[syzbot] [kernel?] memory leak in do_timer_create

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 24172e0d7990 Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=165417cd980000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=9c47ad18f978d4394986
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15004914580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16ea6b42580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ded911fa4408/disk-24172e0d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a1f3e61cb784/vmlinux-24172e0d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b92fd0e25cb7/bzImage-24172e0d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9c47ad...@syzkaller.appspotmail.com

2025/11/12 09:47:51 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888108465800 (size 384):
comm "syz.0.17", pid 6100, jiffies 4294944668
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 1025e73e):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881084a0000 (size 384):
comm "syz.0.18", pid 6104, jiffies 4294944670
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc 63c47fd0):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881084a0180 (size 384):
comm "syz.0.19", pid 6107, jiffies 4294944671
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc d769495f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888108464600 (size 384):
comm "syz.0.20", pid 6127, jiffies 4294945201
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc a3c907e):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff8881084a0300 (size 384):
comm "syz.0.21", pid 6128, jiffies 4294945201
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace (crc bb0da4da):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478
__do_sys_timer_create kernel/time/posix-timers.c:584 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:573 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:573
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject:
Author: eslam.me...@gmail.com

#syz test

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in do_timer_create

2025/11/14 02:38:26 executed programs: 5
BUG: memory leak
unreferenced object 0xffff88810956c180 (size 384):
comm "syz.0.17", pid 6732, jiffies 4294946163

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc 64f02d39):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478

__do_sys_timer_create kernel/time/posix-timers.c:585 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:574 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:574

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak

unreferenced object 0xffff8881118c8000 (size 384):
comm "syz.0.18", pid 6735, jiffies 4294946164

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc d3965a85):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478

__do_sys_timer_create kernel/time/posix-timers.c:585 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:574 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:574

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak

unreferenced object 0xffff8881012d8d80 (size 384):
comm "syz.0.19", pid 6739, jiffies 4294946164

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc 593dfa0a):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478

__do_sys_timer_create kernel/time/posix-timers.c:585 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:574 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:574

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak

unreferenced object 0xffff8881012d9080 (size 384):
comm "syz.0.20", pid 6759, jiffies 4294946764

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc b63c44c):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478

__do_sys_timer_create kernel/time/posix-timers.c:585 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:574 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:574

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak

unreferenced object 0xffff88810956c000 (size 384):
comm "syz.0.21", pid 6761, jiffies 4294946764

hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................

backtrace (crc d05d1bb6):

kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
slab_alloc_node mm/slub.c:5288 [inline]
kmem_cache_alloc_noprof+0x397/0x5a0 mm/slub.c:5295
alloc_posix_timer kernel/time/posix-timers.c:429 [inline]
do_timer_create+0xe0/0x800 kernel/time/posix-timers.c:478

__do_sys_timer_create kernel/time/posix-timers.c:585 [inline]
__se_sys_timer_create kernel/time/posix-timers.c:574 [inline]
__x64_sys_timer_create+0xdb/0xf0 kernel/time/posix-timers.c:574

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=150ab532580000

kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=9c47ad18f978d4394986
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=138dc914580000

[syzbot]

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

SYZFAIL: failed to recv rpc

SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0


Warning: Permanently added '10.128.0.161' (ED25519) to the list of known hosts.
2025/11/14 04:06:56 parsed 1 programs
[ 44.794762][ T5813] cgroup: Unknown subsys name 'net'
[ 44.916181][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 44.923078][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 53.639357][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 55.177789][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 55.235590][ T5830] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 55.243035][ T5830] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 55.250812][ T5830] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 55.258701][ T5830] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 55.266968][ T5830] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 55.703638][ T799] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.712021][ T799] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.723063][ T3505] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 55.731244][ T3505] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 55.862606][ T5886] chnl_net:caif_netlink_parms(): no params data found
[ 55.884445][ T5886] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.891932][ T5886] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.899980][ T5886] bridge_slave_0: entered allmulticast mode
[ 55.907339][ T5886] bridge_slave_0: entered promiscuous mode
[ 55.913841][ T5886] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.921571][ T5886] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.929497][ T5886] bridge_slave_1: entered allmulticast mode
[ 55.935959][ T5886] bridge_slave_1: entered promiscuous mode
[ 55.948855][ T5886] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 55.958993][ T5886] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 55.972977][ T5886] team0: Port device team_slave_0 added
[ 55.979392][ T5886] team0: Port device team_slave_1 added
[ 55.992814][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 56.000997][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.028043][ T5886] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 56.039720][ T5886] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 56.046966][ T5886] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 56.073435][ T5886] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 56.094211][ T5886] hsr_slave_0: entered promiscuous mode
[ 56.100458][ T5886] hsr_slave_1: entered promiscuous mode
[ 56.138732][ T5886] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 56.147296][ T5886] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 56.155698][ T5886] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 56.164728][ T5886] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 56.182358][ T5886] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.189842][ T5886] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 56.197265][ T5886] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.204609][ T5886] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 56.224823][ T5886] 8021q: adding VLAN 0 to HW filter on device bond0
[ 56.234962][ T799] bridge0: port 1(bridge_slave_0) entered disabled state
[ 56.242843][ T799] bridge0: port 2(bridge_slave_1) entered disabled state
[ 56.253310][ T5886] 8021q: adding VLAN 0 to HW filter on device team0
[ 56.262879][ T4088] bridge0: port 1(bridge_slave_0) entered blocking state
[ 56.270547][ T4088] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 56.280312][ T799] bridge0: port 2(bridge_slave_1) entered blocking state
[ 56.288611][ T799] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 56.349969][ T5886] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 56.369518][ T5886] veth0_vlan: entered promiscuous mode
[ 56.378056][ T5886] veth1_vlan: entered promiscuous mode
[ 56.391688][ T5886] veth0_macvtap: entered promiscuous mode
[ 56.399665][ T5886] veth1_macvtap: entered promiscuous mode
[ 56.409561][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 56.419564][ T5886] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 56.429430][ T4088] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.438542][ T4088] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.448810][ T4088] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.458768][ T4088] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.508005][ T3505] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.566660][ T3505] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.626800][ T3505] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.661754][ T3505] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2025/11/14 04:07:11 executed programs: 0
[ 59.609579][ T3505] bridge_slave_1: left allmulticast mode
[ 59.615426][ T3505] bridge_slave_1: left promiscuous mode
[ 59.621249][ T3505] bridge0: port 2(bridge_slave_1) entered disabled state
[ 59.629795][ T3505] bridge_slave_0: left allmulticast mode
[ 59.635793][ T3505] bridge_slave_0: left promiscuous mode
[ 59.641606][ T3505] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.686984][ T3505] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 59.696872][ T3505] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 59.706397][ T3505] bond0 (unregistering): Released all slaves
[ 59.766608][ T3505] hsr_slave_0: left promiscuous mode
[ 59.772314][ T3505] hsr_slave_1: left promiscuous mode
[ 59.778134][ T3505] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 59.785926][ T3505] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 59.793421][ T3505] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 59.800982][ T3505] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 59.809400][ T3505] veth1_macvtap: left promiscuous mode
[ 59.815590][ T3505] veth0_macvtap: left promiscuous mode
[ 59.821279][ T3505] veth1_vlan: left promiscuous mode
[ 59.827043][ T3505] veth0_vlan: left promiscuous mode
[ 59.854694][ T3505] team0 (unregistering): Port device team_slave_1 removed
[ 59.864443][ T3505] team0 (unregistering): Port device team_slave_0 removed
[ 62.773039][ T5134] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 62.780656][ T5134] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 62.788115][ T5134] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 62.795522][ T5134] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 62.802757][ T5134] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 62.843777][ T5986] chnl_net:caif_netlink_parms(): no params data found
[ 62.865722][ T5986] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.873096][ T5986] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.880487][ T5986] bridge_slave_0: entered allmulticast mode
[ 62.886927][ T5986] bridge_slave_0: entered promiscuous mode
[ 62.894424][ T5986] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.901897][ T5986] bridge0: port 2(bridge_slave_1) entered disabled state
[ 62.909417][ T5986] bridge_slave_1: entered allmulticast mode
[ 62.915886][ T5986] bridge_slave_1: entered promiscuous mode
[ 62.929191][ T5986] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 62.939350][ T5986] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 62.953231][ T5986] team0: Port device team_slave_0 added
[ 62.959588][ T5986] team0: Port device team_slave_1 added
[ 62.970025][ T5986] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 62.977198][ T5986] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.004432][ T5986] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 63.016146][ T5986] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 63.023370][ T5986] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 63.050199][ T5986] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 63.068827][ T5986] hsr_slave_0: entered promiscuous mode
[ 63.074768][ T5986] hsr_slave_1: entered promiscuous mode
[ 63.270626][ T5986] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 63.279475][ T5986] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 63.287689][ T5986] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 63.296051][ T5986] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 63.309900][ T5986] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.317471][ T5986] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.324775][ T5986] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.332055][ T5986] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.356494][ T5986] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.366968][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.374534][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.385713][ T5986] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.395204][ T12] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.402380][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.413862][ T3505] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.421039][ T3505] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.480639][ T5986] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 63.499969][ T5986] veth0_vlan: entered promiscuous mode
[ 63.507992][ T5986] veth1_vlan: entered promiscuous mode
[ 63.521865][ T5986] veth0_macvtap: entered promiscuous mode
[ 63.529847][ T5986] veth1_macvtap: entered promiscuous mode
[ 63.540597][ T5986] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 63.550698][ T5986] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 63.560492][ T3505] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.577114][ T3505] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.593044][ T3505] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.606395][ T3505] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.615277][ T3505] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.623464][ T3505] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
SYZFAIL: failed to recv rpc
[ 63.637976][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.646104][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
fd=3 want=4 recv=0 n=0


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3477257999=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 4e1406b4def
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=4e1406b4defac0e2a9d9424c70706f79a7750cf3 -X github.com/google/syzkaller/prog.gitRevisionDate=20251106-151142" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"4e1406b4defac0e2a9d9424c70706f79a7750cf3\"
/usr/bin/ld: /tmp/ccvZzLPE.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null

Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=9c47ad18f978d4394986
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=14d69c12580000

[syzbot]

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+9c47ad...@syzkaller.appspotmail.com
Tested-by: syzbot+9c47ad...@syzkaller.appspotmail.com

Tested on:

commit: 6da43bbe Merge tag 'vfio-v6.18-rc6' of https://github...
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1429bc12580000

kernel config: https://syzkaller.appspot.com/x/.config?x=cb128cd5cb439809
dashboard link: https://syzkaller.appspot.com/bug?extid=9c47ad18f978d4394986
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40

patch: https://syzkaller.appspot.com/x/patch.diff?x=13e408b4580000

Note: testing is done by a robot and is best-effort only.

[Thomas Gleixner]

When posix timer creation is set to allocate a given timer ID and the
access to the user space value faults, the function terminates without
freeing the already allocated posix timer structure.

Move the allocation after the user space access to cure that.

Fixes: ec2d0c04624b ("posix-timers: Provide a mechanism to allocate a given timer ID")
Reported-by: syzbot+9c47ad...@syzkaller.appspotmail.com
Signed-off-by: Thomas Gleixner <tg...@linutronix.de>
Closes: https://lore.kernel.org/all/69155df4.a70a022...@google.com
---
kernel/time/posix-timers.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)

--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -475,12 +475,6 @@ static int do_timer_create(clockid_t whi
if (!kc->timer_create)
return -EOPNOTSUPP;

- new_timer = alloc_posix_timer();
- if (unlikely(!new_timer))
- return -EAGAIN;
-
- spin_lock_init(&new_timer->it_lock);
-
/* Special case for CRIU to restore timers with a given timer ID. */
if (unlikely(current->signal->timer_create_restore_ids)) {
if (copy_from_user(&req_id, created_timer_id, sizeof(req_id)))
@@ -490,6 +484,12 @@ static int do_timer_create(clockid_t whi
return -EINVAL;
}

+ new_timer = alloc_posix_timer();
+ if (unlikely(!new_timer))
+ return -EAGAIN;
+
+ spin_lock_init(&new_timer->it_lock);
+
/*
* Add the timer to the hash table. The timer is not yet valid
* after insertion, but has a unique ID allocated.