From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932418AbcHSVRk (ORCPT ); Fri, 19 Aug 2016 17:17:40 -0400 Received: from mail-oi0-f66.google.com ([209.85.218.66]:34721 "EHLO mail-oi0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754127AbcHSVRf (ORCPT ); Fri, 19 Aug 2016 17:17:35 -0400 To: Marcel Holtmann , Gustavo Padovan , Johan Hedberg , Linux Bluetooth mailing list , LKML From: Larry Finger Subject: Memory (skb) leak in kernel 4.8-rc2 Message-ID: Date: Fri, 19 Aug 2016 16:02:44 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2 MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org I am seeing two skb leaks in the BT sub-system for kernel 4.8-rc2. I only recently re-enabled kmemleak, but I do not think I saw these leaks in 4.7. The first leak is at btusb_recv_intr+0x12b/0x170 [btusb]. This address refers to the call to bt_skb_alloc() in routine btusb_recv_intr(). The second leak is at hci_event_packet+0xb8/0x30b0 [bluetooth]. The backtrace for this address is 0x13d38 is in hci_event_packet (net/bluetooth/hci_event.c:5254). 5249 * various handlers may modify the original one through 5250 * skb_pull() calls, etc. 5251 */ 5252 if (req_complete_skb || event == HCI_EV_CMD_STATUS || 5253 event == HCI_EV_CMD_COMPLETE) 5254 orig_skb = skb_clone(skb, GFP_KERNEL); 5255 5256 skb_pull(skb, HCI_EVENT_HDR_SIZE); 5257 5258 switch (event) { I am unable to unload module bluetooth to verify that the second leak is not a false positive; however, the one in btusb is a real memory leak. As always, I will be happy to test any patches. Larry