From: syzbot <syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com>
To: axboe@kernel.dk, io-uring@vger.kernel.org,
linux-kernel@vger.kernel.org, ssranevjti@gmail.com,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [io-uring?] memory leak in io_submit_sqes (5)
Date: Mon, 01 Dec 2025 13:24:07 -0800 [thread overview]
Message-ID: <692e0777.a70a0220.2ea503.00bc.GAE@google.com> (raw)
In-Reply-To: <d08c0c69-eafa-4768-906a-50a7e039e76d@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes
2025/12/01 21:23:33 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888111254200 (size 248):
comm "syz.0.17", pid 6735, jiffies 4294946584
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 2fa747c9):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888111262200 (size 248):
comm "syz.0.18", pid 6740, jiffies 4294946586
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 95820259):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888125155300 (size 248):
comm "syz.0.19", pid 6744, jiffies 4294946588
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 7f690aa4):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888122d56200 (size 248):
comm "syz.0.20", pid 6764, jiffies 4294947184
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 1e329da4):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888126b78d00 (size 248):
comm "syz.0.21", pid 6766, jiffies 4294947184
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc d8b7eea):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
Tested on:
commit: 7d0a66e4 Linux 6.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=131aa512580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14448512580000
next prev parent reply other threads:[~2025-12-01 21:24 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-01 17:07 [syzbot] [io-uring?] memory leak in io_submit_sqes (5) syzbot
2025-12-01 20:16 ` Jens Axboe
2025-12-01 21:00 ` syzbot
2025-12-01 20:36 ` shaurya
2025-12-01 21:24 ` syzbot [this message]
2025-12-01 21:29 ` Jens Axboe
2025-12-01 21:31 ` Jens Axboe
2025-12-01 21:52 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=692e0777.a70a0220.2ea503.00bc.GAE@google.com \
--to=syzbot+641eec6b7af1f62f2b99@syzkaller.appspotmail.com \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ssranevjti@gmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox