Applied filters: WithRepro (drop) Label=subsystems:io-uring (drop)
Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Closed Patch
KASAN: null-ptr-deref Read in io_sqe_buffer_register prio:high io-uring 11 syz, C done 54 393d 396d 2/29 never fixup: mm/gup: remove record_subpages()
INFO: task hung in io_write io-uring ext4 prio:high 1 syz, C 1 28d 27d 27/29 never 796aa0547557 io_uring/rw: end write accounting from ->ki_complete
memory leak in io_submit_sqes (6) prio:high io-uring block 3 syz, C 2 58d 56d 27/29 never 360941242f09 io_uring/uring_cmd: don't skip completion for a synchronous multishot cmd
INFO: task hung in io_sq_thread_stop fs io-uring 1 syz, C done 211 2058d 2218d 1/29 never io_uring: don't sleep schedule in SQPOLL thread if we need to park
general protection fault in vma_is_shmem mm io-uring 2 syz, C error 28 1505d 1507d 1/29 never mm/gup.c: Fix return value for __gup_longterm_locked()
WARNING in io_pin_pages (2) io-uring prio:low -1 syz, C 22 105d 108d 29/29 83d 3996771b8f75 io_uring/memmap: bound io_pin_pages() by page array byte size
memory leak in path_openat (3) prio:high io-uring 3 syz, C 1 115d 115d 29/29 83d 2564ca2e31bd io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE
WARNING in io_wq_put_and_exit io-uring -1 syz 74 142d 219d 29/29 138d 41859843f27d io_uring/tctx: mark io_wq as exiting before error path teardown
INFO: task hung in io_wq_put_and_exit (6) io-uring 1 syz, C error 74 255d 414d 29/29 152d 10dc95939817 io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop 1f293098a313 io_uring/io-wq: don't trigger hung task for syzbot craziness
INFO: task hung in io_uring_del_tctx_node (5) io-uring 1 syz, C done 19 286d 343d 29/29 271d 101e596e7404 io_uring/fdinfo: cap SQ iteration at max SQ entries
memory leak in io_submit_sqes (5) io-uring 3 syz 3 308d 308d 29/29 271d 84230ad2d2af io_uring/poll: correctly handle io_poll_add() return value on update
INFO: task hung in io_uring_alloc_task_context (6) io-uring 1 syz 5 308d 338d 29/29 271d 101e596e7404 io_uring/fdinfo: cap SQ iteration at max SQ entries
KASAN: global-out-of-bounds Read in io_uring_show_fdinfo io-uring 17 syz, C done 7 337d 340d 29/29 271d 8cd5a59e4d51 io_uring/fdinfo: validate opcode before checking if it's an 128b one
memory leak in iovec_from_user (2) io-uring 3 syz, C 1 332d 329d 29/29 271d d3c9c213c0b8 io_uring/rw: ensure allocated iovec gets cleared for early failure
KASAN: slab-use-after-free Read in io_waitid_wait io-uring 19 syz, C 3 365d 363d 29/29 341d 2f8229d53d98 io_uring/waitid: always prune wait queue entry in io_waitid_wait()
WARNING in __vmap_pages_range_noflush io-uring -1 syz, C done 14 424d 424d 29/29 396d 33503c083fda io_uring/memmap: cast nr_pages to size_t before shifting
WARNING: ODEBUG bug in io_sq_offload_create io-uring -1 syz, C 8 475d 476d 29/29 425d f2320f1dd6f6 io_uring/sqpoll: don't put task_struct on tctx setup failure
WARNING in io_register_clone_buffers io-uring -1 syz, C 4 482d 478d 29/29 425d 1d27f11bf02b io_uring/rsrc: validate buffer count with offset for cloning
BUG: unable to handle kernel NULL pointer dereference in io_buffer_select io-uring 10 syz, C 102 507d 513d 29/29 455d f446c6311e86 io_uring/memmap: don't use page_address() on a highmem page
BUG: unable to handle kernel NULL pointer dereference in io_ring_buffers_peek io-uring 10 syz, C 68 508d 513d 29/29 455d f446c6311e86 io_uring/memmap: don't use page_address() on a highmem page
WARNING: refcount bug in io_send_zc_cleanup (2) io-uring 13 syz, C done 6 563d 563d 28/29 482d 67c007d6c12d io_uring/net: fix sendzc double notif flush
INFO: task hung in io_wq_put_and_exit (4) io-uring 1 syz, C unreliable 86 487d 716d 28/29 482d cf960726eb65 io_uring/kbuf: reject zero sized provided buffers
WARNING in io_pin_pages io-uring -1 syz, C done 14 685d 683d 28/29 517d 0c0a4eae26ac io_uring: check for overflows in io_pin_pages
KMSAN: uninit-value in io_recv io-uring 7 syz, C 31 640d 641d 28/29 517d c6e60a0a68b7 io_uring/net: always initialize kmsg->msg.msg_inq upfront
WARNING: locking bug in eventfd_signal_mask io-uring fs 4 syz, C done 6 642d 646d 28/29 517d a9c83a0ab66a io_uring/timeout: flush timeouts outside of the timeout lock
WARNING in __io_submit_flush_completions io-uring -1 syz, C 23 634d 654d 28/29 517d 60495b08cf7a io_uring: silence false positive warnings
KMSAN: uninit-value in io_nop io-uring 7 syz, C 39 674d 683d 28/29 517d ee116574de84 io_uring/nop: ensure nop->fd is always initialized
general protection fault in io_uring_show_fdinfo (2) io-uring 2 syz, C done 19 704d 703d 28/29 659d d50f94d761a5 io_uring/rsrc: get rid of the empty node and dummy_ubuf
general protection fault in io_sqe_buffer_register io-uring 2 syz, C done 55 701d 703d 28/29 659d d50f94d761a5 io_uring/rsrc: get rid of the empty node and dummy_ubuf
WARNING in io_sq_offload_create io-uring -1 syz, C 284 741d 745d 28/29 708d a09c17240bdf io_uring/sqpoll: retain test for whether the CPU is valid
KMSAN: uninit-value in io_req_task_work_add_remote io-uring 7 syz, C 10 802d 804d 27/29 774d 0db4618e8fab io_uring/msg_ring: fix uninitialized use of target_req->flags
general protection fault in tomoyo_socket_bind_permission io-uring 2 syz, C 4 815d 815d 27/29 783d ad00e629145b io_uring/net: check socket is valid in io_bind()/io_listen()
general protection fault in __io_remove_buffers io-uring 2 syz, C done 3 811d 810d 27/29 783d bcc87d978b83 io_uring: fix error pbuf checking
KMSAN: uninit-value in io_req_cqe_overflow (3) io-uring 7 syz, C 16 844d 844d 26/29 802d 18414a4a2eab io_uring/net: assign kmsg inq/flags before buffer selection
KMSAN: uninit-value in io_sendrecv_fail io-uring 7 syz, C 29 927d 934d 25/29 909d e21e1c45e1fe io_uring: clear opcode specific data for an early failure
KMSAN: uninit-value in io_rw_fail io-uring 7 syz, C 25 980d 996d 25/29 977d 0a535eddbe0d io_uring/rw: ensure io->bytes_done is always initialized
WARNING in get_pte_pfn mm io-uring -1 syz, C error 2 1008d 1019d 25/29 979d c28ac3c7eb94 mm/mglru: skip special VMAs in lru_gen_look_around()
UBSAN: array-index-out-of-bounds in io_setup_async_msg io-uring 15 syz, C done 3 1119d 1118d 25/29 1020d c21a8027ad8a io_uring/net: fix iter retargeting for selected buf
general protection fault in io_get_cqe_overflow io-uring 2 syz, C done 2 1102d 1099d 25/29 1020d 1658633c0465 io_uring: ensure io_lockdep_assert_cq_locked() handles disabled rings
general protection fault in io_uring_show_fdinfo io-uring 2 syz, C done 17 1122d 1130d 23/29 1089d 32f5dea040ee io_uring/fdinfo: only print ->sq_array[] if it's there
WARNING in io_cqring_event_overflow io-uring -1 syz, C 7 1355d 1363d 22/29 1215d 544d163d659d io_uring: lock overflowing for IOPOLL
memory leak in io_submit_sqes (4) io-uring 3 syz, C 1 1367d 1366d 22/29 1215d febb985c06cb io_uring/poll: add hash if ready poll request can't complete inline
WARNING in io_sync_cancel io-uring -1 syz, C error 3 1389d 1385d 22/29 1215d 23fffb2f09ce io_uring/cancel: re-grab ctx mutex after finishing wait
WARNING in io_cqring_overflow_flush io-uring -1 syz, C 2 1389d 1385d 22/29 1215d 52ea806ad983 io_uring: finish waiting before flushing overflow entries
KASAN: use-after-free Read in io_worker_get io-uring 19 syz, C done done 5 1331d 1366d 22/29 1215d e6db6f9398da io_uring/io-wq: only free worker if it was allocated for creation
KASAN: use-after-free Read in io_wq_worker_wake io-uring 19 syz, C done done 1 1333d 1366d 22/29 1215d e6db6f9398da io_uring/io-wq: only free worker if it was allocated for creation
KASAN: wild-memory-access Read in io_wq_worker_running io-uring 19 syz, C 39 1361d 1368d 22/29 1215d e6db6f9398da io_uring/io-wq: only free worker if it was allocated for creation
KASAN: use-after-free Read in tty_release io-uring serial 19 syz, C done 23 1648d 1658d 22/29 1319d d89a4fac0fbc io_uring: fix assuming triggered poll waitqueue is the single poll
KASAN: use-after-free Read in pty_close serial io-uring fuse 19 syz, C done 4 1524d 1552d 22/29 1319d 7a121ced6e64 io_uring: don't miss setting REQ_F_DOUBLE_POLL
KASAN: slab-out-of-bounds Read in io_uring_show_fdinfo io-uring 19 syz, C done 5 1451d 1457d 22/29 1319d 00927931cb63 io_uring: fix fdinfo sqe offsets calculation
kernel BUG in commit_creds lsm io-uring -1 syz, C done 5 1631d 1635d 22/29 1319d 701521403cfb io_uring: abort file assignment prior to assigning creds
memory leak in __vsock_create net virt io-uring 3 syz, C 1 1644d 1640d 22/29 1319d 7e97cfed9929 vsock: Fix memory leak in vsock_connect()
inconsistent lock state in kmem_cache_alloc io-uring 4 syz, C 4 1463d 1470d 22/29 1319d b000145e9907 io_uring/rw: defer fsnotify calls to task context
KASAN: null-ptr-deref Write in io_file_get_normal io-uring fs 12 syz, C done 107 1565d 1649d 22/29 1319d d5361233e9ab io_uring: drop the old style inflight file tracking
memory leak in iovec_from_user fs io-uring 3 syz, C 1 1637d 1633d 22/29 1319d 323b190ba2de io_uring: free iovec if file assignment fails
WARNING in inet_csk_destroy_sock (2) io-uring net -1 syz, C done 8 1368d 1455d 22/29 1319d e0833d1fedb0 dccp/tcp: Fixup bhash2 bucket when connect() fails.
WARNING in io_req_complete_failed io-uring -1 syz, C error 2 1411d 1407d 22/29 1319d c06c6c5d2767 io_uring: always lock in io_apoll_task_func
WARNING: ODEBUG bug in kvm_xen_vcpu_set_attr kvm kvm-x86 io-uring -1 syz, C done 4 1527d 1580d 22/29 1319d af735db31285 KVM: x86/xen: Initialize Xen timer only once c03689913635 KVM: x86/xen: Stop Xen timer before changing IRQ
WARNING in __split_huge_page_tail arch mm io-uring -1 syz, C error 155 1368d 1441d 22/29 1319d 5aae9265ee1a mm: prep_compound_tail() clear page->private
KASAN: use-after-free Write in io_sendrecv_fail io-uring 22 syz, C 75 1450d 1473d 22/29 1319d a75155faef4e io_uring/net: fix UAF in io_sendrecv_fail()
KASAN: use-after-free Read in add_wait_queue fs io-uring 19 syz, C done done 13 1652d 1659d 22/29 1319d d89a4fac0fbc io_uring: fix assuming triggered poll waitqueue is the single poll
BUG: unable to handle kernel NULL pointer dereference in io_do_iopoll fs io-uring 10 syz, C done 3 1603d 1602d 22/29 1319d aa184e8671f0 io_uring: don't attempt to IOPOLL for MSG_RING requests
KASAN: use-after-free Read in __io_remove_buffers io-uring 19 syz, C done 2 1522d 1518d 22/29 1319d ec8516f3b7c4 io_uring: fix free of unallocated buffer list
KASAN: use-after-free Read in filp_close io-uring fs 19 syz, C done 17 1361d 1590d 22/29 1319d 40a1926022d1 fix the breakage in close_fd_get_file() calling conventions change
KASAN: use-after-free Read in inet_bind2_bucket_find net io-uring 19 syz, C done 13 1574d 1581d 22/29 1319d 593d1ebe00a4 Revert "net: Add a second bind table hashed by port and address"
WARNING: still has locks held in io_ring_submit_lock fs io-uring 4 syz, C done 3 1604d 1604d 22/29 1319d e7637a492b9f io_uring: fix locking state for empty buffer group
KASAN: invalid-free in io_clean_op io-uring 24 syz, C 13 1454d 1471d 22/29 1319d 4c17a496a7a0 io_uring/net: fix cleanup double free free_iov init
general protection fault in io_uring_register fs io-uring 2 syz done 1 1852d 1848d 20/29 1672d 41d3a6bd1d37 io_uring: pin SQPOLL data before unlocking ring lock
KASAN: use-after-free Write in io_queue_worker_create fs io-uring 22 syz, C unreliable 132 1755d 1765d 20/29 1672d 71a85387546e io-wq: check for wq exit after adding new worker task_work e47498afeca9 io-wq: remove spurious bit clear on task_work addition
INFO: task hung in io_uring_del_tctx_node io-uring fs 1 syz, C unreliable 37 1674d 1838d 20/29 1672d 8bab4c09f24e io_uring: allow conditional reschedule for intensive iterators
possible deadlock in io_worker_cancel_cb io-uring fs 4 syz, C done 9 1753d 1758d 20/29 1672d d800c65c2d4e io-wq: drop wqe lock before creating new worker
BUG: unable to handle kernel paging request in __blk_mq_alloc_requests io-uring block 19 syz, C unreliable 107 1791d 1799d 20/29 1672d a22c00be90de block: assign correct tag before doing prefetch of request
INFO: task hung in io_uring_try_cancel_requests fs io-uring 1 syz, C error 41 1762d 1803d 20/29 1672d f75d118349be io_uring: harder fdinfo sq/cq ring iterating
WARNING in signalfd_cleanup fs io-uring -1 syz, C done 201 1719d 1734d 20/29 1672d 791f3465c4af io_uring: fix UAF due to missing POLLFREE handling
INFO: task hung in io_uring_cancel_generic (2) io-uring fs 1 syz, C done 97 1756d 1783d 20/29 1672d 78a780602075 io_uring: ensure task_work gets run as part of cancelations
INFO: rcu detected stall in io_wqe_worker (2) fs io-uring 1 syz, C done 2 1805d 1805d 20/29 1672d c5e0321e43de Revert "devlink: Remove not-executed trap policer notifications"
possible deadlock in io_poll_double_wake (3) io-uring fs 4 syz, C error done 703 1728d 2001d 20/29 1672d aa43477b0402 io_uring: poll rework
INFO: task hung in io_wqe_worker fs io-uring 1 syz, C unreliable 3 1814d 1810d 20/29 1672d 1d5f5ea7cb7d io-wq: remove worker to owner tw dependency
WARNING in io_link_timeout_fn fs io-uring -1 syz, C done 2 1972d 1972d 20/29 1791d 447c19f3b507 io_uring: fix ltout double free on completion race
general protection fault in io_commit_cqring (2) io-uring fs 12 syz, C done 82 2003d 2017d 20/29 1791d 51520426f4bc io_uring: handle setup-failed ctx in kill_timeouts
INFO: task hung in io_sq_thread_park (2) fs io-uring 1 syz done 2 1913d 1909d 20/29 1791d 46fee9ab02cb io_uring: remove double poll entry on arm failure
INFO: task hung in __io_uring_cancel fs io-uring 1 syz, C done 5 1929d 1995d 20/29 1791d 28090c133869 io_uring: fix work_exit sqpoll cancellations
memory leak in create_io_worker io-uring fs 3 syz, C 5 1814d 1853d 20/29 1791d 66e70be72288 io-wq: fix memory leak in create_io_worker()
WARNING in io_wqe_enqueue io-uring fs -1 syz, C done 13 1950d 1950d 20/29 1791d e6ab8991c5d0 io_uring: fix false WARN_ONCE
WARNING in io_poll_double_wake fs io-uring -1 syz, C done done 1124 1893d 1994d 20/29 1791d a890d01e4ee0 io_uring: fix poll requests leaking second poll entries
INFO: task hung in io_wq_put_and_exit io-uring fs 1 syz, C unreliable 628 1792d 1853d 20/29 1791d 3b33e3f4a6c0 io-wq: fix silly logic error in io_task_work_match()
general protection fault in try_grab_compound_head io-uring mm 7 syz, C done 5 1892d 1920d 20/29 1791d d08af0a59684 mm/hugetlb: fix refs calculation from unaligned @vaddr
BUG: unable to handle kernel NULL pointer dereference in kiocb_done fs io-uring 10 syz, C unreliable done 3 1859d 1858d 20/29 1791d b8ce1b9d25cc io_uring: don't submit half-prepared drain request
WARNING in io_try_cancel_userdata fs io-uring -1 syz unreliable 4 1866d 1870d 20/29 1791d dadebc350da2 io_uring: fix io_try_cancel_userdata race for iowq
general protection fault in __io_file_supports_nowait fs io-uring 2 syz, C done done 13 1856d 1861d 20/29 1791d c6d3d9cbd659 io_uring: fix queueing half-created requests
INFO: task hung in io_uring_cancel_generic io-uring fs 1 syz, C unreliable 151 1791d 1912d 20/29 1791d 1b48773f9fd0 io_uring: fix io_drain_req()
general protection fault in sock_from_file net io-uring 2 syz, C inconclusive 78 1855d 1862d 20/29 1791d c6d3d9cbd659 io_uring: fix queueing half-created requests
WARNING in io_rsrc_node_switch io-uring fs -1 syz, C done 174 1976d 1986d 20/29 1791d 47b228ce6f66 io_uring: fix unchecked error in switch_start()
WARNING in io_wq_submit_work (2) io-uring fs -1 syz, C done done 52 1850d 1853d 20/29 1791d 713b9825a4c4 io-wq: fix cancellation on create-worker failure
KASAN: stack-out-of-bounds Read in iov_iter_revert fs io-uring 17 syz, C error 14 1864d 1880d 20/29 1791d 89c2b3b74918 io_uring: reexpand under-reexpanded iters
WARNING in io_wq_put fs io-uring -1 syz, C unreliable 3 2025d 2036d 20/29 1791d f5d2d23bf0d9 io-wq: fix race around pending work on teardown
WARNING in io_uring_setup (2) fs io-uring -1 syz, C done 40 1976d 1985d 20/29 1791d 47b228ce6f66 io_uring: fix unchecked error in switch_start()
KASAN: use-after-free Read in idr_for_each (2) io-uring fs 19 syz, C error done 86 2029d 2192d 20/29 1995d 61cf93700fe6 io_uring: Convert personality_idr to XArray
INFO: task hung in io_uring_cancel_task_requests fs io-uring 1 syz, C 305 2029d 2064d 20/29 2005d 34343786ecc5 io_uring: unpark SQPOLL thread for cancelation
INFO: task hung in io_sq_thread_park fs io-uring 1 syz, C unreliable 263 2040d 2045d 20/29 2005d 3ebba796fa25 io_uring: ensure that SQPOLL thread is started for exit
memory leak in io_submit_sqes (2) fs io-uring 3 syz, C 1 2043d 2042d 20/29 2005d f01272541d2c io-wq: ensure all pending work is canceled on exit
possible deadlock in io_poll_double_wake (2) io-uring fs 4 syz, C error error 431 2005d 2198d 20/29 2005d 1c3b3e6527e5 io_uring: ignore double poll add on the same waitqueue head
inconsistent lock state in io_dismantle_req fs io-uring 4 syz, C 2 2073d 2073d 20/29 2005d 9ae1f8dd372e io_uring: fix inconsistent lock state
WARNING in io_uring_flush fs io-uring -1 syz, C unreliable 10 2080d 2089d 19/29 2036d 4325cb498cb7 io_uring: fix uring_flush in exit_files() warning
INFO: task hung in __io_uring_files_cancel io-uring fs 1 syz, C done 30 2077d 2144d 19/29 2036d bee749b187ac io_uring: fix files cancellation
general protection fault in io_disable_sqo_submit fs io-uring 2 syz, C done 124 2088d 2092d 19/29 2036d b4411616c26f io_uring: fix null-deref in io_disable_sqo_submit
WARNING in io_uring_cancel_task_requests io-uring fs -1 syz done 69 2073d 2076d 19/29 2036d 70b2c60d3797 io_uring: fix sqo ownership false positive warning
BUG: corrupted list in io_file_get fs io-uring 8 syz, C done 3 2076d 2076d 19/29 2036d f609cbb8911e io_uring: fix list corruption for splice file_get
KASAN: null-ptr-deref Write in kthread_use_mm io-uring fs 12 syz, C done 2 2164d 2163d 15/29 2145d 4b70cf9dea4c io_uring: ensure consistent view of original task ->mm from SQPOLL
KASAN: use-after-free Write in io_submit_sqes fs io-uring 22 syz, C error 2 2163d 2162d 15/29 2145d cb8a8ae31074 io_uring: drop req/tctx io_identity separately
KASAN: use-after-free Read in io_wqe_worker fs io-uring 19 syz, C error 2 2199d 2201d 15/29 2149d c4068bf898dd io-wq: fix use-after-free in io_wq_worker_running
inconsistent lock state in xa_destroy io-uring fs 4 syz, C 755 2188d 2188d 15/29 2149d ca6484cd308a io_uring: no need to call xa_destroy() on empty xarray
INFO: task hung in io_uring_flush io-uring fs 1 syz, C done done 11 2240d 2247d 15/29 2149d b7ddce3cbf01 io_uring: fix cancel of deferred reqs with ->files
KASAN: use-after-free Write in io_wq_worker_running io-uring fs 22 syz, C error 14 2192d 2219d 15/29 2149d c4068bf898dd io-wq: fix use-after-free in io_wq_worker_running
general protection fault in io_poll_double_wake (2) fs io-uring 2 syz, C error 2 2200d 2199d 15/29 2176d 8706e04ed7d6 io_uring: always delete double poll wait entry on match
KASAN: use-after-free Read in do_madvise io-uring mm 19 syz error 4 2235d 2236d 15/29 2195d 7867fd7cc44e mm: madvise: fix vma user-after-free
possible deadlock in __lock_task_sighand io-uring 4 syz, C done 12 2226d 2228d 15/29 2202d fd7d6de22414 io_uring: don't recurse on tsk->sighand->siglock with signalfd
possible deadlock in __io_queue_deferred fs io-uring 4 syz, C error 1 2249d 2247d 15/29 2210d 7271ef3a93a8 io_uring: fix recursive completion locking on oveflow flush
BUG: unable to handle kernel NULL pointer dereference in loop_rw_iter io-uring fs 10 syz, C done 24 2236d 2247d 15/29 2210d 2dd2111d0d38 io_uring: Fix NULL pointer dereference in loop_rw_iter()
KASAN: use-after-free Read in io_async_task_func io-uring fs 19 syz error 1 2247d 2247d 15/29 2210d 6d816e088c35 io_uring: hold 'ctx' reference around task_work queue + execute
memory leak in io_submit_sqes fs io-uring 3 syz, C 2 2227d 2246d 15/29 2210d a36da65c4656 io_uring: fail poll arm on queue proc failure
general protection fault in io_poll_double_wake io-uring fs 2 syz, C done 8 2214d 2242d 15/29 2210d d4e7cd36a90e io_uring: sanitize double poll handling
possible deadlock in io_timeout_fn io-uring fs 4 syz, C done 4 2245d 2247d 15/29 2210d 51a4cc112c7a io_uring: defer file table grabbing request cleanup for locked requests