From: syzbot <syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com>
To: almaz.alexandrovich@paragon-software.com, bp@alien8.de,
dave.hansen@linux.intel.com, dsterba@suse.com, hpa@zytor.com,
linux-btrfs@vger.kernel.org, linux-ext4@vger.kernel.org,
linux-kernel@vger.kernel.org, mingo@redhat.com,
ntfs3@lists.linux.dev, syzkaller-bugs@googlegroups.com,
tglx@kernel.org, x86@kernel.org
Subject: [syzbot] [btrfs?] [ext4?] [ntfs3?] memory leak in __pcs_replace_full_main
Date: Wed, 04 Nov 2026 15:17:26 -0800 [thread overview]
Message-ID: <6aebbd06.21d05368.325ed5.0000.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 36aad21d50d1 Merge tag 'ksmbd-for-7.4-rc1-part2' of git://..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14e205f1580000
kernel config: https://syzkaller.appspot.com/x/.config?x=afcef595c54d5d11
dashboard link: https://syzkaller.appspot.com/bug?extid=4d078516add5f4f12cea
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12e205f1580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/67a38cdd86cf/disk-36aad21d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7b8834e6d3d5/vmlinux-36aad21d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9103be67c72d/bzImage-36aad21d.xz
mounted in repro #1: https://storage.googleapis.com/syzbot-assets/a661f7a0d152/mount_0.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=130fea8d580000)
mounted in repro #2: https://storage.googleapis.com/syzbot-assets/5aa6292982d9/mount_13.gz
mounted in repro #3: https://storage.googleapis.com/syzbot-assets/5bf87b41f4ce/mount_16.gz
fsck result: OK (log: https://syzkaller.appspot.com/x/fsck.log?x=13558981580000)
AI-generated root cause summary:
The SLUB allocator's sheaf caching layer allocates 'struct slab_sheaf' objects
via kmalloc_flags(), which registers them with kmemleak for leak tracking. When
full RCU sheaves are retired in __kfree_rcu_sheaf(), they are queued into RCU
via call_rcu(&rcu_sheaf->rcu_head, rcu_free_sheaf). While pending in RCU's
singly-linked callback list, if any preceding callback resides in memory
untracked or ignored by kmemleak (such as struct slab from
call_rcu(&slab->rcu_head, rcu_free_slab)), kmemleak cannot traverse the chain to
reach subsequent callbacks. Because __alloc_empty_sheaf() does not mark the
sheaf with kmemleak_not_leak() (which marks the metadata grey so it is not
reported as a leak while still scanning its cached objects), kmemleak falsely
flags pending RCU sheaves as unreferenced memory leaks.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=4d078516add5f4f12cea
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff8881009d4e00 (size 512):
comm "kworker/0:1", pid 10, jiffies 4294937433
hex dump (first 32 bytes):
b0 7e 81 2d 81 88 ff ff 60 bd b3 81 ff ff ff ff .~.-....`.......
00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00 ........<.......
backtrace (crc 91d5a5d8):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
__do_kmalloc_node mm/slub.c:5530 [inline]
__kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2854 [inline]
alloc_empty_sheaf mm/slub.c:2874 [inline]
__pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
free_to_pcs mm/slub.c:6147 [inline]
slab_free mm/slub.c:6633 [inline]
kfree+0x353/0x390 mm/slub.c:6923
vfree mm/vmalloc.c:3549 [inline]
vfree+0xa8/0x390 mm/vmalloc.c:3521
delayed_vfree_work+0x29/0x40 mm/vmalloc.c:3451
process_one_work+0x2b7/0x5c0 kernel/workqueue.c:3495
process_scheduled_works kernel/workqueue.c:3578 [inline]
worker_thread+0x255/0x4a0 kernel/workqueue.c:3659
kthread+0x150/0x1a0 kernel/kthread.c:436
ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
BUG: memory leak
unreferenced object 0xffff888102382600 (size 512):
comm "kworker/u8:6", pid 403, jiffies 4294937442
hex dump (first 32 bytes):
10 45 0c 2d 81 88 ff ff 60 bd b3 81 ff ff ff ff .E.-....`.......
00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00 ........<.......
backtrace (crc 2d83b05a):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
__do_kmalloc_node mm/slub.c:5530 [inline]
__kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2854 [inline]
alloc_empty_sheaf mm/slub.c:2874 [inline]
__pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
free_to_pcs mm/slub.c:6147 [inline]
slab_free mm/slub.c:6633 [inline]
kfree+0x353/0x390 mm/slub.c:6923
call_usermodehelper_freeinfo kernel/umh.c:43 [inline]
umh_complete kernel/umh.c:57 [inline]
call_usermodehelper_exec_async+0x1c7/0x1f0 kernel/umh.c:117
ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
BUG: memory leak
unreferenced object 0xffff8881009e5600 (size 512):
comm "softirq", pid 0, jiffies 4294937452
hex dump (first 32 bytes):
10 25 4b 2c 81 88 ff ff 60 bd b3 81 ff ff ff ff .%K,....`.......
00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00 ........<.......
backtrace (crc 9cf07d25):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
__do_kmalloc_node mm/slub.c:5530 [inline]
__kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2854 [inline]
alloc_empty_sheaf mm/slub.c:2874 [inline]
__pcs_replace_full_main+0xf7/0x330 mm/slub.c:6094
free_to_pcs mm/slub.c:6147 [inline]
slab_free mm/slub.c:6633 [inline]
kfree+0x353/0x390 mm/slub.c:6923
security_task_free+0x6e/0x130 security/security.c:2827
__put_task_struct+0x9f/0x260 kernel/fork.c:792
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x269/0x720 kernel/rcu/tree.c:2919
handle_softirqs+0x114/0x330 kernel/softirq.c:669
run_ksoftirqd kernel/softirq.c:1133 [inline]
run_ksoftirqd+0x20/0x30 kernel/softirq.c:1125
smpboot_thread_fn+0x1f5/0x430 kernel/smpboot.c:162
kthread+0x150/0x1a0 kernel/kthread.c:436
ret_from_fork+0x219/0x490 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
BUG: memory leak
unreferenced object 0xffff888109c00000 (size 512):
comm "udevadm", pid 4995, jiffies 4294938376
hex dump (first 32 bytes):
00 3e 67 26 81 88 ff ff 60 bd b3 81 ff ff ff ff .>g&....`.......
00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00 ........<.......
backtrace (crc acde3b3b):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
__do_kmalloc_node mm/slub.c:5530 [inline]
__kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2854 [inline]
alloc_empty_sheaf mm/slub.c:2874 [inline]
__pcs_replace_empty_main+0x260/0x2e0 mm/slub.c:4806
alloc_from_pcs mm/slub.c:4887 [inline]
slab_alloc_node mm/slub.c:5021 [inline]
__kmalloc_cache_noprof+0x370/0x3f0 mm/slub.c:5676
_kmalloc_noprof include/linux/slab.h:991 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
kernfs_get_open_node fs/kernfs/file.c:537 [inline]
kernfs_fop_open+0x523/0x620 fs/kernfs/file.c:725
do_dentry_open+0x1d9/0x7e0 fs/open.c:1000
vfs_open_consume+0x4e/0x1c0 fs/open.c:1131
do_open fs/namei.c:4851 [inline]
path_openat+0xb90/0x1250 fs/namei.c:5016
do_file_open+0x121/0x200 fs/namei.c:5045
do_sys_openat2+0xd9/0x140 fs/open.c:1442
do_sys_open fs/open.c:1448 [inline]
__do_sys_openat fs/open.c:1464 [inline]
__se_sys_openat fs/open.c:1459 [inline]
__x64_sys_openat+0x82/0xf0 fs/open.c:1459
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff888109bff800 (size 512):
comm "udevd", pid 4994, jiffies 4294938441
hex dump (first 32 bytes):
70 76 fd 26 81 88 ff ff 60 bd b3 81 ff ff ff ff pv.&....`.......
00 12 04 00 81 88 ff ff 3c 00 00 00 00 00 00 00 ........<.......
backtrace (crc 1107e34f):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
__do_kmalloc_node mm/slub.c:5530 [inline]
__kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2854 [inline]
alloc_empty_sheaf mm/slub.c:2874 [inline]
__kfree_rcu_sheaf+0x1aa/0x2d0 mm/slub.c:6282
kfree_rcu_sheaf mm/slab_common.c:1689 [inline]
kvfree_call_rcu+0x1ef/0x3a0 mm/slab_common.c:2044
kernfs_unlink_open_file+0x18f/0x1a0 fs/kernfs/file.c:611
kernfs_fop_release+0x55/0x110 fs/kernfs/file.c:790
__fput+0x1a6/0x4f0 fs/file_table.c:512
fput_close_sync+0x67/0x130 fs/file_table.c:618
filp_close_sync fs/open.c:1573 [inline]
__do_sys_close fs/open.c:1596 [inline]
__se_sys_close fs/open.c:1583 [inline]
__x64_sys_close+0x4a/0xc0 fs/open.c:1583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BUG: memory leak
unreferenced object 0xffff88810a9dae00 (size 512):
comm "sshd", pid 5384, jiffies 4294938845
hex dump (first 32 bytes):
00 7e 05 26 81 88 ff ff 60 bd b3 81 ff ff ff ff .~.&....`.......
00 4a 04 00 81 88 ff ff 20 00 00 00 00 00 00 00 .J...... .......
backtrace (crc b8bd2d90):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
__do_kmalloc_node mm/slub.c:5530 [inline]
__kmalloc_flags_noprof+0x42c/0x570 mm/slub.c:5719
_kmalloc_flags_noprof mm/slab.h:55 [inline]
__alloc_empty_sheaf mm/slub.c:2854 [inline]
alloc_empty_sheaf mm/slub.c:2874 [inline]
kmem_cache_prefill_sheaf+0x1a2/0x2d0 mm/slub.c:5279
mt_get_sheaf lib/maple_tree.c:154 [inline]
mas_alloc_nodes lib/maple_tree.c:1079 [inline]
mas_preallocate+0x3fb/0x6f0 lib/maple_tree.c:5016
vma_iter_prealloc mm/vma.h:698 [inline]
__mmap_new_vma mm/vma.c:2713 [inline]
__mmap_region+0xd92/0x1be0 mm/vma.c:3054
mmap_region+0x19c/0x2a0 mm/vma.c:3136
do_mmap+0x950/0xdf0 mm/mmap.c:573
vm_mmap_pgoff+0x195/0x310 mm/util.c:581
ksys_mmap_pgoff+0x89/0x2e0 mm/mmap.c:619
__do_sys_mmap arch/x86/kernel/sys_x86_64.c:96 [inline]
__se_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
__x64_sys_mmap+0x6f/0xa0 arch/x86/kernel/sys_x86_64.c:89
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0xe9/0x530 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
** replaying previous printk message **
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
next reply other threads:[~2026-11-04 23:17 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-04 23:17 syzbot [this message]
2026-11-05 12:59 ` Forwarded: [PATCH] mm/slub: fix kmemleak false positive in RCU sheaves syzbot
[not found] <20261105125943.178158-1-gowtham398gs@gmail.com>
2026-11-05 16:15 ` [syzbot] [btrfs?] [ext4?] [ntfs3?] memory leak in __pcs_replace_full_main syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aebbd06.21d05368.325ed5.0000.GAE@google.com \
--to=syzbot+4d078516add5f4f12cea@syzkaller.appspotmail.com \
--cc=almaz.alexandrovich@paragon-software.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=dsterba@suse.com \
--cc=hpa@zytor.com \
--cc=linux-btrfs@vger.kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=ntfs3@lists.linux.dev \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tglx@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.