* [syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3)
@ 2026-05-07 23:35 syzbot
2026-05-08 2:56 ` Forwarded: syzbot
2026-05-08 3:01 ` Forwarded: [PATCH] media: msi2500: fix memory leak in msi2500_probe error path syzbot
0 siblings, 2 replies; 3+ messages in thread
From: syzbot @ 2026-05-07 23:35 UTC (permalink / raw)
To: linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 5862221fdded Merge tag 'parisc-for-7.1-rc3' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15dfcd06580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c47d4d4befc65788
dashboard link: https://syzkaller.appspot.com/bug?extid=b1de0d5fd8a15fac11aa
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=170a6636580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13dfcd06580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8afd44b99460/disk-5862221f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/488628808019/vmlinux-5862221f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/92718d825f82/bzImage-5862221f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b1de0d5fd8a15fac11aa@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff888106b17248 (size 8):
comm "kworker/1:8", pid 6017, jiffies 4294942650
hex dump (first 8 bytes):
00 c7 2b 2b 81 88 ff ff ..++....
backtrace (crc d625c37c):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4574 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
__do_kmalloc_node mm/slub.c:5294 [inline]
__kvmalloc_node_noprof+0x537/0x760 mm/slub.c:6832
v4l2_ctrl_handler_init_class+0x59/0x90 drivers/media/v4l2-core/v4l2-ctrls-core.c:1728
msi2500_probe+0x2a9/0x390 drivers/media/usb/msi2500/msi2500.c:1248
usb_probe_interface+0x22a/0x4e0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:709
__driver_probe_device+0xe8/0x1a0 drivers/base/dd.c:871
driver_probe_device+0x2a/0x120 drivers/base/dd.c:901
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1029
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1101
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1156
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:613
device_add+0x99b/0xc70 drivers/base/core.c:3706
usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
usb_probe_device+0x78/0x1f0 drivers/usb/core/driver.c:291
BUG: memory leak
unreferenced object 0xffff888129cfe400 (size 256):
comm "kworker/1:8", pid 6017, jiffies 4294942650
hex dump (first 32 bytes):
58 f7 2c 13 81 88 ff ff 58 f7 2c 13 81 88 ff ff X.,.....X.,.....
10 e4 cf 29 81 88 ff ff 10 e4 cf 29 81 88 ff ff ...).......)....
backtrace (crc 9e26d735):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4574 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
__do_kmalloc_node mm/slub.c:5294 [inline]
__kvmalloc_node_noprof+0x537/0x760 mm/slub.c:6832
v4l2_ctrl_new+0x2bb/0x1470 drivers/media/v4l2-core/v4l2-ctrls-core.c:2139
v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2293
handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1874
v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2443 [inline]
v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2417
msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
usb_probe_interface+0x22a/0x4e0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:709
__driver_probe_device+0xe8/0x1a0 drivers/base/dd.c:871
driver_probe_device+0x2a/0x120 drivers/base/dd.c:901
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1029
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1101
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1156
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:613
device_add+0x99b/0xc70 drivers/base/core.c:3706
BUG: memory leak
unreferenced object 0xffff88812b2bc840 (size 64):
comm "kworker/1:8", pid 6017, jiffies 4294942650
hex dump (first 32 bytes):
00 c8 2b 2b 81 88 ff ff 68 f7 2c 13 81 88 ff ff ..++....h.,.....
00 00 00 00 00 00 00 00 00 e4 cf 29 81 88 ff ff ...........)....
backtrace (crc 7d5214ee):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4574 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
__do_kmalloc_node mm/slub.c:5294 [inline]
__kmalloc_noprof+0x3b7/0x550 mm/slub.c:5307
kmalloc_noprof include/linux/slab.h:954 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1882
v4l2_ctrl_new+0x69e/0x1470 drivers/media/v4l2-core/v4l2-ctrls-core.c:2222
v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2293
handler_new_ref+0x34d/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1874
v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2443 [inline]
v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2417
msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
usb_probe_interface+0x22a/0x4e0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:709
__driver_probe_device+0xe8/0x1a0 drivers/base/dd.c:871
driver_probe_device+0x2a/0x120 drivers/base/dd.c:901
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1029
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1101
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1156
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:613
BUG: memory leak
unreferenced object 0xffff88812b2bc800 (size 64):
comm "kworker/1:8", pid 6017, jiffies 4294942650
hex dump (first 32 bytes):
c0 c7 2b 2b 81 88 ff ff 40 c8 2b 2b 81 88 ff ff ..++....@.++....
40 c8 2b 2b 81 88 ff ff 00 ea cf 29 81 88 ff ff @.++.......)....
backtrace (crc 63c3c8c3):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4574 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
__do_kmalloc_node mm/slub.c:5294 [inline]
__kmalloc_noprof+0x3b7/0x550 mm/slub.c:5307
kmalloc_noprof include/linux/slab.h:954 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
handler_new_ref+0xd9/0x440 drivers/media/v4l2-core/v4l2-ctrls-core.c:1882
v4l2_ctrl_add_handler drivers/media/v4l2-core/v4l2-ctrls-core.c:2443 [inline]
v4l2_ctrl_add_handler+0x12d/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2417
msi2500_probe+0x2e0/0x390 drivers/media/usb/msi2500/msi2500.c:1256
usb_probe_interface+0x22a/0x4e0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x12f/0x3a0 drivers/base/dd.c:709
__driver_probe_device+0xe8/0x1a0 drivers/base/dd.c:871
driver_probe_device+0x2a/0x120 drivers/base/dd.c:901
__device_attach_driver+0x10f/0x170 drivers/base/dd.c:1029
bus_for_each_drv+0xd2/0x130 drivers/base/bus.c:500
__device_attach+0xf9/0x290 drivers/base/dd.c:1101
device_initial_probe+0x6f/0x80 drivers/base/dd.c:1156
bus_probe_device+0x3e/0xb0 drivers/base/bus.c:613
device_add+0x99b/0xc70 drivers/base/core.c:3706
usb_set_configuration+0x8f5/0xb80 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x73/0xb0 drivers/usb/core/generic.c:250
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Forwarded:
2026-05-07 23:35 [syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3) syzbot
@ 2026-05-08 2:56 ` syzbot
2026-05-08 3:01 ` Forwarded: [PATCH] media: msi2500: fix memory leak in msi2500_probe error path syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2026-05-08 2:56 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject:
Author: daiky0325@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
^ permalink raw reply [flat|nested] 3+ messages in thread
* Forwarded: [PATCH] media: msi2500: fix memory leak in msi2500_probe error path
2026-05-07 23:35 [syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3) syzbot
2026-05-08 2:56 ` Forwarded: syzbot
@ 2026-05-08 3:01 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2026-05-08 3:01 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] media: msi2500: fix memory leak in msi2500_probe error path
Author: daiky0325@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
When video_register_device() fails in msi2500_probe(), the error path
jumps to err_unregister_v4l2_dev, which skips the call to
v4l2_ctrl_handler_free(). This leaks memory allocated by
v4l2_ctrl_handler_init() and v4l2_ctrl_add_handler().
Fix this by jumping to err_free_controls instead, which properly frees
the control handler before unregistering the v4l2 device.
Reported-by: syzbot+b1de0d5fd8a15fac11aa@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b1de0d5fd8a15fac11aa
Signed-off-by: Daiki Harada <daiky0325@gmail.com>
---
drivers/media/usb/msi2500/msi2500.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/msi2500/msi2500.c b/drivers/media/usb/msi2500/msi2500.c
index 1ff98956b680..76e1f2bfab0c 100644
--- a/drivers/media/usb/msi2500/msi2500.c
+++ b/drivers/media/usb/msi2500/msi2500.c
@@ -1265,7 +1265,7 @@ static int msi2500_probe(struct usb_interface *intf,
if (ret) {
dev_err(dev->dev,
"Failed to register as video device (%d)\n", ret);
- goto err_unregister_v4l2_dev;
+ goto err_free_controls;
}
dev_info(dev->dev, "Registered as %s\n",
video_device_node_name(&dev->vdev));
--
2.54.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-08 3:01 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-07 23:35 [syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (3) syzbot
2026-05-08 2:56 ` Forwarded: syzbot
2026-05-08 3:01 ` Forwarded: [PATCH] media: msi2500: fix memory leak in msi2500_probe error path syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox