linux-kernel - Re: [syzbot] [io-uring?] memory leak in io_submit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <692e0777.a70a0220.2ea503.00bc.GAE@google.com>
Date: Mon, 01 Dec 2025 13:24:07 -0800
From: syzbot <syzbot+641eec6b7af1f62f2b99@...kaller.appspotmail.com>
To: axboe@...nel.dk, io-uring@...r.kernel.org, linux-kernel@...r.kernel.org, 
	ssranevjti@...il.com, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [io-uring?] memory leak in io_submit_sqes (5)

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes

2025/12/01 21:23:33 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888111254200 (size 248):
  comm "syz.0.17", pid 6735, jiffies 4294946584
  hex dump (first 32 bytes):
    c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  < ..............
  backtrace (crc 2fa747c9):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
    __io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
    io_alloc_req io_uring/io_uring.h:543 [inline]
    io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888111262200 (size 248):
  comm "syz.0.18", pid 6740, jiffies 4294946586
  hex dump (first 32 bytes):
    c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  < ..............
  backtrace (crc 95820259):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
    __io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
    io_alloc_req io_uring/io_uring.h:543 [inline]
    io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888125155300 (size 248):
  comm "syz.0.19", pid 6744, jiffies 4294946588
  hex dump (first 32 bytes):
    c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  < ..............
  backtrace (crc 7f690aa4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
    __io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
    io_alloc_req io_uring/io_uring.h:543 [inline]
    io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888122d56200 (size 248):
  comm "syz.0.20", pid 6764, jiffies 4294947184
  hex dump (first 32 bytes):
    c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  < ..............
  backtrace (crc 1e329da4):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
    __io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
    io_alloc_req io_uring/io_uring.h:543 [inline]
    io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126b78d00 (size 248):
  comm "syz.0.21", pid 6766, jiffies 4294947184
  hex dump (first 32 bytes):
    c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00  ................
    3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00  < ..............
  backtrace (crc d8b7eea):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4983 [inline]
    kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
    __io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
    io_alloc_req io_uring/io_uring.h:543 [inline]
    io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF


Tested on:

commit:         7d0a66e4 Linux 6.18
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=131aa512580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler:       gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14448512580000