memory leak in j1939_netdev_start

Status: auto-obsoleted due to no activity on 2026/04/14 08:53
Subsystems: can
[Documentation on labels]
Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com
First crash: 1002d, last: 227d
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [can?] memory leak in j1939_netdev_start 3 (9) 2025/12/21 07:58
[syzbot] Monthly can report (Dec 2023) 0 (1) 2023/12/02 14:45
▶ ▼ Last patch testing requests (14)
Created Duration User Patch Repo Result
2026/03/15 11:40 25m retest repro upstream no crash log
2026/03/15 11:34 19m retest repro upstream no crash log
2026/03/15 08:34 1h22m retest repro upstream no crash log
2026/01/04 08:17 21m retest repro upstream report log
2026/01/04 08:17 14m retest repro upstream report log
2025/10/12 12:39 46m retest repro upstream report log
2025/08/03 11:41 15m retest repro upstream report log
2025/05/25 10:42 18m retest repro upstream report log
2025/03/16 08:26 14m retest repro upstream report log
2025/01/05 07:52 15m retest repro upstream report log
2024/01/24 01:24 1h24m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2024/01/23 09:39 13m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log
2024/01/23 09:12 0m eadavis@qq.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 98b1cc82c4af error
2024/01/19 13:27 19m n.zhandarovich@fintech.ru upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812437e000 (size 8192):
  comm "syz.3.27", pid 6191, jiffies 4294942739
  hex dump (first 32 bytes):
    00 e0 37 24 81 88 ff ff 00 e0 37 24 81 88 ff ff  ..7$......7$....
    00 00 00 00 00 00 00 00 00 80 67 14 81 88 ff ff  ..........g.....
  backtrace (crc 9710eadb):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    j1939_priv_create net/can/j1939/main.c:131 [inline]
    j1939_netdev_start+0x160/0x6f0 net/can/j1939/main.c:268
    j1939_sk_bind+0x247/0x590 net/can/j1939/socket.c:504
    __sys_bind_socket net/socket.c:1874 [inline]
    __sys_bind_socket net/socket.c:1866 [inline]
    __sys_bind+0x132/0x160 net/socket.c:1905
    __do_sys_bind net/socket.c:1910 [inline]
    __se_sys_bind net/socket.c:1908 [inline]
    __x64_sys_bind+0x1c/0x30 net/socket.c:1908
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810cc00e00 (size 240):
  comm "softirq", pid 0, jiffies 4294942739
  hex dump (first 32 bytes):
    68 8a 63 24 81 88 ff ff 68 8a 63 24 81 88 ff ff  h.c$....h.c$....
    00 80 67 14 81 88 ff ff 00 00 00 00 00 00 00 00  ..g.............
  backtrace (crc 467a0d54):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    __alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
    alloc_skb include/linux/skbuff.h:1383 [inline]
    j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
    j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
    j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
    j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
    j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
    j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
    deliver net/can/af_can.c:575 [inline]
    can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
    can_receive+0xf0/0x140 net/can/af_can.c:666
    can_rcv+0xf6/0x130 net/can/af_can.c:690
    __netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
    __netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
    process_backlog+0xd5/0x1e0 net/core/dev.c:6602
    __napi_poll+0x44/0x3a0 net/core/dev.c:7666
    napi_poll net/core/dev.c:7729 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7881
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
    sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056

BUG: memory leak
unreferenced object 0xffff88810a549e40 (size 704):
  comm "softirq", pid 0, jiffies 4294942739
  hex dump (first 32 bytes):
    0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc fd324075):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
    kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
    __alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
    alloc_skb include/linux/skbuff.h:1383 [inline]
    j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
    j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
    j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
    j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
    j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
    j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
    deliver net/can/af_can.c:575 [inline]
    can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
    can_receive+0xf0/0x140 net/can/af_can.c:666
    can_rcv+0xf6/0x130 net/can/af_can.c:690
    __netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
    __netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
    process_backlog+0xd5/0x1e0 net/core/dev.c:6602
    __napi_poll+0x44/0x3a0 net/core/dev.c:7666
    napi_poll net/core/dev.c:7729 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7881
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723

BUG: memory leak
unreferenced object 0xffff888124638a00 (size 512):
  comm "softirq", pid 0, jiffies 4294942739
  hex dump (first 32 bytes):
    00 e0 37 24 81 88 ff ff 28 f0 37 24 81 88 ff ff  ..7$....(.7$....
    28 f0 37 24 81 88 ff ff 18 8a 63 24 81 88 ff ff  (.7$......c$....
  backtrace (crc 965e5f06):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    j1939_session_new+0x55/0x1d0 net/can/j1939/transport.c:1495
    j1939_session_fresh_new net/can/j1939/transport.c:1543 [inline]
    j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
    j1939_xtp_rx_rts+0x47a/0xb30 net/can/j1939/transport.c:1751
    j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
    j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
    j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
    deliver net/can/af_can.c:575 [inline]
    can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
    can_receive+0xf0/0x140 net/can/af_can.c:666
    can_rcv+0xf6/0x130 net/can/af_can.c:690
    __netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
    __netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
    process_backlog+0xd5/0x1e0 net/core/dev.c:6602
    __napi_poll+0x44/0x3a0 net/core/dev.c:7666
    napi_poll net/core/dev.c:7729 [inline]
    net_rx_action+0x492/0x560 net/core/dev.c:7881
    handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
    __do_softirq kernel/softirq.c:656 [inline]
    invoke_softirq kernel/softirq.c:496 [inline]
    __irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
    instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
    sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/21 07:58 upstream d8ba32c5a460 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-leak memory leak in j1939_netdev_start
2023/11/21 02:33 upstream 98b1cc82c4af cb976f63 .config console log report syz [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in j1939_netdev_start
* Struck through repros no longer work on HEAD.