--- title: Tracing memory leaks in the NFC Digital Protocol stack description: A practical walkthrough of using kmemleak (Kernel Memory Leak Detector) to find and fix real memory leaks in the Linux NFC Digital Protocol stack. Two concrete... canonical: https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tracing memory leaks in the NFC Digital Protocol stack | daily.dev og:description: A practical walkthrough of using kmemleak (Kernel Memory Leak Detector) to find and fix real memory leaks in the Linux NFC Digital Protocol stack. Two concrete... og:url: https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr og:image: https://api.daily.dev/og/posts/bU7rbyktr.png og:image:alt: Tracing memory leaks in the NFC Digital Protocol stack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tracing memory leaks in the NFC Digital Protocol stack **[Collabora Blog](https://daily.dev/sources/collabora)** · 8 min read · 0 upvotes · 0 comments ## Summary A practical walkthrough of using kmemleak (Kernel Memory Leak Detector) to find and fix real memory leaks in the Linux NFC Digital Protocol stack. Two concrete cases are covered: an unnecessary allocation in the NFC-F target polling loop where an nfcid2 array was allocated but never freed, and un-freed socket buffers (SKBs) during chained PDU handling in NFC-DEP. The post explains how to enable and use kmemleak via sysfs, how to interpret its backtraces, and how to modify the nfcsim virtual driver to get better allocation origin information. Both bugs were fixed and committed to the Linux kernel. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use kmemleak to scan for memory leaks in the Linux kernel? Enable kmemleak under Kernel hacking > Memory Debugging in the kernel config, then control it via /sys/kernel/debug/kmemleak. Trigger a scan with `echo scan > /sys/kernel/debug/kmemleak`, clear results with `echo clean`, and read detected leaks with `cat /sys/kernel/debug/kmemleak`. The output includes the allocation call stack, memory address, size, and a hex dump of the leaked chunk. _Kernel developers tracking down allocation bugs share kmemleak workflows and fixes on daily.dev._ ### Why does kmemleak show the skb_copy allocation site instead of the original SKB allocation when debugging NFC socket buffer leaks? When nfcsim_send() copies the incoming SKB with skb_copy() and frees the original, kmemleak tracks the copy's allocation site rather than the original. To expose the true origin, modify the driver to pass the original SKB directly (link->skb = skb) instead of copying it. This makes kmemleak report the actual allocation function, such as digital_skb_alloc inside digital_in_send_ack, revealing where the SKB should have been freed. _Linux networking and driver developers debugging SKB lifecycle issues find relevant kernel patches and techniques on daily.dev._ ## Similar posts on daily.dev - [IonStack part II: GhostLock, a stack-UAF that has existed in ALL Linux distributions for 15 years](https://daily.dev/posts/ionstack-part-ii-ghostlock-a-stack-uaf-that-has-existed-in-all-linux-distributions-for-15-years-wznoxduhk) · Hacker News · 2 upvotes · 0 comments - [Tracing a memory leak bug in PID 1 and contributing an upstream fix: a Linux support story](https://daily.dev/posts/tracing-a-memory-leak-bug-in-pid-1-and-contributing-an-upstream-fix-a-linux-support-story-acqq4ixcg) · Ubuntu · 2 upvotes · 0 comments - [FreeBSoD: Leveraging Language Models to Find and Exploit Kernel Bugs \(Part 2 of 2\)](https://daily.dev/posts/freebsod-leveraging-language-models-to-find-and-exploit-kernel-bugs-part-2-of-2--qhvyj36t9) · Security Boulevard · 0 upvotes · 0 comments - [MEMINSPECT Proposed For The Linux Kernel To Help In Memory Analysis / Debugging](https://daily.dev/posts/meminspect-proposed-for-the-linux-kernel-to-help-in-memory-analysis-debugging-2shzyhkrf) · Phoronix · 0 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux) [View this post on daily.dev](https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tracing memory leaks in the NFC Digital Protocol stack","url":"https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr"},"datePublished":"2026-08-11T08:56:20.310Z","dateModified":"2026-08-11T09:33:10.034Z","description":"A practical walkthrough of using kmemleak (Kernel Memory Leak Detector) to find and fix real memory leaks in the Linux NFC Digital Protocol stack. Two concrete...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Collabora Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collabora Blog","logo":"https://media.daily.dev/image/upload/s--ZGZ0FjqS--/f_auto,q_auto/v1786438306/logos/collabora?_a=BAMAMicg0","url":"https://daily.dev/sources/collabora"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collabora Blog","item":"https://daily.dev/sources/collabora"},{"@type":"ListItem","position":3,"name":"Tracing memory leaks in the NFC Digital Protocol stack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tracing-memory-leaks-in-the-nfc-digital-protocol-stack-bu7rbyktr#faq","mainEntity":[{"@type":"Question","name":"How do I use kmemleak to scan for memory leaks in the Linux kernel?","acceptedAnswer":{"@type":"Answer","text":"Enable kmemleak under Kernel hacking > Memory Debugging in the kernel config, then control it via /sys/kernel/debug/kmemleak. Trigger a scan with `echo scan > /sys/kernel/debug/kmemleak`, clear results with `echo clean`, and read detected leaks with `cat /sys/kernel/debug/kmemleak`. The output includes the allocation call stack, memory address, size, and a hex dump of the leaked chunk. Kernel developers tracking down allocation bugs share kmemleak workflows and fixes on daily.dev."}},{"@type":"Question","name":"Why does kmemleak show the skb_copy allocation site instead of the original SKB allocation when debugging NFC socket buffer leaks?","acceptedAnswer":{"@type":"Answer","text":"When nfcsim_send() copies the incoming SKB with skb_copy() and frees the original, kmemleak tracks the copy's allocation site rather than the original. To expose the true origin, modify the driver to pass the original SKB directly (link->skb = skb) instead of copying it. This makes kmemleak report the actual allocation function, such as digital_skb_alloc inside digital_in_send_ack, revealing where the SKB should have been freed. Linux networking and driver developers debugging SKB lifecycle issues find relevant kernel patches and techniques on daily.dev."}}]} ```