From: syzbot ci <syzbot+ci5f475aa1640b4177@syzkaller.appspotmail.com>
To: andres@anarazel.de, axboe@kernel.dk, io-uring@vger.kernel.org
Cc: syzbot@lists.linux.dev, syzkaller-bugs@googlegroups.com
Subject: [syzbot ci] Re: io_uring/rsrc: remove registered buffer 1GB limit
Date: Tue, 05 May 2026 06:08:30 -0700 [thread overview]
Message-ID: <69f9ebce.170a0220.59368.0011.GAE@google.com> (raw)
In-Reply-To: <6de5d329-9162-4992-85cb-f946f2d5c0b1@kernel.dk>
syzbot ci has tested the following series
[v1] io_uring/rsrc: remove registered buffer 1GB limit
https://lore.kernel.org/all/6de5d329-9162-4992-85cb-f946f2d5c0b1@kernel.dk
* [PATCH] io_uring/rsrc: remove registered buffer 1GB limit
and found the following issue:
WARNING in io_pin_pages
Full report is available here:
https://ci.syzbot.org/series/576c7f20-d7fb-471a-a534-f8f67489e049
***
WARNING in io_pin_pages
tree: torvalds
URL: https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux
base: c7e4e4d5f7dc2daa439303d1b5bf6bdfaa249f49
arch: amd64
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
config: https://ci.syzbot.org/builds/287c9ce7-c085-4a41-9f94-756762f8dacf/config
syz repro: https://ci.syzbot.org/findings/63ff94b0-aced-41c6-83fc-a917c57ad624/syz_repro
------------[ cut here ]------------
!(flags & __GFP_NOWARN)
WARNING: mm/slub.c:6840 at __kvmalloc_node_noprof+0x7be/0x8a0 mm/slub.c:6840, CPU#1: syz.1.18/5830
Modules linked in:
CPU: 1 UID: 0 PID: 5830 Comm: syz.1.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:__kvmalloc_node_noprof+0x7be/0x8a0 mm/slub.c:6840
Code: ff 48 c7 c7 d0 bd a8 8e 48 89 de e8 dc 48 c9 02 e9 49 fc ff ff 48 c7 c7 10 be a8 8e 48 89 de e8 c8 48 c9 02 e9 7e fc ff ff 90 <0f> 0b 90 45 31 e4 e9 f8 fd ff ff 90 0f 0b 90 e9 52 ff ff ff 49 83
RSP: 0018:ffffc90003a37928 EFLAGS: 00010246
RAX: 0000000000000004 RBX: 0000000201000008 RCX: 0000000080000001
RDX: 0000000201000008 RSI: ffffffff8c28ac40 RDI: ffffffff8c28ac00
RBP: ffffc90003a37b70 R08: 00000000004028c0 R09: 00000000ffffffff
R10: 0000000000000006 R11: 0000000000000000 R12: 0000000000000000
R13: 00000000004028c0 R14: 0000000000000016 R15: 00000000ffffffff
FS: 00007fb3823ec6c0(0000) GS:ffff8882a9290000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcca0efe68 CR3: 000000017064e000 CR4: 00000000000006f0
Call Trace:
<TASK>
io_pin_pages+0xac/0x1a0 io_uring/memmap.c:59
io_sqe_buffer_register+0x228/0x1860 io_uring/rsrc.c:801
io_sqe_buffers_register+0x2f9/0x7e0 io_uring/rsrc.c:913
io_register_rsrc+0x24d/0x280 io_uring/rsrc.c:414
__io_uring_register io_uring/register.c:843 [inline]
__do_sys_io_uring_register io_uring/register.c:1029 [inline]
__se_sys_io_uring_register+0xc5d/0x1ac0 io_uring/register.c:1006
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb38159cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb3823ec028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab
RAX: ffffffffffffffda RBX: 00007fb381815fa0 RCX: 00007fb38159cdd9
RDX: 0000200000002700 RSI: 000000000000000f RDI: 0000000000000003
RBP: 00007fb381632d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb381816038 R14: 00007fb381815fa0 R15: 00007fffdb4e7d78
</TASK>
***
If these findings have caused you to resend the series or submit a
separate fix, please add the following tag to your commit message:
Tested-by: syzbot@syzkaller.appspotmail.com
---
This report is generated by a bot. It may contain errors.
syzbot ci engineers can be reached at syzkaller@googlegroups.com.
To test a patch for this bug, please reply with `#syz test`
(should be on a separate line).
The patch should be attached to the email.
Note: arguments like custom git repos and branches are not supported.
prev parent reply other threads:[~2026-05-05 13:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-05 7:39 [PATCH] io_uring/rsrc: remove registered buffer 1GB limit Jens Axboe
2026-05-05 10:09 ` Jens Axboe
2026-05-05 13:23 ` Clément Léger
2026-05-05 13:26 ` Jens Axboe
2026-05-05 13:35 ` Clément Léger
2026-05-05 13:08 ` syzbot ci [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69f9ebce.170a0220.59368.0011.GAE@google.com \
--to=syzbot+ci5f475aa1640b4177@syzkaller.appspotmail.com \
--cc=andres@anarazel.de \
--cc=axboe@kernel.dk \
--cc=io-uring@vger.kernel.org \
--cc=syzbot@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.