syzbot


Applied filters: Label=subsystems:io-uring (drop)
Title Repro Cause bisect Fix bisect Count Last Reported Patched Closed Patch
INFO: task hung in io_sq_thread_stop fs io-uring C done 211 1137d 1296d 1/26 never io_uring: don't sleep schedule in SQPOLL thread if we need to park
KMSAN: uninit-value in io_sendrecv_fail io-uring C 29 5d15h 12d 20/26 never e21e1c45e1fe io_uring: clear opcode specific data for an early failure
general protection fault in vma_is_shmem mm io-uring C error 28 584d 585d 1/26 never mm/gup.c: Fix return value for __gup_longterm_locked()
general protection fault in vma_interval_tree_remove mm io-uring C done 13 678d 696d 1/26 never mm/mmap: fix advanced maple tree API for mmap_region() mm/mmap: qvoid dereferencing next on null in BUG_ON()
KMSAN: uninit-value in io_rw_fail (2) io-uring 1 51d 47d 26/26 43d 0a535eddbe0d io_uring/rw: ensure io->bytes_done is always initialized
KMSAN: uninit-value in io_rw_fail io-uring C 25 58d 74d 26/26 55d 0a535eddbe0d io_uring/rw: ensure io->bytes_done is always initialized
WARNING in get_pte_pfn io-uring mm C error 2 87d 97d 26/26 58d c28ac3c7eb94 mm/mglru: skip special VMAs in lru_gen_look_around()
BUG: unable to handle kernel NULL pointer dereference in __io_remove_buffers (2) io-uring 86 173d 178d 25/26 98d f8024f1f36a3 io_uring/kbuf: don't allow registered buffer rings on highmem pages
UBSAN: array-index-out-of-bounds in io_setup_async_msg io-uring C done 3 198d 197d 25/26 98d c21a8027ad8a io_uring/net: fix iter retargeting for selected buf
general protection fault in io_get_cqe_overflow io-uring C done 2 180d 178d 25/26 98d 1658633c0465 io_uring: ensure io_lockdep_assert_cq_locked() handles disabled rings
general protection fault in io_sqpoll_wq_cpu_affinity io-uring 33 202d 213d 23/26 168d bd6fc5da4c51 io_uring: Don't set affinity on a dying sqpoll thread
general protection fault in io_uring_show_fdinfo io-uring C done 17 200d 209d 23/26 168d 32f5dea040ee io_uring/fdinfo: only print ->sq_array[] if it's there
WARNING in io_get_cqe_overflow io-uring 1 431d 430d 22/26 294d e12d7a46f65a io_uring/msg_ring: fix missing lock on overflow for IOPOLL
WARNING in io_cqring_event_overflow io-uring C 7 434d 441d 22/26 294d 544d163d659d io_uring: lock overflowing for IOPOLL
memory leak in io_submit_sqes (4) io-uring C 1 445d 444d 22/26 294d febb985c06cb io_uring/poll: add hash if ready poll request can't complete inline
WARNING in io_sync_cancel io-uring C error 3 467d 463d 22/26 294d 23fffb2f09ce io_uring/cancel: re-grab ctx mutex after finishing wait
WARNING in io_cqring_overflow_flush io-uring C 2 467d 463d 22/26 294d 52ea806ad983 io_uring: finish waiting before flushing overflow entries
KASAN: use-after-free Read in io_worker_get io-uring C done done 5 409d 444d 22/26 294d e6db6f9398da io_uring/io-wq: only free worker if it was allocated for creation
KASAN: use-after-free Read in io_wq_worker_wake io-uring C done done 1 411d 444d 22/26 294d e6db6f9398da io_uring/io-wq: only free worker if it was allocated for creation
KASAN: wild-memory-access Read in io_wq_worker_running io-uring C 39 440d 446d 22/26 294d e6db6f9398da io_uring/io-wq: only free worker if it was allocated for creation
KASAN: use-after-free Read in tty_release io-uring serial C done 23 727d 737d 22/26 398d d89a4fac0fbc io_uring: fix assuming triggered poll waitqueue is the single poll
KASAN: use-after-free Read in pty_close serial io-uring fuse C done 4 603d 630d 22/26 398d 7a121ced6e64 io_uring: don't miss setting REQ_F_DOUBLE_POLL
KASAN: slab-out-of-bounds Read in io_uring_show_fdinfo io-uring C done 5 529d 535d 22/26 398d 00927931cb63 io_uring: fix fdinfo sqe offsets calculation
kernel BUG in commit_creds io-uring C done 5 709d 713d 22/26 398d 701521403cfb io_uring: abort file assignment prior to assigning creds
inconsistent lock state in kmem_cache_alloc io-uring C 4 542d 549d 22/26 398d b000145e9907 io_uring/rw: defer fsnotify calls to task context
KASAN: null-ptr-deref Write in io_file_get_normal io-uring fs C done 107 643d 728d 22/26 398d d5361233e9ab io_uring: drop the old style inflight file tracking
memory leak in iovec_from_user fs io-uring C 1 715d 711d 22/26 398d 323b190ba2de io_uring: free iovec if file assignment fails
WARNING in inet_csk_destroy_sock (2) io-uring net C done 8 447d 533d 22/26 398d e0833d1fedb0 dccp/tcp: Fixup bhash2 bucket when connect() fails.
WARNING in io_req_complete_failed io-uring C error 2 489d 485d 22/26 398d c06c6c5d2767 io_uring: always lock in io_apoll_task_func
WARNING: ODEBUG bug in kvm_xen_vcpu_set_attr kvm io-uring C done 4 605d 658d 22/26 398d af735db31285 KVM: x86/xen: Initialize Xen timer only once c03689913635 KVM: x86/xen: Stop Xen timer before changing IRQ
WARNING in __split_huge_page_tail arch mm io-uring C error 155 447d 519d 22/26 398d 5aae9265ee1a mm: prep_compound_tail() clear page->private
KASAN: use-after-free Write in io_sendrecv_fail io-uring C 75 529d 552d 22/26 398d a75155faef4e io_uring/net: fix UAF in io_sendrecv_fail()
KASAN: use-after-free Read in add_wait_queue fs io-uring C done done 13 730d 737d 22/26 398d d89a4fac0fbc io_uring: fix assuming triggered poll waitqueue is the single poll
BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll fs io-uring C done 3 682d 681d 22/26 398d aa184e8671f0 io_uring: don't attempt to IOPOLL for MSG_RING requests
KASAN: use-after-free Read in __io_remove_buffers io-uring C done 2 600d 596d 22/26 398d ec8516f3b7c4 io_uring: fix free of unallocated buffer list
KASAN: use-after-free Read in filp_close io-uring fs C done 17 439d 668d 22/26 398d 40a1926022d1 fix the breakage in close_fd_get_file() calling conventions change
BUG: Bad page map (5) mm io-uring C 35 439d 697d 22/26 398d 4d24de9425f7 mm: MADV_COLLAPSE: refetch vm_end after reacquiring mmap_lock
KASAN: use-after-free Read in inet_bind2_bucket_find net io-uring C done 13 653d 660d 22/26 398d 593d1ebe00a4 Revert "net: Add a second bind table hashed by port and address"
WARNING: still has locks held in io_ring_submit_lock fs io-uring C done 3 682d 683d 22/26 398d e7637a492b9f io_uring: fix locking state for empty buffer group
KASAN: invalid-free in io_clean_op io-uring C 13 532d 550d 22/26 398d 4c17a496a7a0 io_uring/net: fix cleanup double free free_iov init
general protection fault in io_uring_register fs io-uring syz done 1 930d 927d 20/26 751d 41d3a6bd1d37 io_uring: pin SQPOLL data before unlocking ring lock
KASAN: use-after-free Write in io_queue_worker_create fs io-uring C unreliable 132 834d 843d 20/26 751d 71a85387546e io-wq: check for wq exit after adding new worker task_work e47498afeca9 io-wq: remove spurious bit clear on task_work addition
INFO: task hung in io_uring_del_tctx_node io-uring fs C unreliable 37 753d 916d 20/26 751d 8bab4c09f24e io_uring: allow conditional reschedule for intensive iterators
possible deadlock in io_worker_cancel_cb fs io-uring C done 9 832d 836d 20/26 751d d800c65c2d4e io-wq: drop wqe lock before creating new worker
BUG: unable to handle kernel paging request in __blk_mq_alloc_requests io-uring block C unreliable 107 869d 878d 20/26 751d a22c00be90de block: assign correct tag before doing prefetch of request
INFO: task hung in io_uring_try_cancel_requests fs io-uring C error 41 840d 882d 20/26 751d f75d118349be io_uring: harder fdinfo sq/cq ring iterating
WARNING in signalfd_cleanup fs io-uring C done 201 797d 813d 20/26 751d 791f3465c4af io_uring: fix UAF due to missing POLLFREE handling
INFO: task hung in io_uring_cancel_generic (2) io-uring fs C done 97 834d 861d 20/26 751d 78a780602075 io_uring: ensure task_work gets run as part of cancelations
INFO: rcu detected stall in io_wqe_worker (2) fs io-uring C done 2 883d 883d 20/26 751d c5e0321e43de Revert "devlink: Remove not-executed trap policer notifications"
possible deadlock in io_poll_double_wake (3) io-uring fs C error done 703 806d 1079d 20/26 751d aa43477b0402 io_uring: poll rework
INFO: task hung in io_wqe_worker fs io-uring C unreliable 3 892d 888d 20/26 751d 1d5f5ea7cb7d io-wq: remove worker to owner tw dependency
WARNING in io_link_timeout_fn fs io-uring C done 2 1051d 1050d 20/26 869d 447c19f3b507 io_uring: fix ltout double free on completion race
general protection fault in io_commit_cqring (2) fs io-uring C done 82 1081d 1095d 20/26 869d 51520426f4bc io_uring: handle setup-failed ctx in kill_timeouts
INFO: task hung in io_sq_thread_park (2) fs io-uring syz done 2 991d 987d 20/26 869d 46fee9ab02cb io_uring: remove double poll entry on arm failure
INFO: task hung in __io_uring_cancel fs io-uring C done 5 1007d 1073d 20/26 869d 28090c133869 io_uring: fix work_exit sqpoll cancellations
memory leak in create_io_worker io-uring fs C 5 892d 931d 20/26 869d 66e70be72288 io-wq: fix memory leak in create_io_worker()
WARNING in io_wqe_enqueue io-uring fs C done 13 1028d 1028d 20/26 869d e6ab8991c5d0 io_uring: fix false WARN_ONCE
WARNING in io_poll_double_wake fs io-uring C done done 1124 971d 1072d 20/26 869d a890d01e4ee0 io_uring: fix poll requests leaking second poll entries
INFO: task hung in io_wq_put_and_exit io-uring fs C unreliable 628 870d 931d 20/26 869d 3b33e3f4a6c0 io-wq: fix silly logic error in io_task_work_match()
general protection fault in try_grab_compound_head mm io-uring C done 5 971d 999d 20/26 869d d08af0a59684 mm/hugetlb: fix refs calculation from unaligned @vaddr
BUG: unable to handle kernel NULL pointer dereference in kiocb_done fs io-uring C unreliable done 3 937d 936d 20/26 869d b8ce1b9d25cc io_uring: don't submit half-prepared drain request
WARNING in io_try_cancel_userdata fs io-uring syz unreliable 4 944d 948d 20/26 869d dadebc350da2 io_uring: fix io_try_cancel_userdata race for iowq
general protection fault in __io_file_supports_nowait fs io-uring C done done 13 934d 939d 20/26 869d c6d3d9cbd659 io_uring: fix queueing half-created requests
INFO: task hung in io_uring_cancel_generic io-uring fs C unreliable 151 869d 991d 20/26 869d 1b48773f9fd0 io_uring: fix io_drain_req()
general protection fault in sock_from_file net io-uring C inconclusive 78 933d 940d 20/26 869d c6d3d9cbd659 io_uring: fix queueing half-created requests
WARNING in io_rsrc_node_switch io-uring fs C done 174 1055d 1064d 20/26 869d 47b228ce6f66 io_uring: fix unchecked error in switch_start()
WARNING in io_wq_submit_work (2) io-uring fs C done done 52 929d 931d 20/26 869d 713b9825a4c4 io-wq: fix cancellation on create-worker failure
KASAN: stack-out-of-bounds Read in iov_iter_revert fs io-uring C error 14 942d 959d 20/26 869d 89c2b3b74918 io_uring: reexpand under-reexpanded iters
WARNING in io_wq_put fs io-uring C unreliable 3 1103d 1115d 20/26 869d f5d2d23bf0d9 io-wq: fix race around pending work on teardown
WARNING in io_uring_setup (2) io-uring fs C done 40 1055d 1064d 20/26 869d 47b228ce6f66 io_uring: fix unchecked error in switch_start()
KASAN: use-after-free Read in idr_for_each (2) io-uring fs C error done 86 1108d 1270d 20/26 1073d 61cf93700fe6 io_uring: Convert personality_idr to XArray
INFO: task hung in io_uring_cancel_task_requests fs io-uring C 305 1108d 1142d 20/26 1083d 34343786ecc5 io_uring: unpark SQPOLL thread for cancelation
INFO: task hung in io_sq_thread_park fs io-uring C unreliable 263 1119d 1123d 20/26 1083d 3ebba796fa25 io_uring: ensure that SQPOLL thread is started for exit
memory leak in io_submit_sqes (2) fs io-uring C 1 1121d 1121d 20/26 1083d f01272541d2c io-wq: ensure all pending work is canceled on exit
possible deadlock in io_poll_double_wake (2) io-uring fs C error error 431 1084d 1276d 20/26 1083d 1c3b3e6527e5 io_uring: ignore double poll add on the same waitqueue head
inconsistent lock state in io_dismantle_req fs io-uring C 2 1151d 1151d 20/26 1083d 9ae1f8dd372e io_uring: fix inconsistent lock state
WARNING in io_uring_flush fs io-uring C unreliable 10 1158d 1168d 19/26 1114d 4325cb498cb7 io_uring: fix uring_flush in exit_files() warning
INFO: task hung in __io_uring_files_cancel io-uring fs C done 30 1155d 1222d 19/26 1114d bee749b187ac io_uring: fix files cancellation
general protection fault in io_disable_sqo_submit fs io-uring C done 124 1166d 1170d 19/26 1114d b4411616c26f io_uring: fix null-deref in io_disable_sqo_submit
WARNING in io_uring_cancel_task_requests io-uring fs syz done 69 1151d 1155d 19/26 1114d 70b2c60d3797 io_uring: fix sqo ownership false positive warning
BUG: corrupted list in io_file_get fs io-uring C done 3 1155d 1155d 19/26 1114d f609cbb8911e io_uring: fix list corruption for splice file_get
KASAN: null-ptr-deref Write in kthread_use_mm fs io-uring C done 2 1242d 1242d 15/26 1224d 4b70cf9dea4c io_uring: ensure consistent view of original task ->mm from SQPOLL
KASAN: use-after-free Write in io_submit_sqes fs io-uring C error 2 1242d 1241d 15/26 1224d cb8a8ae31074 io_uring: drop req/tctx io_identity separately
KASAN: use-after-free Read in io_wqe_worker fs io-uring C error 2 1277d 1279d 15/26 1228d c4068bf898dd io-wq: fix use-after-free in io_wq_worker_running
inconsistent lock state in xa_destroy io-uring fs C 755 1266d 1267d 15/26 1228d ca6484cd308a io_uring: no need to call xa_destroy() on empty xarray
INFO: task hung in io_uring_flush io-uring fs C done done 11 1319d 1326d 15/26 1228d b7ddce3cbf01 io_uring: fix cancel of deferred reqs with ->files
KASAN: use-after-free Write in io_wq_worker_running io-uring fs C error 14 1271d 1297d 15/26 1228d c4068bf898dd io-wq: fix use-after-free in io_wq_worker_running
general protection fault in io_poll_double_wake (2) fs io-uring C error 2 1278d 1277d 15/26 1254d 8706e04ed7d6 io_uring: always delete double poll wait entry on match
KASAN: use-after-free Read in do_madvise io-uring mm syz error 4 1313d 1315d 15/26 1274d 7867fd7cc44e mm: madvise: fix vma user-after-free
possible deadlock in __lock_task_sighand io-uring C done 12 1305d 1306d 15/26 1280d fd7d6de22414 io_uring: don't recurse on tsk->sighand->siglock with signalfd
possible deadlock in __io_queue_deferred io-uring fs C error 1 1327d 1326d 15/26 1288d 7271ef3a93a8 io_uring: fix recursive completion locking on oveflow flush
BUG: unable to handle kernel NULL pointer dereference in loop_rw_iter io-uring fs C done 24 1314d 1326d 15/26 1288d 2dd2111d0d38 io_uring: Fix NULL pointer dereference in loop_rw_iter()
KASAN: use-after-free Read in io_async_task_func fs io-uring syz error 1 1325d 1325d 15/26 1288d 6d816e088c35 io_uring: hold 'ctx' reference around task_work queue + execute
memory leak in io_submit_sqes fs io-uring C 2 1306d 1325d 15/26 1288d a36da65c4656 io_uring: fail poll arm on queue proc failure
general protection fault in io_poll_double_wake io-uring fs C done 8 1293d 1321d 15/26 1288d d4e7cd36a90e io_uring: sanitize double poll handling
possible deadlock in io_timeout_fn io-uring fs C done 4 1323d 1326d 15/26 1288d 51a4cc112c7a io_uring: defer file table grabbing request cleanup for locked requests