:904
    ip_fragment.constprop.0+0x8b/0x100 net/ipv4/ip_output.c:583
    __ip_finish_output.part.0+0x8f/0x1c0 net/ipv4/ip_output.c:313
    __ip_finish_output net/ipv4/ip_output.c:444 [inline]
    ip_finish_output net/ipv4/ip_output.c:325 [inline]
    NF_HOOK_COND include/linux/netfilter.h:307 [inline]
    ip_output+0xf5/0x200 net/ipv4/ip_output.c:438
    dst_output include/net/dst.h:464 [inline]
    ip_local_out+0x9d/0xc0 net/ipv4/ip_output.c:131
    __ip_queue_xmit+0x2b0/0x770 net/ipv4/ip_output.c:534
    sctp_v4_xmit+0x360/0x3d0 net/sctp/protocol.c:1060
    sctp_packet_transmit+0xa0d/0xd30 net/sctp/output.c:653
    sctp_outq_flush_transports net/sctp/outqueue.c:1173 [inline]
    sctp_outq_flush+0x4ff/0x1080 net/sctp/outqueue.c:1221
    sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1824 [inline]
    sctp_side_effects net/sctp/sm_sideeffect.c:1204 [inline]
    sctp_do_sm+0xdf1/0x24b0 net/sctp/sm_sideeffect.c:1175
    sctp_primitive_SEND+0x59/0x70 net/sctp/primitive.c:163
    sctp_sendmsg_to_asoc+0x6d2/0xbc0 net/sctp/socket.c:1872

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/02 17:30 upstream b69053dd3ffb d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in ip_frag_next
2026/01/02 16:05 upstream b69053dd3ffb d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in ip_frag_next
2026/01/02 10:45 upstream b69053dd3ffb d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in ip_frag_next
2026/01/02 08:58 upstream b69053dd3ffb d6526ea3 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in ip_frag_next
* Struck through repros no longer work on HEAD.