[syzbot] [io-uring?] memory leak in io_submit_sqes (5)
6 views
Skip to first unread message
syzbot
Dec 1, 2025, 12:07:46 PM (23 hours ago) Dec 1
to ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 7d0a66e4bb90 Linux 6.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=110d0512580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150d0512580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3e289f3ec7e8/disk-7d0a66e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bf695f1b8080/vmlinux-7d0a66e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/eb2f95cf98c6/bzImage-7d0a66e4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+641eec...@syzkaller.appspotmail.com
2025/12/01 16:45:07 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888112d6b200 (size 248):
comm "syz.0.17", pid 6070, jiffies 4294944719
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 9dd5d643):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888112e96200 (size 248):
comm "syz.0.18", pid 6072, jiffies 4294944721
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 79b7669c):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888112e5ed00 (size 248):
comm "syz.0.19", pid 6073, jiffies 4294944722
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 11e3e38b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888127618400 (size 248):
comm "syz.0.20", pid 6127, jiffies 4294945384
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc b9653957):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881262cf200 (size 248):
comm "syz.0.21", pid 6128, jiffies 4294945385
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 457654b1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 7d0a66e4bb90 Linux 6.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=110d0512580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150d0512580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3e289f3ec7e8/disk-7d0a66e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/bf695f1b8080/vmlinux-7d0a66e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/eb2f95cf98c6/bzImage-7d0a66e4.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+641eec...@syzkaller.appspotmail.com
2025/12/01 16:45:07 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888112d6b200 (size 248):
comm "syz.0.17", pid 6070, jiffies 4294944719
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 9dd5d643):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888112e96200 (size 248):
comm "syz.0.18", pid 6072, jiffies 4294944721
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 79b7669c):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888112e5ed00 (size 248):
comm "syz.0.19", pid 6073, jiffies 4294944722
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 11e3e38b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888127618400 (size 248):
comm "syz.0.20", pid 6127, jiffies 4294945384
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc b9653957):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff8881262cf200 (size 248):
comm "syz.0.21", pid 6128, jiffies 4294945385
hex dump (first 32 bytes):
40 f8 56 0d 81 88 ff ff 00 00 00 00 00 00 00 00 @.V.............
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 457654b1):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Jens Axboe
Dec 1, 2025, 3:16:31 PM (20 hours ago) Dec 1
to syzbot, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.18
diff --git a/io_uring/poll.c b/io_uring/poll.c
index b9681d0f9f13..5df09e4e958d 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -922,6 +922,11 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
goto out;
}
+ /*
+ * Set cancel res early, so io_poll_add() can overwrite it, if
+ * necessary.
+ */
+ io_req_set_res(preq, -ECANCELED, 0);
if (poll_update->update_events || poll_update->update_user_data) {
/* only mask one event flags, keep behavior flags */
if (poll_update->update_events) {
@@ -936,12 +941,12 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);
/* successfully updated, don't complete poll request */
- if (!ret2 || ret2 == -EIOCBQUEUED)
+ if (ret2 == IOU_ISSUE_SKIP_COMPLETE)
goto out;
}
- req_set_fail(preq);
- io_req_set_res(preq, -ECANCELED, 0);
+ if (preq->cqe.res < 0)
+ req_set_fail(preq);
preq->io_task_work.func = io_req_task_complete;
io_req_task_work_add(preq);
out:
--
Jens Axboe
diff --git a/io_uring/poll.c b/io_uring/poll.c
index b9681d0f9f13..5df09e4e958d 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -922,6 +922,11 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
goto out;
}
+ /*
+ * Set cancel res early, so io_poll_add() can overwrite it, if
+ * necessary.
+ */
+ io_req_set_res(preq, -ECANCELED, 0);
if (poll_update->update_events || poll_update->update_user_data) {
/* only mask one event flags, keep behavior flags */
if (poll_update->update_events) {
@@ -936,12 +941,12 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);
/* successfully updated, don't complete poll request */
- if (!ret2 || ret2 == -EIOCBQUEUED)
+ if (ret2 == IOU_ISSUE_SKIP_COMPLETE)
goto out;
}
- req_set_fail(preq);
- io_req_set_res(preq, -ECANCELED, 0);
+ if (preq->cqe.res < 0)
+ req_set_fail(preq);
preq->io_task_work.func = io_req_task_complete;
io_req_task_work_add(preq);
out:
--
Jens Axboe
shaurya
Dec 1, 2025, 3:36:45 PM (20 hours ago) Dec 1
to syzbot+641eec...@syzkaller.appspotmail.com, ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
syzbot
Dec 1, 2025, 4:00:05 PM (19 hours ago) Dec 1
to ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
Warning: Permanently added '10.128.1.13' (ED25519) to the list of known hosts.
2025/12/01 20:59:35 parsed 1 programs
[ 45.094356][ T5813] cgroup: Unknown subsys name 'net'
[ 45.202443][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 45.208862][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 53.863046][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 55.317007][ T5825] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 55.448849][ T5830] chnl_net:caif_netlink_parms(): no params data found
[ 55.468796][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.476764][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.484104][ T5830] bridge_slave_0: entered allmulticast mode
[ 55.490494][ T5830] bridge_slave_0: entered promiscuous mode
[ 55.497389][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.504651][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.511920][ T5830] bridge_slave_1: entered allmulticast mode
[ 55.518298][ T5830] bridge_slave_1: entered promiscuous mode
[ 55.530562][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 55.540621][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 55.555225][ T5830] team0: Port device team_slave_0 added
[ 55.561419][ T5830] team0: Port device team_slave_1 added
[ 55.571641][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 55.578610][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.604931][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 55.616342][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 55.623586][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.649758][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 55.667015][ T5830] hsr_slave_0: entered promiscuous mode
[ 55.672837][ T5830] hsr_slave_1: entered promiscuous mode
[ 55.702718][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 55.710523][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 55.718180][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 55.726058][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 55.738320][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.745549][ T5830] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 55.752892][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.759930][ T5830] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 55.777110][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[ 55.786285][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.793904][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.803960][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[ 55.812453][ T59] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.819693][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 55.831755][ T59] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.838825][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 55.879152][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 55.894511][ T5830] veth0_vlan: entered promiscuous mode
[ 55.901971][ T5830] veth1_vlan: entered promiscuous mode
[ 55.913067][ T5830] veth0_macvtap: entered promiscuous mode
[ 55.919675][ T5830] veth1_macvtap: entered promiscuous mode
[ 55.928894][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 55.938300][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 55.947580][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.956434][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.965897][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.974873][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.025363][ T58] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.088083][ T58] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.134632][ T58] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.183062][ T58] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.198760][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.207701][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.218293][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.226287][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.343504][ T5892] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 56.350743][ T5892] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 56.358165][ T5892] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 56.365814][ T5892] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 56.373433][ T5892] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/12/01 20:59:49 executed programs: 0
[ 59.121698][ T58] bridge_slave_1: left allmulticast mode
[ 59.127497][ T58] bridge_slave_1: left promiscuous mode
[ 59.134848][ T58] bridge0: port 2(bridge_slave_1) entered disabled state
[ 59.142486][ T58] bridge_slave_0: left allmulticast mode
[ 59.148220][ T58] bridge_slave_0: left promiscuous mode
[ 59.154181][ T58] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.203736][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 59.213014][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 59.222011][ T58] bond0 (unregistering): Released all slaves
[ 59.313631][ T58] hsr_slave_0: left promiscuous mode
[ 59.319216][ T58] hsr_slave_1: left promiscuous mode
[ 59.324844][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 59.332334][ T58] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 59.339764][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 59.347198][ T58] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 59.355640][ T58] veth1_macvtap: left promiscuous mode
[ 59.361130][ T58] veth0_macvtap: left promiscuous mode
[ 59.366742][ T58] veth1_vlan: left promiscuous mode
[ 59.372040][ T58] veth0_vlan: left promiscuous mode
[ 59.399875][ T58] team0 (unregistering): Port device team_slave_1 removed
[ 59.408653][ T58] team0 (unregistering): Port device team_slave_0 removed
[ 62.564840][ T5134] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 62.572035][ T5134] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 62.579170][ T5134] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 62.586644][ T5134] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 62.594085][ T5134] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 62.632210][ T5983] chnl_net:caif_netlink_parms(): no params data found
[ 62.651514][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.658706][ T5983] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.666137][ T5983] bridge_slave_0: entered allmulticast mode
[ 62.672389][ T5983] bridge_slave_0: entered promiscuous mode
[ 62.678796][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.686192][ T5983] bridge0: port 2(bridge_slave_1) entered disabled state
[ 62.693313][ T5983] bridge_slave_1: entered allmulticast mode
[ 62.699554][ T5983] bridge_slave_1: entered promiscuous mode
[ 62.711639][ T5983] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 62.721580][ T5983] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 62.735611][ T5983] team0: Port device team_slave_0 added
[ 62.742046][ T5983] team0: Port device team_slave_1 added
[ 62.752167][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 62.759107][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 62.785244][ T5983] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 62.796357][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 62.803353][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 62.829487][ T5983] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 62.847117][ T5983] hsr_slave_0: entered promiscuous mode
[ 62.852936][ T5983] hsr_slave_1: entered promiscuous mode
[ 63.036253][ T5983] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 63.045375][ T5983] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 63.053519][ T5983] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 63.061789][ T5983] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 63.075975][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.083083][ T5983] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.090673][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.097877][ T5983] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.122294][ T5983] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.132914][ T58] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.140548][ T58] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.152272][ T5983] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.162216][ T79] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.169296][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.178607][ T58] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.185727][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.247759][ T5983] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 63.268232][ T5983] veth0_vlan: entered promiscuous mode
[ 63.276325][ T5983] veth1_vlan: entered promiscuous mode
[ 63.296850][ T5983] veth0_macvtap: entered promiscuous mode
[ 63.304290][ T5983] veth1_macvtap: entered promiscuous mode
[ 63.314925][ T5983] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 63.334416][ T5983] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 63.344953][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.354046][ T79] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.363838][ T79] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.383838][ T79] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 63.428886][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.440292][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 63.451963][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.463029][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1359059719=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d6526ea3e
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/ccZ4MFua.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 7d0a66e4 Linux 6.18
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.18
syzbot tried to test the proposed patch but the build/boot failed:
SYZFAIL: failed to recv rpc
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
Warning: Permanently added '10.128.1.13' (ED25519) to the list of known hosts.
2025/12/01 20:59:35 parsed 1 programs
[ 45.094356][ T5813] cgroup: Unknown subsys name 'net'
[ 45.202443][ T5813] cgroup: Unknown subsys name 'cpuset'
[ 45.208862][ T5813] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 53.863046][ T5813] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 55.317007][ T5825] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linu...@kvack.org if you depend on this functionality.
[ 55.448849][ T5830] chnl_net:caif_netlink_parms(): no params data found
[ 55.468796][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.476764][ T5830] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.484104][ T5830] bridge_slave_0: entered allmulticast mode
[ 55.490494][ T5830] bridge_slave_0: entered promiscuous mode
[ 55.497389][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.504651][ T5830] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.511920][ T5830] bridge_slave_1: entered allmulticast mode
[ 55.518298][ T5830] bridge_slave_1: entered promiscuous mode
[ 55.530562][ T5830] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 55.540621][ T5830] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 55.555225][ T5830] team0: Port device team_slave_0 added
[ 55.561419][ T5830] team0: Port device team_slave_1 added
[ 55.571641][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 55.578610][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.604931][ T5830] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 55.616342][ T5830] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 55.623586][ T5830] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 55.649758][ T5830] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 55.667015][ T5830] hsr_slave_0: entered promiscuous mode
[ 55.672837][ T5830] hsr_slave_1: entered promiscuous mode
[ 55.702718][ T5830] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 55.710523][ T5830] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 55.718180][ T5830] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 55.726058][ T5830] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 55.738320][ T5830] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.745549][ T5830] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 55.752892][ T5830] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.759930][ T5830] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 55.777110][ T5830] 8021q: adding VLAN 0 to HW filter on device bond0
[ 55.786285][ T12] bridge0: port 1(bridge_slave_0) entered disabled state
[ 55.793904][ T12] bridge0: port 2(bridge_slave_1) entered disabled state
[ 55.803960][ T5830] 8021q: adding VLAN 0 to HW filter on device team0
[ 55.812453][ T59] bridge0: port 1(bridge_slave_0) entered blocking state
[ 55.819693][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 55.831755][ T59] bridge0: port 2(bridge_slave_1) entered blocking state
[ 55.838825][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 55.879152][ T5830] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 55.894511][ T5830] veth0_vlan: entered promiscuous mode
[ 55.901971][ T5830] veth1_vlan: entered promiscuous mode
[ 55.913067][ T5830] veth0_macvtap: entered promiscuous mode
[ 55.919675][ T5830] veth1_macvtap: entered promiscuous mode
[ 55.928894][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 55.938300][ T5830] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 55.947580][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.956434][ T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.965897][ T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.974873][ T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 56.025363][ T58] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.088083][ T58] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.134632][ T58] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.183062][ T58] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.198760][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.207701][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.218293][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.226287][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.343504][ T5892] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 56.350743][ T5892] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 56.358165][ T5892] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 56.365814][ T5892] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 56.373433][ T5892] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
2025/12/01 20:59:49 executed programs: 0
[ 59.121698][ T58] bridge_slave_1: left allmulticast mode
[ 59.127497][ T58] bridge_slave_1: left promiscuous mode
[ 59.134848][ T58] bridge0: port 2(bridge_slave_1) entered disabled state
[ 59.142486][ T58] bridge_slave_0: left allmulticast mode
[ 59.148220][ T58] bridge_slave_0: left promiscuous mode
[ 59.154181][ T58] bridge0: port 1(bridge_slave_0) entered disabled state
[ 59.203736][ T58] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 59.213014][ T58] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 59.222011][ T58] bond0 (unregistering): Released all slaves
[ 59.313631][ T58] hsr_slave_0: left promiscuous mode
[ 59.319216][ T58] hsr_slave_1: left promiscuous mode
[ 59.324844][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 59.332334][ T58] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 59.339764][ T58] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 59.347198][ T58] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 59.355640][ T58] veth1_macvtap: left promiscuous mode
[ 59.361130][ T58] veth0_macvtap: left promiscuous mode
[ 59.366742][ T58] veth1_vlan: left promiscuous mode
[ 59.372040][ T58] veth0_vlan: left promiscuous mode
[ 59.399875][ T58] team0 (unregistering): Port device team_slave_1 removed
[ 59.408653][ T58] team0 (unregistering): Port device team_slave_0 removed
[ 62.564840][ T5134] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[ 62.572035][ T5134] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[ 62.579170][ T5134] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[ 62.586644][ T5134] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[ 62.594085][ T5134] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[ 62.632210][ T5983] chnl_net:caif_netlink_parms(): no params data found
[ 62.651514][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.658706][ T5983] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.666137][ T5983] bridge_slave_0: entered allmulticast mode
[ 62.672389][ T5983] bridge_slave_0: entered promiscuous mode
[ 62.678796][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.686192][ T5983] bridge0: port 2(bridge_slave_1) entered disabled state
[ 62.693313][ T5983] bridge_slave_1: entered allmulticast mode
[ 62.699554][ T5983] bridge_slave_1: entered promiscuous mode
[ 62.711639][ T5983] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 62.721580][ T5983] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 62.735611][ T5983] team0: Port device team_slave_0 added
[ 62.742046][ T5983] team0: Port device team_slave_1 added
[ 62.752167][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 62.759107][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 62.785244][ T5983] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 62.796357][ T5983] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 62.803353][ T5983] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[ 62.829487][ T5983] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 62.847117][ T5983] hsr_slave_0: entered promiscuous mode
[ 62.852936][ T5983] hsr_slave_1: entered promiscuous mode
[ 63.036253][ T5983] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 63.045375][ T5983] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 63.053519][ T5983] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 63.061789][ T5983] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 63.075975][ T5983] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.083083][ T5983] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.090673][ T5983] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.097877][ T5983] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.122294][ T5983] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.132914][ T58] bridge0: port 1(bridge_slave_0) entered disabled state
[ 63.140548][ T58] bridge0: port 2(bridge_slave_1) entered disabled state
[ 63.152272][ T5983] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.162216][ T79] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.169296][ T79] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.178607][ T58] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.185727][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.247759][ T5983] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 63.268232][ T5983] veth0_vlan: entered promiscuous mode
[ 63.276325][ T5983] veth1_vlan: entered promiscuous mode
[ 63.296850][ T5983] veth0_macvtap: entered promiscuous mode
[ 63.304290][ T5983] veth1_macvtap: entered promiscuous mode
[ 63.314925][ T5983] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 63.334416][ T5983] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 63.344953][ T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.354046][ T79] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.363838][ T79] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 63.383838][ T79] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
SYZFAIL: failed to recv rpc
fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)
[ 63.428886][ T79] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.440292][ T79] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 63.451963][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 63.463029][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1359059719=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d6526ea3e
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d6526ea3e6ad9081c902859bbb80f9f840377cb4 -X github.com/google/syzkaller/prog.gitRevisionDate=20251126-113115" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d6526ea3e6ad9081c902859bbb80f9f840377cb4\"
/usr/bin/ld: /tmp/ccZ4MFua.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Tested on:
commit: 7d0a66e4 Linux 6.18
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v6.18
kernel config: https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13688512580000
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syzbot
Dec 1, 2025, 4:24:09 PM (19 hours ago) Dec 1
to ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, ssran...@gmail.com, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes
2025/12/01 21:23:33 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888111254200 (size 248):
comm "syz.0.17", pid 6735, jiffies 4294946584
comm "syz.0.18", pid 6740, jiffies 4294946586
comm "syz.0.19", pid 6744, jiffies 4294946588
comm "syz.0.20", pid 6764, jiffies 4294947184
comm "syz.0.21", pid 6766, jiffies 4294947184
console output: https://syzkaller.appspot.com/x/log.txt?x=131aa512580000
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
memory leak in io_submit_sqes
2025/12/01 21:23:33 executed programs: 5
BUG: memory leak
unreferenced object 0xffff888111254200 (size 248):
comm "syz.0.17", pid 6735, jiffies 4294946584
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 2fa747c9):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888111262200 (size 248):
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
comm "syz.0.18", pid 6740, jiffies 4294946586
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 95820259):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888125155300 (size 248):
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
comm "syz.0.19", pid 6744, jiffies 4294946588
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 7f690aa4):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888122d56200 (size 248):
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
comm "syz.0.20", pid 6764, jiffies 4294947184
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc 1e329da4):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888126b78d00 (size 248):
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
comm "syz.0.21", pid 6766, jiffies 4294947184
hex dump (first 32 bytes):
c0 e9 e3 09 81 88 ff ff 00 00 00 00 00 00 00 00 ................
3c 20 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 < ..............
backtrace (crc d8b7eea):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
slab_post_alloc_hook mm/slub.c:4983 [inline]
kmem_cache_alloc_bulk_noprof+0x220/0x3e0 mm/slub.c:7497
__io_alloc_req_refill+0x54/0x1a0 io_uring/io_uring.c:1058
io_alloc_req io_uring/io_uring.h:543 [inline]
io_submit_sqes+0x584/0xe80 io_uring/io_uring.c:2438
__do_sys_io_uring_enter+0x83f/0xcf0 io_uring/io_uring.c:3516
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xa4/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
Tested on:
commit: 7d0a66e4 Linux 6.18
git tree: upstream
commit: 7d0a66e4 Linux 6.18
console output: https://syzkaller.appspot.com/x/log.txt?x=131aa512580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=14448512580000
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Jens Axboe
Dec 1, 2025, 4:29:42 PM (19 hours ago) Dec 1
to syzbot, io-u...@vger.kernel.org, linux-...@vger.kernel.org, ssran...@gmail.com, syzkall...@googlegroups.com
On 12/1/25 2:24 PM, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in io_submit_sqes
Yep that patch made no sense to me...
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> memory leak in io_submit_sqes
Shaurya Rane, was that some kind of AI hallucination, or what led to that?!
--
Jens Axboe
Jens Axboe
Dec 1, 2025, 4:31:38 PM (19 hours ago) Dec 1
to syzbot, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Let's try this again, seemed like a testing failure last time...
diff --git a/io_uring/poll.c b/io_uring/poll.c
index b9681d0f9f13..0d5bb90d4743 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -936,12 +936,17 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);
/* successfully updated, don't complete poll request */
- if (!ret2 || ret2 == -EIOCBQUEUED)
+ if (ret2 == IOU_ISSUE_SKIP_COMPLETE)
goto out;
+ /* request completed as part of the update, complete it */
+ else if (ret2 == IOU_COMPLETE)
+ goto complete;
}
- req_set_fail(preq);
io_req_set_res(preq, -ECANCELED, 0);
+complete:
diff --git a/io_uring/poll.c b/io_uring/poll.c
index b9681d0f9f13..0d5bb90d4743 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -936,12 +936,17 @@ int io_poll_remove(struct io_kiocb *req, unsigned int issue_flags)
ret2 = io_poll_add(preq, issue_flags & ~IO_URING_F_UNLOCKED);
/* successfully updated, don't complete poll request */
- if (!ret2 || ret2 == -EIOCBQUEUED)
+ if (ret2 == IOU_ISSUE_SKIP_COMPLETE)
goto out;
+ else if (ret2 == IOU_COMPLETE)
+ goto complete;
}
- req_set_fail(preq);
io_req_set_res(preq, -ECANCELED, 0);
+complete:
syzbot
Dec 1, 2025, 4:52:04 PM (18 hours ago) Dec 1
to ax...@kernel.dk, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+641eec...@syzkaller.appspotmail.com
Tested-by: syzbot+641eec...@syzkaller.appspotmail.com
Tested on:
commit: 7d0a66e4 Linux 6.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11128512580000
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+641eec...@syzkaller.appspotmail.com
Tested-by: syzbot+641eec...@syzkaller.appspotmail.com
Tested on:
commit: 7d0a66e4 Linux 6.18
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=f30cc590c4f6da44
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
patch: https://syzkaller.appspot.com/x/patch.diff?x=13d09112580000
dashboard link: https://syzkaller.appspot.com/bug?extid=641eec6b7af1f62f2b99
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
Note: testing is done by a robot and is best-effort only.
Shaurya Rane
7:12 AM (4 hours ago) 7:12 AM
to Jens Axboe, syzbot, io-u...@vger.kernel.org, linux-...@vger.kernel.org, syzkall...@googlegroups.com
You're right, and I am sorry for the noise. I misread the backtrace and
made an incorrect assumption about the teardown ordering being the issue.
I'll take more time to properly understand
the code before sending another patch.
Sorry for wasting your time.
made an incorrect assumption about the teardown ordering being the issue.
I'll take more time to properly understand
the code before sending another patch.
Sorry for wasting your time.
Reply all
Reply to author
Forward
0 new messages