syzbot

 sign-in | mailing list | source | docs
🐞 Open [1455]
≡ Subsystems
🐞 Fixed [6881]
🐞 Invalid [17876]
⬇ Missing Backports [224]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in v4l2_ctrl_handler_init_class (2)

Status: upstream: reported C repro on 2025/11/25 07:55
Subsystems: usb media
[Documentation on labels]
Reported-by: syzbot+a41b73dce23962a74c72@syzkaller.appspotmail.com
Fix commit: media: radio-keene: fix memory leak in error path
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 65d, last: 5d17h
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH v3] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/29 10:01
[PATCH] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/27 16:56
[PATCH v2] media: radio-keene: fix memory leak in error path 2 (2) 2025/11/26 17:46
[syzbot] [media?] [usb?] memory leak in v4l2_ctrl_handler_init_class (2) 3 (7) 2025/11/25 21:29
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in v4l2_ctrl_handler_init_class usb media 3 C 12 1742d 1795d 20/29 fixed on 2021/11/10 00:50
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/12/09 21:58 19m retest repro upstream report log
2025/12/09 21:58 14m retest repro upstream report log
2025/11/25 20:21 20m ssranevjti@gmail.com patch upstream OK log
2025/11/25 17:03 31m ssranevjti@gmail.com patch upstream OK log
2025/11/25 17:01 16m ssranevjti@gmail.com upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888110656708 (size 8):
  comm "kworker/0:4", pid 5946, jiffies 4294942555
  hex dump (first 8 bytes):
    c0 d0 ea 1a 81 88 ff ff                          ........
  backtrace (crc 480f7a2c):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x50c/0x800 mm/slub.c:7136
    kvmalloc_array_node_noprof include/linux/slab.h:1122 [inline]
    v4l2_ctrl_handler_init_class+0x59/0x80 drivers/media/v4l2-core/v4l2-ctrls-core.c:1706
    usb_keene_probe+0xc4/0x440 drivers/media/radio/radio-keene.c:326
    usb_probe_interface+0x246/0x5b0 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:581 [inline]
    really_probe+0x12f/0x430 drivers/base/dd.c:659
    __driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
    bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1031
    device_initial_probe+0x6a/0x70 drivers/base/dd.c:1086
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x983/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x961/0xc70 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x83/0xd0 drivers/usb/core/generic.c:250
    usb_probe_device+0x7c/0x1d0 drivers/usb/core/driver.c:291

BUG: memory leak
unreferenced object 0xffff88811ac44400 (size 256):
  comm "kworker/0:4", pid 5946, jiffies 4294942555
  hex dump (first 32 bytes):
    00 40 c4 1a 81 88 ff ff 00 42 c4 1a 81 88 ff ff  .@.......B......
    10 44 c4 1a 81 88 ff ff 10 44 c4 1a 81 88 ff ff  .D.......D......
  backtrace (crc 5a8e4f0d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x50c/0x800 mm/slub.c:7136
    v4l2_ctrl_new+0x2bf/0x1340 drivers/media/v4l2-core/v4l2-ctrls-core.c:2112
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    usb_keene_probe+0xe8/0x440 drivers/media/radio/radio-keene.c:327
    usb_probe_interface+0x246/0x5b0 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:581 [inline]
    really_probe+0x12f/0x430 drivers/base/dd.c:659
    __driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
    bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1031
    device_initial_probe+0x6a/0x70 drivers/base/dd.c:1086
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574
    device_add+0x983/0xc80 drivers/base/core.c:3689
    usb_set_configuration+0x961/0xc70 drivers/usb/core/message.c:2210
    usb_generic_driver_probe+0x83/0xd0 drivers/usb/core/generic.c:250

BUG: memory leak
unreferenced object 0xffff88811ac44200 (size 256):
  comm "kworker/0:4", pid 5946, jiffies 4294942555
  hex dump (first 32 bytes):
    00 44 c4 1a 81 88 ff ff 30 ed f0 13 81 88 ff ff  .D......0.......
    10 42 c4 1a 81 88 ff ff 10 42 c4 1a 81 88 ff ff  .B.......B......
  backtrace (crc 804cbcec):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kvmalloc_node_noprof+0x50c/0x800 mm/slub.c:7136
    v4l2_ctrl_new+0x2bf/0x1340 drivers/media/v4l2-core/v4l2-ctrls-core.c:2112
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    handler_new_ref+0x352/0x450 drivers/media/v4l2-core/v4l2-ctrls-core.c:1853
    v4l2_ctrl_new+0x67d/0x1340 drivers/media/v4l2-core/v4l2-ctrls-core.c:2195
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    usb_keene_probe+0xe8/0x440 drivers/media/radio/radio-keene.c:327
    usb_probe_interface+0x246/0x5b0 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:581 [inline]
    really_probe+0x12f/0x430 drivers/base/dd.c:659
    __driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
    bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1031
    device_initial_probe+0x6a/0x70 drivers/base/dd.c:1086
    bus_probe_device+0x3e/0xb0 drivers/base/bus.c:574

BUG: memory leak
unreferenced object 0xffff88811aead880 (size 64):
  comm "kworker/0:4", pid 5946, jiffies 4294942555
  hex dump (first 32 bytes):
    80 d1 ea 1a 81 88 ff ff 40 ed f0 13 81 88 ff ff  ........@.......
    00 00 00 00 00 00 00 00 00 42 c4 1a 81 88 ff ff  .........B......
  backtrace (crc a938bb66):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    handler_new_ref+0xd7/0x450 drivers/media/v4l2-core/v4l2-ctrls-core.c:1861
    v4l2_ctrl_new+0x67d/0x1340 drivers/media/v4l2-core/v4l2-ctrls-core.c:2195
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    handler_new_ref+0x352/0x450 drivers/media/v4l2-core/v4l2-ctrls-core.c:1853
    v4l2_ctrl_new+0x67d/0x1340 drivers/media/v4l2-core/v4l2-ctrls-core.c:2195
    v4l2_ctrl_new_std+0x122/0x180 drivers/media/v4l2-core/v4l2-ctrls-core.c:2266
    usb_keene_probe+0xe8/0x440 drivers/media/radio/radio-keene.c:327
    usb_probe_interface+0x246/0x5b0 drivers/usb/core/driver.c:396
    call_driver_probe drivers/base/dd.c:581 [inline]
    really_probe+0x12f/0x430 drivers/base/dd.c:659
    __driver_probe_device+0xc3/0x1a0 drivers/base/dd.c:801
    driver_probe_device+0x2a/0x120 drivers/base/dd.c:831
    __device_attach_driver+0x10f/0x170 drivers/base/dd.c:959
    bus_for_each_drv+0xcf/0x120 drivers/base/bus.c:500
    __device_attach+0xf9/0x290 drivers/base/dd.c:1031
    device_initial_probe+0x6a/0x70 drivers/base/dd.c:1086

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/20 03:10 upstream 24d479d26b25 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 13:26 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 12:01 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/17 11:40 upstream 39d3389331ab d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:53 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:38 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2026/01/16 19:07 upstream 983d014aafb1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 12:46 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 11:46 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
2025/11/21 07:51 upstream fd95357fd8c6 280ea308 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in v4l2_ctrl_handler_init_class
* Struck through repros no longer work on HEAD.