Re: [syzbot] [can?] memory leak in j1939_netdev_start

syzbot
2025-12-21T07:58:23Z

syzbot has found a reproducer for the following issue on:

HEAD commit: d8ba32c5a460 Merge tag 'block-6.19-20251218' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13989392580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d60836e327fd6756
dashboard link: https://syzkaller.appspot.com/bug?extid=1d37bef05da87b99c5a6
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155c4358580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d1777c580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/075f0ee95918/disk-d8ba32c5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8219d2472799/vmlinux-d8ba32c5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/5d07c95aef4d/bzImage-d8ba32c5.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/2fd2ba265dd2/mount_9.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=105f562a580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1d37bef05da87b99c5a6@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88812437e000 (size 8192):
comm "syz.3.27", pid 6191, jiffies 4294942739
hex dump (first 32 bytes):
00 e0 37 24 81 88 ff ff 00 e0 37 24 81 88 ff ff ..7$......7$....
00 00 00 00 00 00 00 00 00 80 67 14 81 88 ff ff ..........g.....
backtrace (crc 9710eadb):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
j1939_priv_create net/can/j1939/main.c:131 [inline]
j1939_netdev_start+0x160/0x6f0 net/can/j1939/main.c:268
j1939_sk_bind+0x247/0x590 net/can/j1939/socket.c:504
__sys_bind_socket net/socket.c:1874 [inline]
__sys_bind_socket net/socket.c:1866 [inline]
__sys_bind+0x132/0x160 net/socket.c:1905
__do_sys_bind net/socket.c:1910 [inline]
__se_sys_bind net/socket.c:1908 [inline]
__x64_sys_bind+0x1c/0x30 net/socket.c:1908
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810cc00e00 (size 240):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
68 8a 63 24 81 88 ff ff 68 8a 63 24 81 88 ff ff h.c$....h.c$....
00 80 67 14 81 88 ff ff 00 00 00 00 00 00 00 00 ..g.............
backtrace (crc 467a0d54):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
__alloc_skb+0xe8/0x2b0 net/core/skbuff.c:679
alloc_skb include/linux/skbuff.h:1383 [inline]
j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056

BUG: memory leak
unreferenced object 0xffff88810a549e40 (size 704):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc fd324075):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
kmem_cache_alloc_node_noprof+0x384/0x5a0 mm/slub.c:5315
kmalloc_reserve+0xe6/0x180 net/core/skbuff.c:586
__alloc_skb+0x111/0x2b0 net/core/skbuff.c:690
alloc_skb include/linux/skbuff.h:1383 [inline]
j1939_session_fresh_new net/can/j1939/transport.c:1532 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x3e4/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723

BUG: memory leak
unreferenced object 0xffff888124638a00 (size 512):
comm "softirq", pid 0, jiffies 4294942739
hex dump (first 32 bytes):
00 e0 37 24 81 88 ff ff 28 f0 37 24 81 88 ff ff ..7$....(.7$....
28 f0 37 24 81 88 ff ff 18 8a 63 24 81 88 ff ff (.7$......c$....
backtrace (crc 965e5f06):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
j1939_session_new+0x55/0x1d0 net/can/j1939/transport.c:1495
j1939_session_fresh_new net/can/j1939/transport.c:1543 [inline]
j1939_xtp_rx_rts_session_new net/can/j1939/transport.c:1630 [inline]
j1939_xtp_rx_rts+0x47a/0xb30 net/can/j1939/transport.c:1751
j1939_tp_cmd_recv net/can/j1939/transport.c:2073 [inline]
j1939_tp_recv+0x1b9/0x800 net/can/j1939/transport.c:2160
j1939_can_recv+0x35f/0x4d0 net/can/j1939/main.c:108
deliver net/can/af_can.c:575 [inline]
can_rcv_filter+0xdd/0x2c0 net/can/af_can.c:609
can_receive+0xf0/0x140 net/can/af_can.c:666
can_rcv+0xf6/0x130 net/can/af_can.c:690
__netif_receive_skb_one_core+0xeb/0x100 net/core/dev.c:6137
__netif_receive_skb+0x1d/0x80 net/core/dev.c:6250
process_backlog+0xd5/0x1e0 net/core/dev.c:6602
__napi_poll+0x44/0x3a0 net/core/dev.c:7666
napi_poll net/core/dev.c:7729 [inline]
net_rx_action+0x492/0x560 net/core/dev.c:7881
handle_softirqs+0xe1/0x2e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x98/0xc0 kernel/softirq.c:723
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0x73/0x80 arch/x86/kernel/apic/apic.c:1056

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.