From: syzbot <syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com>
To: davem@davemloft.net, eadavis@qq.com, edumazet@google.com,
kernel@pengutronix.de, kuba@kernel.org,
linux-can@vger.kernel.org, linux-kernel@vger.kernel.org,
mkl@pengutronix.de, n.zhandarovich@fintech.ru,
netdev@vger.kernel.org, o.rempel@pengutronix.de,
pabeni@redhat.com, robin@protonic.nl, socketcan@hartkopp.net,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [can?] memory leak in j1939_netdev_start
Date: Sat, 20 Dec 2025 23:58:22 -0800 [thread overview]
Message-ID: <6947a89e.a70a0220.25eec0.006f.GAE@google.com> (raw)
In-Reply-To: <00000000000060446d060af10f08@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: d8ba32c5a460 Merge tag 'block-6.19-20251218' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13989392580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d60836e327fd6756
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155c4358580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d1777c580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/075f0ee95918/disk-d8ba32c5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8219d2472799/vmlinux-d8ba32c5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d07c95aef4d/bzImage-d8ba32c5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2fd2ba265dd2/mount_9.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=105f562a580000)
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88812437e000 (size 8192):
comm "syz.3.27", pid 6191, jiffies 4294942739
hex dump (first 32 bytes):
00 e0 37 24 81 88 ff ff 00 e0 37 24 81 88 ff ff ..7$......7$....
00 00 00 00 00 00 00 00 00 80 67 14 81 88 ff ff ..........g.....
backtrace (crc 9710eadb):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
j1939_priv_create net/can/j1939/main.c:131 [inline]
j1939_netdev_start+0x160/0x6f0 net/can/j1939/main.c:268
j1939_sk_bind+0x247/0x590 net/can/j1939/socket.c:504
__sys_bind_socket net/socket.c:1874 [inline]
__sys_bind_socket net/socket.c:1866 [inline]
__sys_bind+0x132/0x160 net/socket.c:1905
__do_sys_bind net/socket.c:1910 [inline]
__se_sys_bind net/socket.c:1908 [inline]
__x64_sys_bind+0x1c/0x30 net/socket.c:1908
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810cc00e00 (size 240):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
68 8a 63 24 81 88 ff ff 68 8a 63 24 81 88 ff ff h.c$....h.c$....
00 80 67 14 81 88 ff ff 00 00 00 00 00 00 00 00 ..g.............
backtrace (crc 467a0d54):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
__alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
alloc_skb include/linux/skbuff.h:1383 [inline]
j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056
BUG: memory leak
unreferenced object 0xffff88810a549e40 (size 704):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc fd324075):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
__alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
alloc_skb include/linux/skbuff.h:1383 [inline]
j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
BUG: memory leak
unreferenced object 0xffff888124638a00 (size 512):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
00 e0 37 24 81 88 ff ff 28 f0 37 24 81 88 ff ff ..7$....(.7$....
28 f0 37 24 81 88 ff ff 18 8a 63 24 81 88 ff ff (.7$......c$....
backtrace (crc 965e5f06):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
j1939_session_new+0x55/0x1d0 net/can/j1939/transport.c:1495
j1939_session_fresh_new net/can/j1939/transport.c:1543 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x47a/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
prev parent reply other threads:[~2025-12-21 7:58 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-11-25 2:45 [syzbot] [can?] memory leak in j1939_netdev_start syzbot
2025-12-21 7:58 ` syzbot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6947a89e.a70a0220.25eec0.006f.GAE@google.com \
--to=syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=eadavis@qq.com \
--cc=edumazet@google.com \
--cc=kernel@pengutronix.de \
--cc=kuba@kernel.org \
--cc=linux-can@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mkl@pengutronix.de \
--cc=n.zhandarovich@fintech.ru \
--cc=netdev@vger.kernel.org \
--cc=o.rempel@pengutronix.de \
--cc=pabeni@redhat.com \
--cc=robin@protonic.nl \
--cc=socketcan@hartkopp.net \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).