syzbot

 sign-in | mailing list | source | docs
🐞 Open [1475]
≡ Subsystems
🐞 Fixed [6716]
🐞 Invalid [17266]
⬇ Missing Backports [219]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in iovec_from_user (2)

Status: upstream: reported C repro on 2025/11/10 18:09
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+3c93637d7648c24e1fd0@syzkaller.appspotmail.com
Fix commit: io_uring/rw: ensure allocated iovec gets cleared for early failure
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 3d13h, last: 3d13h
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] [io-uring?] memory leak in iovec_from_user (2) 3 (5) 2025/11/10 21:55
[PATCH] io_uring/rw: ensure allocated iovec gets cleared for early failure 1 (1) 2025/11/10 21:37
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in iovec_from_user fs io-uring 3 C 1 1308d 1304d 22/29 fixed on 2023/02/24 13:50
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2025/11/10 21:34 20m axboe@kernel.dk git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git io_uring-6.18 OK log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812638cc20 (size 32):
  comm "syz.0.17", pid 6104, jiffies 4294942640
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4975 [inline]
    slab_alloc_node mm/slub.c:5280 [inline]
    __do_kmalloc_node mm/slub.c:5641 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5654
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1309 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1292
    __import_iovec+0x71/0x350 lib/iov_iter.c:1363
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:314 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:326
    io_prep_rwv io_uring/rw.c:344 [inline]
    io_prep_readv+0x20/0x80 io_uring/rw.c:359
    io_init_req io_uring/io_uring.c:2248 [inline]
    io_submit_sqe io_uring/io_uring.c:2295 [inline]
    io_submit_sqes+0x354/0xe80 io_uring/io_uring.c:2447
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3514
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812638cc40 (size 32):
  comm "syz.0.17", pid 6104, jiffies 4294942640
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4975 [inline]
    slab_alloc_node mm/slub.c:5280 [inline]
    __do_kmalloc_node mm/slub.c:5641 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5654
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1309 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1292
    __import_iovec+0x71/0x350 lib/iov_iter.c:1363
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:314 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:326
    io_prep_rwv io_uring/rw.c:344 [inline]
    io_prep_readv+0x20/0x80 io_uring/rw.c:359
    io_init_req io_uring/io_uring.c:2248 [inline]
    io_submit_sqe io_uring/io_uring.c:2295 [inline]
    io_submit_sqes+0x354/0xe80 io_uring/io_uring.c:2447
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3514
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812638cc60 (size 32):
  comm "syz.0.17", pid 6104, jiffies 4294942640
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4975 [inline]
    slab_alloc_node mm/slub.c:5280 [inline]
    __do_kmalloc_node mm/slub.c:5641 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5654
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1309 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1292
    __import_iovec+0x71/0x350 lib/iov_iter.c:1363
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:314 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:326
    io_prep_rwv io_uring/rw.c:344 [inline]
    io_prep_readv+0x20/0x80 io_uring/rw.c:359
    io_init_req io_uring/io_uring.c:2248 [inline]
    io_submit_sqe io_uring/io_uring.c:2295 [inline]
    io_submit_sqes+0x354/0xe80 io_uring/io_uring.c:2447
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3514
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812638cc80 (size 32):
  comm "syz.0.17", pid 6104, jiffies 4294942640
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4975 [inline]
    slab_alloc_node mm/slub.c:5280 [inline]
    __do_kmalloc_node mm/slub.c:5641 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5654
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1309 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1292
    __import_iovec+0x71/0x350 lib/iov_iter.c:1363
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:314 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:326
    io_prep_rwv io_uring/rw.c:344 [inline]
    io_prep_readv+0x20/0x80 io_uring/rw.c:359
    io_init_req io_uring/io_uring.c:2248 [inline]
    io_submit_sqe io_uring/io_uring.c:2295 [inline]
    io_submit_sqes+0x354/0xe80 io_uring/io_uring.c:2447
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3514
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812638cca0 (size 32):
  comm "syz.0.17", pid 6104, jiffies 4294942640
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4975 [inline]
    slab_alloc_node mm/slub.c:5280 [inline]
    __do_kmalloc_node mm/slub.c:5641 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5654
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1309 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1292
    __import_iovec+0x71/0x350 lib/iov_iter.c:1363
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:314 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:326
    io_prep_rwv io_uring/rw.c:344 [inline]
    io_prep_readv+0x20/0x80 io_uring/rw.c:359
    io_init_req io_uring/io_uring.c:2248 [inline]
    io_submit_sqe io_uring/io_uring.c:2295 [inline]
    io_submit_sqes+0x354/0xe80 io_uring/io_uring.c:2447
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3514
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88812638ccc0 (size 32):
  comm "syz.0.17", pid 6104, jiffies 4294942640
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 0):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4975 [inline]
    slab_alloc_node mm/slub.c:5280 [inline]
    __do_kmalloc_node mm/slub.c:5641 [inline]
    __kmalloc_noprof+0x3e3/0x6b0 mm/slub.c:5654
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1309 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1292
    __import_iovec+0x71/0x350 lib/iov_iter.c:1363
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:314 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:326
    io_prep_rwv io_uring/rw.c:344 [inline]
    io_prep_readv+0x20/0x80 io_uring/rw.c:359
    io_init_req io_uring/io_uring.c:2248 [inline]
    io_submit_sqe io_uring/io_uring.c:2295 [inline]
    io_submit_sqes+0x354/0xe80 io_uring/io_uring.c:2447
    __do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3514
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/07 21:19 upstream 4a0c9b339199 4e1406b4 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in iovec_from_user
* Struck through repros no longer work on HEAD.