[syzbot] Monthly io-uring report (Dec 2025)

[syzbot]

Hello io-uring maintainers/developers,

This is a 31-day syzbot report for the io-uring subsystem.
All related reports/information can be found at:
https://syzkaller.appspot.com/upstream/s/io-uring

During the period, 1 new issues were detected and 1 were fixed.
In total, 3 issues are still open and 128 have already been fixed.

Some of the still happening issues:

Ref Crashes Repro Title
<1> 4212 No WARNING in io_ring_exit_work (2)
https://syzkaller.appspot.com/bug?extid=557a278955ff3a4d3938
<2> 46 Yes INFO: task hung in io_wq_put_and_exit (6)
https://syzkaller.appspot.com/bug?extid=4eb282331cab6d5b6588
<3> 1 No KASAN: slab-use-after-free Read in io_poll_remove_entries (2)
https://syzkaller.appspot.com/bug?extid=721cddf316143353975e

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

To disable reminders for individual bugs, reply with the following command:
#syz set <Ref> no-reminders

To change bug's subsystems, reply with:
#syz set <Ref> subsystems: new-subsystem

You may send multiple commands in a single email message.

[Jens Axboe]

On 12/4/25 4:05 PM, syzbot wrote:
> Hello io-uring maintainers/developers,
>
> This is a 31-day syzbot report for the io-uring subsystem.
> All related reports/information can be found at:
> https://syzkaller.appspot.com/upstream/s/io-uring
>
> During the period, 1 new issues were detected and 1 were fixed.
> In total, 3 issues are still open and 128 have already been fixed.
>
> Some of the still happening issues:
>
> Ref Crashes Repro Title
> <1> 4212 No WARNING in io_ring_exit_work (2)
> https://syzkaller.appspot.com/bug?extid=557a278955ff3a4d3938
> <2> 46 Yes INFO: task hung in io_wq_put_and_exit (6)
> https://syzkaller.appspot.com/bug?extid=4eb282331cab6d5b6588

FWIW, I think we'll keep hitting variants of this, as syzbot tests with
tons of debugging enabled (for good reason), which slows things down a
_lot_. Then it floods the ring with work, and cancelation/exit can then
take a long time. Whenever I've tested these reproducers, they finish
quite quick. Until you enable all the gunk and run it on a slow CPU or
two. Hence not a real bug imho.

--
Jens Axboe