syzbot

 sign-in | mailing list | source | docs
🐞 Open [1454]
≡ Subsystems
🐞 Fixed [6864]
🐞 Invalid [17808]
⬇ Missing Backports [226]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
💬 Send us feedback

memory leak in iovec_from_user (4)

Status: closed as invalid on 2026/01/14 16:09
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+df0b387708573ad096ce@syzkaller.appspotmail.com
First crash: 2d11h, last: 2d11h
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [io-uring?] memory leak in iovec_from_user (4) 1 (2) 2026/01/14 16:09
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream memory leak in iovec_from_user (3) io-uring 3 C 1 4d06h 3d21h 0/29 closed as invalid on 2026/01/12 19:36
upstream memory leak in iovec_from_user (2) io-uring 3 C 1 69d 66d 29/29 fixed on 2026/01/07 12:29
upstream memory leak in iovec_from_user fs io-uring 3 C 1 1374d 1370d 22/29 fixed on 2023/02/24 13:50

Sample crash report:
BUG: memory leak
unreferenced object 0xffff88812944f000 (size 4096):
  comm "syz.3.20", pid 6138, jiffies 4294947163
  hex dump (first 32 bytes):
    40 02 00 00 00 20 00 00 03 00 00 00 00 00 00 00  @.... ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8ab58d7d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1321 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1304
    __import_iovec+0x71/0x350 lib/iov_iter.c:1375
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:313 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:325
    io_prep_rwv io_uring/rw.c:343 [inline]
    io_prep_writev+0x23/0x80 io_uring/rw.c:363
    io_init_req io_uring/io_uring.c:2235 [inline]
    io_submit_sqe io_uring/io_uring.c:2282 [inline]
    io_submit_sqes+0x40d/0xf40 io_uring/io_uring.c:2435
    __do_sys_io_uring_enter+0x841/0xcf0 io_uring/io_uring.c:3285
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129450000 (size 4096):
  comm "syz.3.20", pid 6138, jiffies 4294947163
  hex dump (first 32 bytes):
    40 02 00 00 00 20 00 00 03 00 00 00 00 00 00 00  @.... ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8ab58d7d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1321 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1304
    __import_iovec+0x71/0x350 lib/iov_iter.c:1375
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:313 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:325
    io_prep_rwv io_uring/rw.c:343 [inline]
    io_prep_writev+0x23/0x80 io_uring/rw.c:363
    io_init_req io_uring/io_uring.c:2235 [inline]
    io_submit_sqe io_uring/io_uring.c:2282 [inline]
    io_submit_sqes+0x40d/0xf40 io_uring/io_uring.c:2435
    __do_sys_io_uring_enter+0x841/0xcf0 io_uring/io_uring.c:3285
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129451000 (size 4096):
  comm "syz.3.20", pid 6138, jiffies 4294947163
  hex dump (first 32 bytes):
    40 02 00 00 00 20 00 00 03 00 00 00 00 00 00 00  @.... ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8ab58d7d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1321 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1304
    __import_iovec+0x71/0x350 lib/iov_iter.c:1375
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:313 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:325
    io_prep_rwv io_uring/rw.c:343 [inline]
    io_prep_writev+0x23/0x80 io_uring/rw.c:363
    io_init_req io_uring/io_uring.c:2235 [inline]
    io_submit_sqe io_uring/io_uring.c:2282 [inline]
    io_submit_sqes+0x40d/0xf40 io_uring/io_uring.c:2435
    __do_sys_io_uring_enter+0x841/0xcf0 io_uring/io_uring.c:3285
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129453000 (size 4096):
  comm "syz.3.20", pid 6138, jiffies 4294947164
  hex dump (first 32 bytes):
    40 02 00 00 00 20 00 00 03 00 00 00 00 00 00 00  @.... ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8ab58d7d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1321 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1304
    __import_iovec+0x71/0x350 lib/iov_iter.c:1375
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:313 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:325
    io_prep_rwv io_uring/rw.c:343 [inline]
    io_prep_writev+0x23/0x80 io_uring/rw.c:363
    io_init_req io_uring/io_uring.c:2235 [inline]
    io_submit_sqe io_uring/io_uring.c:2282 [inline]
    io_submit_sqes+0x40d/0xf40 io_uring/io_uring.c:2435
    __do_sys_io_uring_enter+0x841/0xcf0 io_uring/io_uring.c:3285
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129452000 (size 4096):
  comm "syz.3.20", pid 6138, jiffies 4294947164
  hex dump (first 32 bytes):
    40 02 00 00 00 20 00 00 03 00 00 00 00 00 00 00  @.... ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8ab58d7d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1321 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1304
    __import_iovec+0x71/0x350 lib/iov_iter.c:1375
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:313 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:325
    io_prep_rwv io_uring/rw.c:343 [inline]
    io_prep_writev+0x23/0x80 io_uring/rw.c:363
    io_init_req io_uring/io_uring.c:2235 [inline]
    io_submit_sqe io_uring/io_uring.c:2282 [inline]
    io_submit_sqes+0x40d/0xf40 io_uring/io_uring.c:2435
    __do_sys_io_uring_enter+0x841/0xcf0 io_uring/io_uring.c:3285
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888129454000 (size 4096):
  comm "syz.3.20", pid 6138, jiffies 4294947164
  hex dump (first 32 bytes):
    40 02 00 00 00 20 00 00 03 00 00 00 00 00 00 00  @.... ..........
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8ab58d7d):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x3e0/0x660 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kmalloc_array_noprof include/linux/slab.h:1003 [inline]
    iovec_from_user lib/iov_iter.c:1321 [inline]
    iovec_from_user+0x108/0x140 lib/iov_iter.c:1304
    __import_iovec+0x71/0x350 lib/iov_iter.c:1375
    io_import_vec io_uring/rw.c:99 [inline]
    __io_import_rw_buffer+0x1e2/0x260 io_uring/rw.c:120
    io_import_rw_buffer io_uring/rw.c:139 [inline]
    io_rw_do_import io_uring/rw.c:313 [inline]
    io_prep_rw+0xb5/0x120 io_uring/rw.c:325
    io_prep_rwv io_uring/rw.c:343 [inline]
    io_prep_writev+0x23/0x80 io_uring/rw.c:363
    io_init_req io_uring/io_uring.c:2235 [inline]
    io_submit_sqe io_uring/io_uring.c:2282 [inline]
    io_submit_sqes+0x40d/0xf40 io_uring/io_uring.c:2435
    __do_sys_io_uring_enter+0x841/0xcf0 io_uring/io_uring.c:3285
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/14 04:13 upstream b54345928fa1 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-leak memory leak in iovec_from_user
* Struck through repros no longer work on HEAD.