[syzbot] [hams?] memory leak in nr_add_node

2 views

Skip to first unread message

syzbot

unread,

Jan 15, 2026, 3:04:36 PM (12 hours ago) Jan 15

to da...@davemloft.net, edum...@google.com, ho...@kernel.org, ku...@kernel.org, linux...@vger.kernel.org, linux-...@vger.kernel.org, net...@vger.kernel.org, pab...@redhat.com, syzkall...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: ea1013c15392 Merge tag 'bpf-fixes' of git://git.kernel.org..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=147cb184580000
kernel config: https://syzkaller.appspot.com/x/.config?x=d60836e327fd6756
dashboard link: https://syzkaller.appspot.com/bug?extid=3f2d46b6e62b8dd546d3
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13c839b4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=127cb184580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5ee91238d53c/disk-ea1013c1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b8eb70b8203f/vmlinux-ea1013c1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3aed81c1b1c5/bzImage-ea1013c1.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/6e21e0104490/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3f2d46...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88811b404b80 (size 64):
comm "syz.0.17", pid 6071, jiffies 4294944872
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
cc cc cc cc cc cc 02 00 00 00 00 00 00 00 00 00 ................
backtrace (crc f88ea0ab):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
nr_add_node+0x5bf/0x14b0 net/netrom/nr_route.c:146
nr_rt_ioctl+0xc32/0x16e0 net/netrom/nr_route.c:651
nr_ioctl+0x11f/0x1a0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
sock_ioctl+0x149/0x480 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811b404d00 (size 64):
comm "syz.0.18", pid 6078, jiffies 4294944884
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
cc cc cc cc cc cc 02 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 8f10725b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
nr_add_node+0x5bf/0x14b0 net/netrom/nr_route.c:146
nr_rt_ioctl+0xc32/0x16e0 net/netrom/nr_route.c:651
nr_ioctl+0x11f/0x1a0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
sock_ioctl+0x149/0x480 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811b404f80 (size 64):
comm "syz.0.19", pid 6086, jiffies 4294944897
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
cc cc cc cc cc cc 02 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 14b53e34):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]
nr_add_node+0x5bf/0x14b0 net/netrom/nr_route.c:146
nr_rt_ioctl+0xc32/0x16e0 net/netrom/nr_route.c:651
nr_ioctl+0x11f/0x1a0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
sock_ioctl+0x149/0x480 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Jan 15, 2026, 9:19:18 PM (5 hours ago) Jan 15

to linux-...@vger.kernel.org, syzkall...@googlegroups.com

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] netrom: fix memory leak in nr_add_node()
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When nr_add_node() creates a new neighbor but the route quality is too
low to be added (node already has 3 routes with better quality), the
newly allocated neighbor is never used but remains in the neighbor list
with refcount=1, causing a memory leak.

Fix by checking if the new neighbor was actually used (count > 0) and
removing it from the list if not.

Reported-by: syzbot+3f2d46...@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
net/netrom/nr_route.c | 5 +++++
1 file changed, 5 insertions(+)

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index b94cb2ffbaf8..4b85bacb7f65 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -100,6 +100,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
{
struct nr_node *nr_node;
struct nr_neigh *nr_neigh;
+ bool new_neigh = false;
int i, found;
struct net_device *odev;

@@ -172,6 +173,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
}
}

+ new_neigh = true;
spin_lock_bh(&nr_neigh_list_lock);
hlist_add_head(&nr_neigh->neigh_node, &nr_neigh_list);
nr_neigh_hold(nr_neigh);
@@ -279,6 +281,9 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
}
}

+ if (new_neigh && nr_neigh->count == 0)
+ nr_remove_neigh(nr_neigh);
+
nr_neigh_put(nr_neigh);
nr_node_unlock(nr_node);
nr_node_put(nr_node);
--
2.43.0

syzbot

unread,

Jan 15, 2026, 10:02:05 PM (5 hours ago) Jan 15

to karti...@gmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)

Warning: Permanently added '10.128.0.92' (ED25519) to the list of known hosts.
2026/01/16 03:01:03 parsed 1 programs
[ 43.274917][ T5817] cgroup: Unknown subsys name 'net'
[ 43.453971][ T5817] cgroup: Unknown subsys name 'cpuset'
[ 43.460625][ T5817] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 51.660653][ T5817] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 52.936056][ T5823] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 53.185904][ T50] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 53.193118][ T50] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 53.200458][ T50] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 53.208221][ T50] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 53.215870][ T50] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 53.301342][ T5855] chnl_net:caif_netlink_parms(): no params data found
[ 53.323226][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.332459][ T5855] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.340240][ T5855] bridge_slave_0: entered allmulticast mode
[ 53.347229][ T5855] bridge_slave_0: entered promiscuous mode
[ 53.354632][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.362940][ T5855] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.370681][ T5855] bridge_slave_1: entered allmulticast mode
[ 53.377466][ T5855] bridge_slave_1: entered promiscuous mode
[ 53.389405][ T5855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 53.400348][ T5855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 53.416700][ T5855] team0: Port device team_slave_0 added
[ 53.423294][ T5855] team0: Port device team_slave_1 added
[ 53.433309][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 53.440612][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 53.467851][ T5855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 53.481327][ T5855] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 53.488635][ T5855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 53.516002][ T5855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 53.535524][ T5855] hsr_slave_0: entered promiscuous mode
[ 53.541713][ T5855] hsr_slave_1: entered promiscuous mode
[ 53.574372][ T5855] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 53.583517][ T5855] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 53.591751][ T5855] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 53.600646][ T5855] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 53.614549][ T5855] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.622088][ T5855] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.630043][ T5855] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.637781][ T5855] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.660522][ T5855] 8021q: adding VLAN 0 to HW filter on device bond0
[ 53.670073][ T3650] bridge0: port 1(bridge_slave_0) entered disabled state
[ 53.678501][ T3650] bridge0: port 2(bridge_slave_1) entered disabled state
[ 53.688598][ T5855] 8021q: adding VLAN 0 to HW filter on device team0
[ 53.697705][ T1326] bridge0: port 1(bridge_slave_0) entered blocking state
[ 53.704973][ T1326] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 53.714642][ T1326] bridge0: port 2(bridge_slave_1) entered blocking state
[ 53.721984][ T1326] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 53.763780][ T5855] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 53.780112][ T5855] veth0_vlan: entered promiscuous mode
[ 53.787498][ T5855] veth1_vlan: entered promiscuous mode
[ 53.799529][ T5855] veth0_macvtap: entered promiscuous mode
[ 53.807519][ T5855] veth1_macvtap: entered promiscuous mode
[ 53.818491][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 53.829013][ T5855] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 53.839887][ T1326] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.850698][ T1326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.861035][ T1326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.871232][ T1326] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 53.906896][ T1326] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 53.966995][ T1326] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 53.995814][ T1326] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 54.034202][ T1326] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 54.159038][ T2114] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 54.167245][ T2114] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 54.178245][ T2114] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 54.186557][ T2114] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
2026/01/16 03:01:16 executed programs: 0
[ 56.923092][ T1326] bridge_slave_1: left allmulticast mode
[ 56.928869][ T1326] bridge_slave_1: left promiscuous mode
[ 56.934672][ T1326] bridge0: port 2(bridge_slave_1) entered disabled state
[ 56.942646][ T1326] bridge_slave_0: left allmulticast mode
[ 56.948885][ T1326] bridge_slave_0: left promiscuous mode
[ 56.954803][ T1326] bridge0: port 1(bridge_slave_0) entered disabled state
[ 57.005555][ T1326] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 57.016763][ T1326] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 57.026927][ T1326] bond0 (unregistering): Released all slaves
[ 57.095657][ T1326] hsr_slave_0: left promiscuous mode
[ 57.101342][ T1326] hsr_slave_1: left promiscuous mode
[ 57.107620][ T1326] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 57.115348][ T1326] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 57.123767][ T1326] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 57.131458][ T1326] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 57.140538][ T1326] veth1_macvtap: left promiscuous mode
[ 57.146257][ T1326] veth0_macvtap: left promiscuous mode
[ 57.152195][ T1326] veth1_vlan: left promiscuous mode
[ 57.157593][ T1326] veth0_vlan: left promiscuous mode
[ 57.181303][ T1326] team0 (unregistering): Port device team_slave_1 removed
[ 57.191493][ T1326] team0 (unregistering): Port device team_slave_0 removed
[ 60.054828][ T5138] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 60.062525][ T5138] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 60.070581][ T5138] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 60.078714][ T5138] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 60.086705][ T5138] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 60.122310][ T5991] chnl_net:caif_netlink_parms(): no params data found
[ 60.142671][ T5991] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.151380][ T5991] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.159631][ T5991] bridge_slave_0: entered allmulticast mode
[ 60.166599][ T5991] bridge_slave_0: entered promiscuous mode
[ 60.173566][ T5991] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.180823][ T5991] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.188212][ T5991] bridge_slave_1: entered allmulticast mode
[ 60.194588][ T5991] bridge_slave_1: entered promiscuous mode
[ 60.206157][ T5991] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 60.216527][ T5991] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 60.230103][ T5991] team0: Port device team_slave_0 added
[ 60.236725][ T5991] team0: Port device team_slave_1 added
[ 60.246712][ T5991] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 60.254114][ T5991] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 60.281073][ T5991] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 60.292352][ T5991] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 60.299876][ T5991] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 60.326817][ T5991] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 60.344691][ T5991] hsr_slave_0: entered promiscuous mode
[ 60.350528][ T5991] hsr_slave_1: entered promiscuous mode
[ 60.547249][ T5991] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 60.556770][ T5991] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 60.565261][ T5991] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 60.574345][ T5991] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 60.595999][ T5991] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.603416][ T5991] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 60.610769][ T5991] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.617975][ T5991] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 60.640024][ T5991] 8021q: adding VLAN 0 to HW filter on device bond0
[ 60.651654][ T1326] bridge0: port 1(bridge_slave_0) entered disabled state
[ 60.661595][ T1326] bridge0: port 2(bridge_slave_1) entered disabled state
[ 60.672035][ T5991] 8021q: adding VLAN 0 to HW filter on device team0
[ 60.681942][ T3533] bridge0: port 1(bridge_slave_0) entered blocking state
[ 60.689121][ T3533] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 60.700374][ T3533] bridge0: port 2(bridge_slave_1) entered blocking state
[ 60.707777][ T3533] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 60.765855][ T5991] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 60.785272][ T5991] veth0_vlan: entered promiscuous mode
[ 60.794067][ T5991] veth1_vlan: entered promiscuous mode
[ 60.813474][ T5991] veth0_macvtap: entered promiscuous mode
[ 60.820492][ T5991] veth1_macvtap: entered promiscuous mode
[ 60.830830][ T5991] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 60.844272][ T5991] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 60.859022][ T1326] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.868601][ T1326] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.882791][ T1326] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 60.895230][ T1326] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 60.917026][ T1326] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 60.930526][ T1326] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 60.943597][ T3533] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 60.951565][ T3533] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50

syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build224329181=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at d6526ea3e
nothing to commit, working tree clean

tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/cczh2cP8.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null

Tested on:

commit: 983d014a kernel: modules: Add SPDX license identifier ..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=87bc41cae23d2144

dashboard link: https://syzkaller.appspot.com/bug?extid=3f2d46b6e62b8dd546d3
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=16cae39a580000

syzbot

unread,

Jan 15, 2026, 10:40:17 PM (4 hours ago) Jan 15

to linux-...@vger.kernel.org, syzkall...@googlegroups.com

Also fix the same leak in the error path when nr_node allocation fails
after creating a new neighbor.

Fix by tracking whether a new neighbor was allocated and removing it
from the list if it was not used (count == 0) or on allocation failure.

Reported-by: syzbot+3f2d46...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3f2d46b6e62b8dd546d3

Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---

net/netrom/nr_route.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index b94cb2ffbaf8..a1591a8f8456 100644

--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -100,6 +100,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
{
struct nr_node *nr_node;
struct nr_neigh *nr_neigh;
+ bool new_neigh = false;
int i, found;
struct net_device *odev;

@@ -172,6 +173,7 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,
}
}

+ new_neigh = true;
spin_lock_bh(&nr_neigh_list_lock);
hlist_add_head(&nr_neigh->neigh_node, &nr_neigh_list);
nr_neigh_hold(nr_neigh);

@@ -183,8 +185,11 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,

if (nr_node == NULL) {
if ((nr_node = kmalloc(sizeof(*nr_node), GFP_ATOMIC)) == NULL) {
- if (nr_neigh)
+ if (nr_neigh) {
+ if (new_neigh)
+ nr_remove_neigh(nr_neigh);
nr_neigh_put(nr_neigh);
+ }
return -ENOMEM;
}

@@ -279,6 +284,9 @@ static int __must_check nr_add_node(ax25_address *nr, const char *mnemonic,

syzbot

unread,

Jan 15, 2026, 11:49:06 PM (3 hours ago) Jan 15

to karti...@gmail.com, linux-...@vger.kernel.org, syzkall...@googlegroups.com

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in nr_add_node

BUG: memory leak
unreferenced object 0xffff88811b69c2c0 (size 64):
comm "syz.0.17", pid 6736, jiffies 4294946654

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
cc cc cc cc cc cc 02 00 00 00 00 00 00 00 00 00 ................

backtrace (crc aa6a12dc):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4958 [inline]
slab_alloc_node mm/slub.c:5263 [inline]
__kmalloc_cache_noprof+0x3b2/0x570 mm/slub.c:5771
kmalloc_noprof include/linux/slab.h:957 [inline]

nr_add_node+0x686/0x1540 net/netrom/nr_route.c:147
nr_rt_ioctl+0xaec/0x1410 net/netrom/nr_route.c:659

nr_ioctl+0x11f/0x1a0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x84/0x1a0 net/socket.c:1254
sock_ioctl+0x149/0x480 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak

unreferenced object 0xffff88811bb55480 (size 64):
comm "syz.0.18", pid 6750, jiffies 4294946665

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
cc cc cc cc cc cc 02 00 00 00 00 00 00 00 00 00 ................

backtrace (crc ddf4c02c):

nr_add_node+0x686/0x1540 net/netrom/nr_route.c:147
nr_rt_ioctl+0xaec/0x1410 net/netrom/nr_route.c:659

unreferenced object 0xffff88811b69c5c0 (size 64):
comm "syz.0.19", pid 6764, jiffies 4294946677

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
cc cc cc cc cc cc 02 00 00 00 00 00 00 00 00 00 ................

backtrace (crc 46518c43):

nr_add_node+0x686/0x1540 net/netrom/nr_route.c:147
nr_rt_ioctl+0xaec/0x1410 net/netrom/nr_route.c:659

Tested on:

commit: 983d014a kernel: modules: Add SPDX license identifier ..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=11bd439a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=87bc41cae23d2144
dashboard link: https://syzkaller.appspot.com/bug?extid=3f2d46b6e62b8dd546d3
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40