syzbot


memory leak in do_cmd_ioctl

Status: upstream: reported C repro on 2025/12/15 04:03
Subsystems: comedi
[Documentation on labels]
Reported-by: syzbot+f238baf6ded841b5a82e@syzkaller.appspotmail.com
First crash: 17h15m, last: 17h15m
Discussions (3)
Title Replies (including bot) Last reply
[PATCH] comedi: runflags cannot determine whether to reclaim chanlist 2 (2) 2025/12/15 12:25
[PATCH] comedi: test memleak 2 (4) 2025/12/15 09:48
[syzbot] [comedi?] memory leak in do_cmd_ioctl 0 (1) 2025/12/15 04:03
Last patch testing requests (2)
Created Duration User Patch Repo Result
2025/12/15 08:51 26m xiaopeitux@foxmail.com patch upstream OK log
2025/12/15 07:50 14m xiaopeitux@foxmail.com patch upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88811193c4d8 (size 8):
  comm "syz.0.17", pid 6094, jiffies 4294942826
  hex dump (first 8 bytes):
    04 00 00 00 00 00 00 00                          ........
  backtrace (crc 844a0efa):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_node_track_caller_noprof+0x3af/0x670 mm/slub.c:5764
    memdup_user+0x2a/0xe0 mm/util.c:221
    memdup_array_user include/linux/string.h:39 [inline]
    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]
    comedi_unlocked_ioctl+0xdea/0x1300 drivers/comedi/comedi_fops.c:2319
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811193c990 (size 8):
  comm "syz.0.18", pid 6096, jiffies 4294942827
  hex dump (first 8 bytes):
    04 00 00 00 00 00 00 00                          ........
  backtrace (crc 844a0efa):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_node_track_caller_noprof+0x3af/0x670 mm/slub.c:5764
    memdup_user+0x2a/0xe0 mm/util.c:221
    memdup_array_user include/linux/string.h:39 [inline]
    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]
    comedi_unlocked_ioctl+0xdea/0x1300 drivers/comedi/comedi_fops.c:2319
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff88811193cea0 (size 8):
  comm "syz.0.19", pid 6099, jiffies 4294942829
  hex dump (first 8 bytes):
    04 00 00 00 00 00 00 00                          ........
  backtrace (crc 844a0efa):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_node_track_caller_noprof+0x3af/0x670 mm/slub.c:5764
    memdup_user+0x2a/0xe0 mm/util.c:221
    memdup_array_user include/linux/string.h:39 [inline]
    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]
    comedi_unlocked_ioctl+0xdea/0x1300 drivers/comedi/comedi_fops.c:2319
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888144d28bf8 (size 8):
  comm "syz.0.20", pid 6124, jiffies 4294943361
  hex dump (first 8 bytes):
    04 00 00 00 00 00 00 00                          ........
  backtrace (crc 844a0efa):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_node_track_caller_noprof+0x3af/0x670 mm/slub.c:5764
    memdup_user+0x2a/0xe0 mm/util.c:221
    memdup_array_user include/linux/string.h:39 [inline]
    __comedi_get_user_chanlist drivers/comedi/comedi_fops.c:1815 [inline]
    do_cmd_ioctl.part.0+0x112/0x350 drivers/comedi/comedi_fops.c:1890
    do_cmd_ioctl drivers/comedi/comedi_fops.c:1858 [inline]
    comedi_unlocked_ioctl+0xdea/0x1300 drivers/comedi/comedi_fops.c:2319
    vfs_ioctl fs/ioctl.c:51 [inline]
    __do_sys_ioctl fs/ioctl.c:597 [inline]
    __se_sys_ioctl fs/ioctl.c:583 [inline]
    __x64_sys_ioctl+0xf4/0x140 fs/ioctl.c:583
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/15 02:37 upstream 8f0b4cce4481 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in do_cmd_ioctl
* Struck through repros no longer work on HEAD.