Hello, syzbot found the following issue on: HEAD commit: 6f1f5caed5bf Merge tag 'for-linus-6.2-ofs1' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=11a5aa57880000 kernel config: https://syzkaller.appspot.com/x/.config?x=aa9d05fc5567240b dashboard link: https://syzkaller.appspot.com/bug?extid=e9632e3eb038d93d6bc6 compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1138a5c0480000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d07e77880000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/e0b09490fc5c/disk-6f1f5cae.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/2f00e5ef8dce/vmlinux-6f1f5cae.xz kernel image: https://storage.googleapis.com/syzbot-assets/78f4c439075f/bzImage-6f1f5cae.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+e9632e3eb038d93d6bc6@xxxxxxxxxxxxxxxxxxxxxxxxx BUG: memory leak unreferenced object 0xffff888101f97700 (size 240): comm "softirq", pid 0, jiffies 4294945988 (age 15.200s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83ac0212>] __alloc_skb+0x202/0x270 net/core/skbuff.c:552 [<ffffffff83ac396a>] __netdev_alloc_skb+0x6a/0x220 net/core/skbuff.c:630 [<ffffffff82df70d0>] __dev_alloc_skb include/linux/skbuff.h:3165 [inline] [<ffffffff82df70d0>] ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline] [<ffffffff82df70d0>] ath9k_hif_usb_rx_cb+0x1d0/0x660 drivers/net/wireless/ath/ath9k/hif_usb.c:686 [<ffffffff82fd9d89>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1671 [<ffffffff82fda06b>] usb_hcd_giveback_urb+0x1ab/0x1c0 drivers/usb/core/hcd.c:1754 [<ffffffff8318c0b4>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [<ffffffff81328243>] call_timer_fn+0x33/0x1f0 kernel/time/timer.c:1700 [<ffffffff813284ff>] expire_timers+0xff/0x1d0 kernel/time/timer.c:1751 [<ffffffff813286f9>] __run_timers kernel/time/timer.c:2022 [inline] [<ffffffff813286f9>] __run_timers kernel/time/timer.c:1995 [inline] [<ffffffff813286f9>] run_timer_softirq+0x129/0x2f0 kernel/time/timer.c:2035 [<ffffffff84c000eb>] __do_softirq+0xeb/0x2ef kernel/softirq.c:571 [<ffffffff8126a086>] invoke_softirq kernel/softirq.c:445 [inline] [<ffffffff8126a086>] __irq_exit_rcu+0xc6/0x110 kernel/softirq.c:650 [<ffffffff848a7742>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1107 [<ffffffff84a00cc6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 [<ffffffff848bd6e9>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [<ffffffff848bd6e9>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [<ffffffff848bd6e9>] acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline] [<ffffffff848bd6e9>] acpi_idle_do_entry+0xc9/0xe0 drivers/acpi/processor_idle.c:570 [<ffffffff848bdc00>] acpi_idle_enter+0x150/0x230 drivers/acpi/processor_idle.c:707 [<ffffffff83699eb4>] cpuidle_enter_state+0xc4/0x740 drivers/cpuidle/cpuidle.c:239 BUG: memory leak unreferenced object 0xffff88810c312800 (size 1024): comm "softirq", pid 0, jiffies 4294945988 (age 15.200s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff814f6467>] __do_kmalloc_node mm/slab_common.c:967 [inline] [<ffffffff814f6467>] __kmalloc_node_track_caller+0x47/0x120 mm/slab_common.c:988 [<ffffffff83ac00f1>] kmalloc_reserve net/core/skbuff.c:492 [inline] [<ffffffff83ac00f1>] __alloc_skb+0xe1/0x270 net/core/skbuff.c:565 [<ffffffff83ac396a>] __netdev_alloc_skb+0x6a/0x220 net/core/skbuff.c:630 [<ffffffff82df70d0>] __dev_alloc_skb include/linux/skbuff.h:3165 [inline] [<ffffffff82df70d0>] ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline] [<ffffffff82df70d0>] ath9k_hif_usb_rx_cb+0x1d0/0x660 drivers/net/wireless/ath/ath9k/hif_usb.c:686 [<ffffffff82fd9d89>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1671 [<ffffffff82fda06b>] usb_hcd_giveback_urb+0x1ab/0x1c0 drivers/usb/core/hcd.c:1754 [<ffffffff8318c0b4>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [<ffffffff81328243>] call_timer_fn+0x33/0x1f0 kernel/time/timer.c:1700 [<ffffffff813284ff>] expire_timers+0xff/0x1d0 kernel/time/timer.c:1751 [<ffffffff813286f9>] __run_timers kernel/time/timer.c:2022 [inline] [<ffffffff813286f9>] __run_timers kernel/time/timer.c:1995 [inline] [<ffffffff813286f9>] run_timer_softirq+0x129/0x2f0 kernel/time/timer.c:2035 [<ffffffff84c000eb>] __do_softirq+0xeb/0x2ef kernel/softirq.c:571 [<ffffffff8126a086>] invoke_softirq kernel/softirq.c:445 [inline] [<ffffffff8126a086>] __irq_exit_rcu+0xc6/0x110 kernel/softirq.c:650 [<ffffffff848a7742>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1107 [<ffffffff84a00cc6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 [<ffffffff848bd6e9>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [<ffffffff848bd6e9>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [<ffffffff848bd6e9>] acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline] [<ffffffff848bd6e9>] acpi_idle_do_entry+0xc9/0xe0 drivers/acpi/processor_idle.c:570 [<ffffffff848bdc00>] acpi_idle_enter+0x150/0x230 drivers/acpi/processor_idle.c:707 BUG: memory leak unreferenced object 0xffff888101f97500 (size 240): comm "softirq", pid 0, jiffies 4294945988 (age 15.200s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff83ac0212>] __alloc_skb+0x202/0x270 net/core/skbuff.c:552 [<ffffffff83ac396a>] __netdev_alloc_skb+0x6a/0x220 net/core/skbuff.c:630 [<ffffffff82df70d0>] __dev_alloc_skb include/linux/skbuff.h:3165 [inline] [<ffffffff82df70d0>] ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:635 [inline] [<ffffffff82df70d0>] ath9k_hif_usb_rx_cb+0x1d0/0x660 drivers/net/wireless/ath/ath9k/hif_usb.c:686 [<ffffffff82fd9d89>] __usb_hcd_giveback_urb+0xf9/0x230 drivers/usb/core/hcd.c:1671 [<ffffffff82fda06b>] usb_hcd_giveback_urb+0x1ab/0x1c0 drivers/usb/core/hcd.c:1754 [<ffffffff8318c0b4>] dummy_timer+0x8e4/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1988 [<ffffffff81328243>] call_timer_fn+0x33/0x1f0 kernel/time/timer.c:1700 [<ffffffff813284ff>] expire_timers+0xff/0x1d0 kernel/time/timer.c:1751 [<ffffffff813286f9>] __run_timers kernel/time/timer.c:2022 [inline] [<ffffffff813286f9>] __run_timers kernel/time/timer.c:1995 [inline] [<ffffffff813286f9>] run_timer_softirq+0x129/0x2f0 kernel/time/timer.c:2035 [<ffffffff84c000eb>] __do_softirq+0xeb/0x2ef kernel/softirq.c:571 [<ffffffff8126a086>] invoke_softirq kernel/softirq.c:445 [inline] [<ffffffff8126a086>] __irq_exit_rcu+0xc6/0x110 kernel/softirq.c:650 [<ffffffff848a7742>] sysvec_apic_timer_interrupt+0xa2/0xd0 arch/x86/kernel/apic/apic.c:1107 [<ffffffff84a00cc6>] asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649 [<ffffffff848bd6e9>] native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline] [<ffffffff848bd6e9>] arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline] [<ffffffff848bd6e9>] acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline] [<ffffffff848bd6e9>] acpi_idle_do_entry+0xc9/0xe0 drivers/acpi/processor_idle.c:570 [<ffffffff848bdc00>] acpi_idle_enter+0x150/0x230 drivers/acpi/processor_idle.c:707 [<ffffffff83699eb4>] cpuidle_enter_state+0xc4/0x740 drivers/cpuidle/cpuidle.c:239 --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@xxxxxxxxxxxxxxxx. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. syzbot can test patches for this issue, for details see: https://goo.gl/tpsmEJ#testing-patches
