syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1336]
≡ Subsystems
🐞 Fixed [7133]
🐞 Invalid [18878]
⬇ Missing Backports [220]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

memory leak in init_srcu_struct_fields

Status: upstream: reported C repro on 2026/05/30 20:57
Subsystems: bluetooth
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+535ecc844591e50588a5@syzkaller.appspotmail.com
Fix commit: Bluetooth: fix memory leak in error path of hci_alloc_dev()
Patched on: [ci-upstream-net-this-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 209d, last: 3d12h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision Error
6e94f034-f41f-4029-b638-346a4f859733 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in init_srcu_struct_fields 2026/05/30 06:03 2026/05/30 06:03 2026/05/30 06:47 6b4a844333e83556da95d61d7f207e7ef5cd4bc6
dc52c7e8-6a02-4548-bac1-18098f7eef14 assessment-security 💥 memory leak in init_srcu_struct_fields 2026/05/14 08:10 2026/05/14 08:10 2026/05/14 08:11 6ccb967e465e832a7bfd7a116ad00d52a0923a5d failed to run ["git" "pull" "origin" "HEAD" "--depth=1" "--allow-unrelated-histories"]: exit status 128 From /app/workdir/repo/linux * branch HEAD -> FETCH_HEAD Updating files: 27% (25953/93693) Updating files: 28% (26235/93693) Updating files: 29% (27171/93693) Updating files: 30% (28108/93693) Updating files: 31% (29045/93693) Updating files: 32% (29982/93693) Updating files: 33% (30919/93693) Updating files: 34% (31856/93693) Updating files: 35% (32793/93693) Updating files: 36% (33730/93693) Updating files: 37% (34667/93693) Updating files: 38% (35604/93693) Updating files: 38% (36228/93693) Updating files: 39% (36541/93693) Updating files: 39% (37363/93693) error: unable to write file drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_1_sh_mask.h error: unable to write file drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_3_0_offset.h error: unable to write file drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_3_0_sh_mask.h error: unable to write file drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_default.h error: unable to write file drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_offset.h error: unable to write file drivers/gpu/drm/amd/include/asic_reg/mmhub/mmhub_9_4_1_sh_mask.h fatal: cannot create directory at 'drivers/gpu/drm/amd/include/asic_reg/mp': No space left on device
▶ ▼ Discussions (8)
Title Replies (including bot) Last reply
[PATCH v5] Bluetooth: fix memory leak in error path of hci_alloc_dev() 2 (2) 2026/06/01 19:10
[PATCH v4] Bluetooth: fix memory leak in error path of hci_alloc_dev() 1 (1) 2026/05/31 18:53
[PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() 2 (2) 2026/05/31 18:13
[PATCH v3] Bluetooth: fix memory leak in error path of hci_alloc_dev() 1 (1) 2026/05/31 18:12
[PATCH v2] Bluetooth: fix memory leak in error path of hci_alloc_dev() 1 (2) 2026/05/31 16:11
[PATCH] Bluetooth: fix memory leaks in error path of hci_alloc_dev() 1 (2) 2026/05/31 15:27
[PATCH] Bluetooth: fix memory leaks in error path of hci_alloc_dev() 1 (2) 2026/05/31 14:59
[syzbot] [bluetooth?] memory leak in init_srcu_struct_fields 0 (4) 2026/05/31 00:13
▶ ▼ Last patch testing requests (17)
Created Duration User Patch Repo Result
2026/06/01 03:37 31m retest repro upstream report log
2026/05/31 15:27 32m kbreddy.rpbc@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f377d0025eb0 OK log
2026/05/31 14:41 28m kbreddy.rpbc@gmail.com patch git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git f377d0025eb0 report log
2026/05/31 14:25 26m kbreddy.rpbc@gmail.com patch upstream report log
2026/05/31 00:13 58m kartikey406@gmail.com patch upstream report log
2026/05/30 23:20 56m kartikey406@gmail.com patch linux-next report log
2026/05/30 23:18 51m kartikey406@gmail.com patch linux-next report log
2026/05/18 00:41 25m retest repro upstream report log
2026/05/18 00:41 26m retest repro upstream report log
2026/05/18 00:41 23m retest repro upstream report log
2026/05/18 00:41 21m retest repro upstream report log
2026/05/18 00:41 27m retest repro upstream report log
2026/04/06 10:33 16m retest repro upstream report log
2026/04/06 10:33 16m retest repro upstream report log
2026/04/06 10:33 17m retest repro upstream report log
2026/04/06 10:33 12m retest repro upstream report log
2026/01/13 16:59 15m kuniyu@google.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888111f49600 (size 512):
  comm "syz.0.17", pid 5937, jiffies 4294945495
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 6e7d3fde):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    __kmalloc_cache_noprof+0x371/0x480 mm/slub.c:5414
    kmalloc_noprof include/linux/slab.h:950 [inline]
    kzalloc_noprof include/linux/slab.h:1188 [inline]
    init_srcu_struct_fields+0x2c0/0x350 kernel/rcu/srcutree.c:207
    hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2453
    hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
    hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:644 [inline]
    hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:720 [inline]
    hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:774
    tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object (percpu) 0x607e4d93d800 (size 384):
  comm "syz.0.17", pid 5937, jiffies 4294945495
  hex dump (first 32 bytes on cpu 0):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 593bdea7):
    pcpu_alloc_noprof+0x7c7/0xed0 mm/percpu.c:1896
    init_srcu_struct_fields+0x2eb/0x350 kernel/rcu/srcutree.c:224
    hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2453
    hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
    hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:644 [inline]
    hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:720 [inline]
    hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:774
    tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object (percpu) 0x607e4d93d980 (size 384):
  comm "syz.0.18", pid 5940, jiffies 4294945497
  hex dump (first 32 bytes on cpu 0):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 593bdea7):
    pcpu_alloc_noprof+0x7c7/0xed0 mm/percpu.c:1896
    init_srcu_struct_fields+0x2eb/0x350 kernel/rcu/srcutree.c:224
    hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2453
    hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
    hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:644 [inline]
    hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:720 [inline]
    hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:774
    tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811d010a00 (size 512):
  comm "syz.0.19", pid 5951, jiffies 4294945502
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 2d3d1dd8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4574 [inline]
    slab_alloc_node mm/slub.c:4898 [inline]
    __kmalloc_cache_noprof+0x371/0x480 mm/slub.c:5414
    kmalloc_noprof include/linux/slab.h:950 [inline]
    kzalloc_noprof include/linux/slab.h:1188 [inline]
    init_srcu_struct_fields+0x2c0/0x350 kernel/rcu/srcutree.c:207
    hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2453
    hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
    hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:644 [inline]
    hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:720 [inline]
    hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:774
    tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object (percpu) 0x607e4d93db00 (size 384):
  comm "syz.0.19", pid 5951, jiffies 4294945502
  hex dump (first 32 bytes on cpu 0):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 593bdea7):
    pcpu_alloc_noprof+0x7c7/0xed0 mm/percpu.c:1896
    init_srcu_struct_fields+0x2eb/0x350 kernel/rcu/srcutree.c:224
    hci_alloc_dev_priv+0x37/0x680 net/bluetooth/hci_core.c:2453
    hci_alloc_dev include/net/bluetooth/hci_core.h:1763 [inline]
    hci_uart_register_dev drivers/bluetooth/hci_ldisc.c:644 [inline]
    hci_uart_set_proto drivers/bluetooth/hci_ldisc.c:720 [inline]
    hci_uart_tty_ioctl+0x173/0x460 drivers/bluetooth/hci_ldisc.c:774
    tty_ioctl+0xaca/0xd60 drivers/tty/tty_io.c:2801
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xee/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/03 23:25 upstream f377d0025eb0 a0d91488 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/04/25 08:46 upstream 27d128c1cff6 9c2d0995 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/04/25 07:34 upstream 27d128c1cff6 9c2d0995 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/04/12 23:14 upstream f5459048c38a 38c8e246 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/03/23 07:26 upstream 8d8bd2a5aa98 5b92003d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/03/15 15:18 upstream 267594792a71 ee8d34d6 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/03/12 20:53 upstream 80234b5ab240 4efadf07 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/02/20 23:06 upstream 8bf22c33e7a1 741f5161 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2026/01/12 00:15 upstream 755bc1335e3b d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2025/12/14 08:30 upstream 4a298a43f5e3 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
2025/11/07 14:47 upstream 4a0c9b339199 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in init_srcu_struct_fields
* Struck through repros no longer work on HEAD.