From: syzbot <syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com>
To: andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, eddyz87@gmail.com, haoluo@google.com,
john.fastabend@gmail.com, jolsa@kernel.org, kpsingh@kernel.org,
linux-kernel@vger.kernel.org, martin.lau@linux.dev,
sdf@fomichev.me, song@kernel.org,
syzkaller-bugs@googlegroups.com, yonghong.song@linux.dev
Subject: [syzbot] [bpf?] memory leak in map_create
Date: Sun, 16 Nov 2025 04:03:27 -0800 [thread overview]
Message-ID: <6919bd8f.a70a0220.3124cb.007d.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 24172e0d7990 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17818692580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=cf08c551fecea9fd1320
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=17a64658580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=11ac3c12580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ded911fa4408/disk-24172e0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a1f3e61cb784/vmlinux-24172e0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b92fd0e25cb7/bzImage-24172e0d.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
2025/11/12 11:58:15 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888125a64000 (size 1024):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 7b9fb9b4):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__do_kmalloc_node mm/slub.c:5649 [inline]
__kmalloc_node_noprof+0x3b4/0x6c0 mm/slub.c:5656
kmalloc_node_noprof include/linux/slab.h:987 [inline]
__bpf_map_area_alloc+0x17a/0x1a0 kernel/bpf/syscall.c:395
htab_map_alloc+0x67/0x950 kernel/bpf/hashtab.c:489
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object (percpu) 0x607e4d6674b0 (size 8):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 8 bytes on cpu 0):
00 00 00 00 00 00 00 00 ........
backtrace (crc 0):
pcpu_alloc_noprof+0x83a/0xd80 mm/percpu.c:1890
bpf_map_alloc_percpu+0x7b/0x190 kernel/bpf/syscall.c:575
bpf_map_init_elem_count include/linux/bpf.h:2532 [inline]
htab_map_alloc+0x165/0x950 kernel/bpf/hashtab.c:527
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888125a64400 (size 1024):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 2cb93737):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__do_kmalloc_node mm/slub.c:5649 [inline]
__kmalloc_node_noprof+0x3b4/0x6c0 mm/slub.c:5656
kmalloc_node_noprof include/linux/slab.h:987 [inline]
__bpf_map_area_alloc+0x17a/0x1a0 kernel/bpf/syscall.c:395
htab_map_alloc+0x18c/0x950 kernel/bpf/hashtab.c:532
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object (percpu) 0x607e4d6674b8 (size 208):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 32 bytes on cpu 0):
e0 f7 2c 27 81 88 ff ff 00 00 00 00 00 00 00 00 ..,'............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc ee549e23):
pcpu_alloc_noprof+0x83a/0xd80 mm/percpu.c:1890
bpf_mem_alloc_init+0x2fe/0x540 kernel/bpf/memalloc.c:525
htab_map_alloc+0x6ce/0x950 kernel/bpf/hashtab.c:579
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881272cf4e0 (size 96):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 0):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__do_kmalloc_node mm/slub.c:5649 [inline]
__kmalloc_node_noprof+0x3b4/0x6c0 mm/slub.c:5656
kmalloc_node_noprof include/linux/slab.h:987 [inline]
__alloc+0x92/0xd0 kernel/bpf/memalloc.c:155
alloc_bulk+0x242/0x3a0 kernel/bpf/memalloc.c:246
prefill_mem_cache kernel/bpf/memalloc.c:499 [inline]
bpf_mem_alloc_init+0x471/0x540 kernel/bpf/memalloc.c:546
htab_map_alloc+0x6ce/0x950 kernel/bpf/hashtab.c:579
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881272cf720 (size 96):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 32 bytes):
e0 f4 2c 27 81 88 ff ff 00 00 00 00 00 00 00 00 ..,'............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 6bfb1ae8):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__do_kmalloc_node mm/slub.c:5649 [inline]
__kmalloc_node_noprof+0x3b4/0x6c0 mm/slub.c:5656
kmalloc_node_noprof include/linux/slab.h:987 [inline]
__alloc+0x92/0xd0 kernel/bpf/memalloc.c:155
alloc_bulk+0x242/0x3a0 kernel/bpf/memalloc.c:246
prefill_mem_cache kernel/bpf/memalloc.c:499 [inline]
bpf_mem_alloc_init+0x471/0x540 kernel/bpf/memalloc.c:546
htab_map_alloc+0x6ce/0x950 kernel/bpf/hashtab.c:579
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881272cf660 (size 96):
comm "syz.0.17", pid 6096, jiffies 4294942817
hex dump (first 32 bytes):
20 f7 2c 27 81 88 ff ff 00 00 00 00 00 00 00 00 .,'............
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc ebf498a1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
__do_kmalloc_node mm/slub.c:5649 [inline]
__kmalloc_node_noprof+0x3b4/0x6c0 mm/slub.c:5656
kmalloc_node_noprof include/linux/slab.h:987 [inline]
__alloc+0x92/0xd0 kernel/bpf/memalloc.c:155
alloc_bulk+0x242/0x3a0 kernel/bpf/memalloc.c:246
prefill_mem_cache kernel/bpf/memalloc.c:499 [inline]
bpf_mem_alloc_init+0x471/0x540 kernel/bpf/memalloc.c:546
htab_map_alloc+0x6ce/0x950 kernel/bpf/hashtab.c:579
map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
__sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
__do_sys_bpf kernel/bpf/syscall.c:6259 [inline]
__se_sys_bpf kernel/bpf/syscall.c:6257 [inline]
__x64_sys_bpf+0x22/0x30 kernel/bpf/syscall.c:6257
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2025-11-16 12:03 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-11-16 12:03 syzbot [this message]
2025-11-16 14:33 ` [syzbot] [bpf?] memory leak in map_create Edward Adam Davis
2025-11-16 14:57 ` syzbot
2025-11-16 14:58 ` [PATCH] bpf: Plug a potential exclusive map memory leak Edward Adam Davis
2025-11-17 6:06 ` Yonghong Song
2025-11-22 0:52 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6919bd8f.a70a0220.3124cb.007d.GAE@google.com \
--to=syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@fomichev.me \
--cc=song@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox