memory leak in __pcs_replace_full_main

Status: upstream: reported syz repro on 2026/11/04 23:17
Subsystems: btrfs ext4 ntfs3
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
✨ AI-generated root cause summary:

The SLUB allocator's sheaf caching layer allocates 'struct slab_sheaf' objects via kmalloc_flags(), which registers them with kmemleak for leak tracking. When full RCU sheaves are retired in __kfree_rcu_sheaf(), they are queued into RCU via call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf). While pending in RCU's singly-linked callback list, if any preceding callback resides in memory untracked or ignored by kmemleak (such as struct slab from call_rcu(&slab->rcu_head, rcu_free_slab)), kmemleak cannot traverse the chain to reach subsequent callbacks. Because __alloc_empty_sheaf() does not mark the sheaf with kmemleak_not_leak() (which marks the metadata grey so it is not reported as a leak while still scanning its cached objects), kmemleak falsely flags pending RCU sheaves as unreferenced memory leaks.

▶ ▼ ✨ Full AI root cause analysis
Based on kernel commit 36aad21d50d1:

Technical Root Cause Analysis

1. Involved Components, Functions, and Structures

  • Source Files: mm/slub.c, mm/kmemleak.c, kernel/rcu/tree.c
  • Functions:
  • Structures & Fields:
    • struct slab_sheaf (mm/slub.c):
      • union { struct rcu_head rcu_head; struct list_head barn_list; ... }
      • struct kmem_cache *cache
      • unsigned int size
      • void *objects[]
    • struct rcu_head: struct callback_head *next, rcu_callback_t func
    • struct rcu_segcblist / struct rcu_data: rdp->cblist

2. Detailed Bug Mechanism

  1. Sheaf Allocation and kmemleak Tracking: The SLUB allocator's sheaf caching layer allocates struct slab_sheaf objects in __alloc_empty_sheaf() via kmalloc_flags(). Under CONFIG_KMEMLEAK, these allocations are tracked as active objects in kmemleak's red-black tree (object_tree_root).

  2. RCU Sheaf Batching and Enqueueing: In __kfree_rcu_sheaf(), objects queued for RCU reclamation are batched into pcs->rcu_free. When the sheaf reaches its capacity (rcu_sheaf->size == s->sheaf_capacity), the sheaf pointer is detached from per-CPU storage (pcs->rcu_free = NULL) and queued for deferred callback execution via:

    call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf);

    At this point:

    • rcu_sheaf->rcu_head.func is set to rcu_free_sheaf (0xffffffff81b3bd60).
    • The callback is entrained into RCU's segmented callback list (rdp->cblist) as a singly linked list connected through rcu_head.next.

  3. kmemleak Scanning Disconnect in RCU Singly-Linked Lists: While pending in rdp->cblist, the only pointer referencing the slab_sheaf is the next pointer of the preceding struct rcu_head in RCU's callback chain:

    • When kmemleak performs memory scanning, it starts from roots (including the per-CPU rcu_data area) and traverses pointer references.
    • However, RCU's callback list mixes callbacks from various kernel subsystems. If any callback preceding the slab_sheaf in rdp->cblist resides in memory that kmemleak does not track or scanβ€”for example, a struct slab queued via call_rcu(&slab->rcu_head, rcu_free_slab) (where struct slab overlays struct page, which kmemleak does not scan), or an object marked with KMEMLEAK_BLACK via kmemleak_ignore()β€”kmemleak's scanner stops traversing the pointer chain at that unmonitored node.
    • Consequently, kmemleak cannot reach subsequent callbacks in the segment, including the struct slab_sheaf instances.

  4. False Positive Memory Leak Splat: Because __alloc_empty_sheaf() does not mark the internal metadata object with kmemleak_not_leak() (the helper used elsewhere in SLUB, such as for obj_exts in alloc_slab_obj_exts(), to mark internal metadata KMEMLEAK_GREY so it is exempt from leak reporting while still scanning its referenced contents), kmemleak detects that the tracked struct slab_sheaf object has zero inbound references and reports it as an unreferenced memory leak.

    Note that sheaf cannot simply be ignored with kmemleak_ignore(), because sheaf->objects[] contains pointers to objects whose freeing hooks (slab_free_hook() and kmemleak_free_recursive()) are deferred until rcu_free_sheaf() runs; marking the sheaf with kmemleak_not_leak() ensures kmemleak continues scanning the cached objects while preventing false leak reports on the sheaf metadata itself.

▶ ▼ ✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision
9c0ffa94 repro-c πŸ’₯ memory leak in __pcs_replace_full_main 2026/11/04 00:00 2026/11/04 00:00 2026/11/04 01:21 d02c3949
8ab7e64d repro-c πŸ’₯ memory leak in __pcs_replace_full_main 2026/11/03 00:00 2026/11/03 00:00 2026/11/03 09:40 0a94d799
49f60b66 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: βœ… UserNamespace: βœ… VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ memory leak in __pcs_replace_full_main 2026/10/31 23:11 2026/10/31 23:12 2026/10/31 23:59 25a0ae84
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [btrfs?] [ext4?] [ntfs3?] memory leak in __pcs_replace_full_main 0 (1) 2026/11/04 23:17

Sample crash report:
BUG: memory leak
unreferenced object 0xffff8881009d4e00 (size 512):
  comm "kworker/0:1", pid 10, jiffies 4294937433
  hex dump (first 32 bytes):
    b0 7e 81 2d 81 88 ff ff 60 bd b3 81 ff ff ff ff  .~.-....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 91d5a5d8):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    vfree mm/vmalloc.c:3549 [inline]
    vfree+0xa8/0x390 mm/vmalloc.c:3521
    delayed_vfree_work+0x29/0x40 mm/vmalloc.c:3451
    process_one_work+0x2b7/0x5c0 kernel/workqueue.c:3495
    process_scheduled_works kernel/workqueue.c:3578 [inline]
    worker_thread+0x255/0x4a0 kernel/workqueue.c:3659
    kthread+0x150/0x1a0 kernel/kthread.c:436
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888102382600 (size 512):
  comm "kworker/u8:6", pid 403, jiffies 4294937442
  hex dump (first 32 bytes):
    10 45 0c 2d 81 88 ff ff 60 bd b3 81 ff ff ff ff  .E.-....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 2d83b05a):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    call_usermodehelper_freeinfo kernel/umh.c:43 [inline]
    umh_complete kernel/umh.c:57 [inline]
    call_usermodehelper_exec_async+0x1c7/0x1f0 kernel/umh.c:117
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff8881009e5600 (size 512):
  comm "softirq", pid 0, jiffies 4294937452
  hex dump (first 32 bytes):
    10 25 4b 2c 81 88 ff ff 60 bd b3 81 ff ff ff ff  .%K,....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 9cf07d25):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
    free_to_pcs mm/slub.c:6147 [inline]
    slab_free mm/slub.c:6633 [inline]
    kfree+0x353/0x390 mm/slub.c:6923
    security_task_free+0x6e/0x130 security/security.c:2827
    __put_task_struct+0x9f/0x260 kernel/fork.c:792
    rcu_do_batch kernel/rcu/tree.c:2650 [inline]
    rcu_core+0x269/0x720 kernel/rcu/tree.c:2919
    handle_softirqs+0x114/0x330 kernel/softirq.c:669
    run_ksoftirqd kernel/softirq.c:1133 [inline]
    run_ksoftirqd+0x20/0x30 kernel/softirq.c:1125
    smpboot_thread_fn+0x1f5/0x430 kernel/smpboot.c:162
    kthread+0x150/0x1a0 kernel/kthread.c:436
    ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

BUG: memory leak
unreferenced object 0xffff888109c00000 (size 512):
  comm "udevadm", pid 4995, jiffies 4294938376
  hex dump (first 32 bytes):
    00 3e 67 26 81 88 ff ff 60 bd b3 81 ff ff ff ff  .>g&....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc acde3b3b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __pcs_replace_empty_main+0x260/0x2e0 mm/slub.c:4806
    alloc_from_pcs mm/slub.c:4887 [inline]
    slab_alloc_node mm/slub.c:5021 [inline]
    __kmalloc_cache_noprof+0x370/0x3f0 mm/slub.c:5676
    _kmalloc_noprof include/linux/slab.h:991 [inline]
    _kzalloc_noprof include/linux/slab.h:1312 [inline]
    kernfs_get_open_node fs/kernfs/file.c:537 [inline]
    kernfs_fop_open+0x523/0x620 fs/kernfs/file.c:725
    do_dentry_open+0x1d9/0x7e0 fs/open.c:1000
    vfs_open_consume+0x4e/0x1c0 fs/open.c:1131
    do_open fs/namei.c:4851 [inline]
    path_openat+0xb90/0x1250 fs/namei.c:5016
    do_file_open+0x121/0x200 fs/namei.c:5045
    do_sys_openat2+0xd9/0x140 fs/open.c:1442
    do_sys_open fs/open.c:1448 [inline]
    __do_sys_openat fs/open.c:1464 [inline]
    __se_sys_openat fs/open.c:1459 [inline]
    __x64_sys_openat+0x82/0xf0 fs/open.c:1459
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888109bff800 (size 512):
  comm "udevd", pid 4994, jiffies 4294938441
  hex dump (first 32 bytes):
    70 76 fd 26 81 88 ff ff 60 bd b3 81 ff ff ff ff  pv.&....`.......
    00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00  ........<.......
  backtrace (crc 1107e34f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    __kfree_rcu_sheaf+0x1aa/0x2d0 mm/slub.c:6282
    kfree_rcu_sheaf mm/slab_common.c:1689 [inline]
    kvfree_call_rcu+0x1ef/0x3a0 mm/slab_common.c:2044
    kernfs_unlink_open_file+0x18f/0x1a0 fs/kernfs/file.c:611
    kernfs_fop_release+0x55/0x110 fs/kernfs/file.c:790
    __fput+0x1a6/0x4f0 fs/file_table.c:512
    fput_close_sync+0x67/0x130 fs/file_table.c:618
    filp_close_sync fs/open.c:1573 [inline]
    __do_sys_close fs/open.c:1596 [inline]
    __se_sys_close fs/open.c:1583 [inline]
    __x64_sys_close+0x4a/0xc0 fs/open.c:1583
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88810a9dae00 (size 512):
  comm "sshd", pid 5384, jiffies 4294938845
  hex dump (first 32 bytes):
    00 7e 05 26 81 88 ff ff 60 bd b3 81 ff ff ff ff  .~.&....`.......
    00 4a 04 00 81 88 ff ff 20 00 00 00 00 00 00 00  .J...... .......
  backtrace (crc b8bd2d90):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4733 [inline]
    slab_alloc_node mm/slub.c:5033 [inline]
    __do_kmalloc_node mm/slub.c:5530 [inline]
    __kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
    _kmalloc_flags_noprof mm/slab.h:55 [inline]
    __alloc_empty_sheaf mm/slub.c:2854 [inline]
    alloc_empty_sheaf mm/slub.c:2874 [inline]
    kmem_cache_prefill_sheaf+0x1a2/0x2d0 mm/slub.c:5279
    mt_get_sheaf lib/maple_tree.c:154 [inline]
    mas_alloc_nodes lib/maple_tree.c:1079 [inline]
    mas_preallocate+0x3fb/0x6f0 lib/maple_tree.c:5016
    vma_iter_prealloc mm/vma.h:698 [inline]
    __mmap_new_vma mm/vma.c:2713 [inline]
    __mmap_region+0xd92/0x1be0 mm/vma.c:3054
    mmap_region+0x19c/0x2a0 mm/vma.c:3136
    do_mmap+0x950/0xdf0 mm/mmap.c:573
    vm_mmap_pgoff+0x195/0x310 mm/util.c:581
    ksys_mmap_pgoff+0x89/0x2e0 mm/mmap.c:619
    __do_sys_mmap arch/x86/kernel/sys_x86_64.c:96 [inline]
    __se_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
    __x64_sys_mmap+0x6f/0xa0 arch/x86/kernel/sys_x86_64.c:89
    do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
    do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
** replaying previous printk message **

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/31 23:11 upstream 36aad21d50d1 2041d3f8 .config console log report syz / log [disk image] [vmlinux] [kernel image] [mounted in repro #1 (clean fs)] [mounted in repro #2] [mounted in repro #3 (clean fs)] ci-upstream-gce-leak memory leak in __pcs_replace_full_main
* Struck through repros no longer work on HEAD.