From: syzbot <syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com>
To: chao@kernel.org, edwards@nvidia.com, hemanth.selam@gmail.com,
jaegeuk@kernel.org, jgg@ziepe.ca, kartikey406@gmail.com,
leon@kernel.org, linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org,
michael.j.ruhl@intel.com, mrgolin@amazon.com,
syzkaller-bugs@googlegroups.com, yishaih@nvidia.com
Subject: Re: [f2fs-dev] [syzbot] [rdma?] [f2fs?] memory leak in radix_tree_insert (3)
Date: Fri, 06 Nov 2026 00:42:39 -0800 [thread overview]
Message-ID: <6aed92ff.a716b02e.a4a62.0000.GAE@google.com> (raw)
In-Reply-To: <6aec6433.0ce67c00.35143.0002.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: d68ce4e71248 Merge tag 'mm-core-7.4-rc2' of git://git.kern..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1781772d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4361b1bb937ae1c4
dashboard link: https://syzkaller.appspot.com/bug?extid=d60be66dd00b4490fa96
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=169572fd580000
AI-generated root cause summary:
In lib/radix-tree.c:__radix_tree_create(), intermediate radix_tree_node
(xa_node) structures are allocated and linked into parent slots as the function
descends through tree levels (shift -= RADIX_TREE_MAP_SHIFT). If a subsequent
node allocation fails with -ENOMEM before reaching the leaf slot,
__radix_tree_create() returns the error immediately without unwinding or
deleting the newly allocated empty intermediate nodes. Consequently, slot-based
iterators such as radix_tree_for_each_slot() used during cleanup (e.g. in
uverbs_destroy_api() -> uapi_remove_range()) never encounter the empty nodes
(which have count == 0), causing those radix_tree_node objects to leak when the
containing object is destroyed.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=d60be66dd00b4490fa96
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff8881102cb918 (size 576):
comm "syz.1.20", pid 6842, jiffies 4294945826
hex dump (first 32 bytes):
0c 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 ef c5 11 81 88 ff ff 30 b9 2c 10 81 88 ff ff ........0.,.....
backtrace (crc c4ea6eb8):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047
radix_tree_node_alloc.constprop.0+0x81/0x1a0 lib/radix-tree.c:276
__radix_tree_create lib/radix-tree.c:624 [inline]
radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:27 [inline]
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:16 [inline]
uapi_add_get_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
uapi_merge_obj_tree drivers/infiniband/core/uverbs_uapi.c:178 [inline]
uapi_merge_def+0x4c4/0xb60 drivers/infiniband/core/uverbs_uapi.c:297
uapi_merge_def+0xf0/0xb60 drivers/infiniband/core/uverbs_uapi.c:286
uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
ib_uverbs_create_uapi drivers/infiniband/core/uverbs_main.c:1140 [inline]
ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
add_client_context+0x290/0x480 drivers/infiniband/core/device.c:755
enable_device_and_get+0x106/0x250 drivers/infiniband/core/device.c:1375
ib_register_device drivers/infiniband/core/device.c:1503 [inline]
ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1441
siw_device_register drivers/infiniband/sw/siw/siw_main.c:71 [inline]
siw_newlink drivers/infiniband/sw/siw/siw_main.c:433 [inline]
siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:415
nldev_newlink+0x26f/0x3e0 drivers/infiniband/core/nldev.c:1859
rdma_nl_rcv_msg+0x1ad/0x2d0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x175/0x1f0 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x3e0/0x530 net/netlink/af_netlink.c:1361
BUG: memory leak
unreferenced object 0xffff88811021f488 (size 576):
comm "syz.1.20", pid 6842, jiffies 4294945826
hex dump (first 32 bytes):
06 09 00 00 00 00 00 00 18 b9 2c 10 81 88 ff ff ..........,.....
00 ef c5 11 81 88 ff ff a0 f4 21 10 81 88 ff ff ..........!.....
backtrace (crc 8219f7d7):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047
radix_tree_node_alloc.constprop.0+0x81/0x1a0 lib/radix-tree.c:276
__radix_tree_create lib/radix-tree.c:624 [inline]
radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:27 [inline]
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:16 [inline]
uapi_add_get_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
uapi_merge_obj_tree drivers/infiniband/core/uverbs_uapi.c:178 [inline]
uapi_merge_def+0x4c4/0xb60 drivers/infiniband/core/uverbs_uapi.c:297
uapi_merge_def+0xf0/0xb60 drivers/infiniband/core/uverbs_uapi.c:286
uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
ib_uverbs_create_uapi drivers/infiniband/core/uverbs_main.c:1140 [inline]
ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
add_client_context+0x290/0x480 drivers/infiniband/core/device.c:755
enable_device_and_get+0x106/0x250 drivers/infiniband/core/device.c:1375
ib_register_device drivers/infiniband/core/device.c:1503 [inline]
ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1441
siw_device_register drivers/infiniband/sw/siw/siw_main.c:71 [inline]
siw_newlink drivers/infiniband/sw/siw/siw_main.c:433 [inline]
siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:415
nldev_newlink+0x26f/0x3e0 drivers/infiniband/core/nldev.c:1859
rdma_nl_rcv_msg+0x1ad/0x2d0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x175/0x1f0 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x3e0/0x530 net/netlink/af_netlink.c:1361
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
_______________________________________________
Linux-f2fs-devel mailing list
Linux-f2fs-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-f2fs-devel
WARNING: multiple messages have this Message-ID (diff)
From: syzbot <syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com>
To: chao@kernel.org, edwards@nvidia.com, hemanth.selam@gmail.com,
jaegeuk@kernel.org, jgg@ziepe.ca, kartikey406@gmail.com,
leon@kernel.org, linux-f2fs-devel@lists.sourceforge.net,
linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org,
michael.j.ruhl@intel.com, mrgolin@amazon.com,
syzkaller-bugs@googlegroups.com, yishaih@nvidia.com
Subject: Re: [syzbot] [rdma?] [f2fs?] memory leak in radix_tree_insert (3)
Date: Fri, 06 Nov 2026 00:42:39 -0800 [thread overview]
Message-ID: <6aed92ff.a716b02e.a4a62.0000.GAE@google.com> (raw)
In-Reply-To: <6aec6433.0ce67c00.35143.0002.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: d68ce4e71248 Merge tag 'mm-core-7.4-rc2' of git://git.kern..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=1781772d580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4361b1bb937ae1c4
dashboard link: https://syzkaller.appspot.com/bug?extid=d60be66dd00b4490fa96
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=169572fd580000
AI-generated root cause summary:
In lib/radix-tree.c:__radix_tree_create(), intermediate radix_tree_node
(xa_node) structures are allocated and linked into parent slots as the function
descends through tree levels (shift -= RADIX_TREE_MAP_SHIFT). If a subsequent
node allocation fails with -ENOMEM before reaching the leaf slot,
__radix_tree_create() returns the error immediately without unwinding or
deleting the newly allocated empty intermediate nodes. Consequently, slot-based
iterators such as radix_tree_for_each_slot() used during cleanup (e.g. in
uverbs_destroy_api() -> uapi_remove_range()) never encounter the empty nodes
(which have count == 0), causing those radix_tree_node objects to leak when the
containing object is destroyed.
full analysis: https://syzkaller.appspot.com/x/ai_root_cause?x=d60be66dd00b4490fa96
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff8881102cb918 (size 576):
comm "syz.1.20", pid 6842, jiffies 4294945826
hex dump (first 32 bytes):
0c 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 ef c5 11 81 88 ff ff 30 b9 2c 10 81 88 ff ff ........0.,.....
backtrace (crc c4ea6eb8):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047
radix_tree_node_alloc.constprop.0+0x81/0x1a0 lib/radix-tree.c:276
__radix_tree_create lib/radix-tree.c:624 [inline]
radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:27 [inline]
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:16 [inline]
uapi_add_get_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
uapi_merge_obj_tree drivers/infiniband/core/uverbs_uapi.c:178 [inline]
uapi_merge_def+0x4c4/0xb60 drivers/infiniband/core/uverbs_uapi.c:297
uapi_merge_def+0xf0/0xb60 drivers/infiniband/core/uverbs_uapi.c:286
uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
ib_uverbs_create_uapi drivers/infiniband/core/uverbs_main.c:1140 [inline]
ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
add_client_context+0x290/0x480 drivers/infiniband/core/device.c:755
enable_device_and_get+0x106/0x250 drivers/infiniband/core/device.c:1375
ib_register_device drivers/infiniband/core/device.c:1503 [inline]
ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1441
siw_device_register drivers/infiniband/sw/siw/siw_main.c:71 [inline]
siw_newlink drivers/infiniband/sw/siw/siw_main.c:433 [inline]
siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:415
nldev_newlink+0x26f/0x3e0 drivers/infiniband/core/nldev.c:1859
rdma_nl_rcv_msg+0x1ad/0x2d0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x175/0x1f0 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x3e0/0x530 net/netlink/af_netlink.c:1361
BUG: memory leak
unreferenced object 0xffff88811021f488 (size 576):
comm "syz.1.20", pid 6842, jiffies 4294945826
hex dump (first 32 bytes):
06 09 00 00 00 00 00 00 18 b9 2c 10 81 88 ff ff ..........,.....
00 ef c5 11 81 88 ff ff a0 f4 21 10 81 88 ff ff ..........!.....
backtrace (crc 8219f7d7):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4733 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_noprof+0x35b/0x3e0 mm/slub.c:5047
radix_tree_node_alloc.constprop.0+0x81/0x1a0 lib/radix-tree.c:276
__radix_tree_create lib/radix-tree.c:624 [inline]
radix_tree_insert+0x140/0x390 lib/radix-tree.c:712
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:27 [inline]
uapi_add_elm drivers/infiniband/core/uverbs_uapi.c:16 [inline]
uapi_add_get_elm+0x61/0x140 drivers/infiniband/core/uverbs_uapi.c:41
uapi_merge_obj_tree drivers/infiniband/core/uverbs_uapi.c:178 [inline]
uapi_merge_def+0x4c4/0xb60 drivers/infiniband/core/uverbs_uapi.c:297
uapi_merge_def+0xf0/0xb60 drivers/infiniband/core/uverbs_uapi.c:286
uverbs_alloc_api+0x85/0xc50 drivers/infiniband/core/uverbs_uapi.c:659
ib_uverbs_create_uapi drivers/infiniband/core/uverbs_main.c:1140 [inline]
ib_uverbs_add_one+0x1b1/0x350 drivers/infiniband/core/uverbs_main.c:1196
add_client_context+0x290/0x480 drivers/infiniband/core/device.c:755
enable_device_and_get+0x106/0x250 drivers/infiniband/core/device.c:1375
ib_register_device drivers/infiniband/core/device.c:1503 [inline]
ib_register_device+0x4fe/0x7f0 drivers/infiniband/core/device.c:1441
siw_device_register drivers/infiniband/sw/siw/siw_main.c:71 [inline]
siw_newlink drivers/infiniband/sw/siw/siw_main.c:433 [inline]
siw_newlink+0x36a/0x3f0 drivers/infiniband/sw/siw/siw_main.c:415
nldev_newlink+0x26f/0x3e0 drivers/infiniband/core/nldev.c:1859
rdma_nl_rcv_msg+0x1ad/0x2d0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x175/0x1f0 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x3e0/0x530 net/netlink/af_netlink.c:1361
connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2026-11-06 8:42 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-05 11:10 [syzbot] [rdma?] [f2fs?] memory leak in radix_tree_insert (3) syzbot
2026-11-05 11:10 ` [f2fs-dev] " syzbot
2026-11-05 12:21 ` Forwarded: [PATCH] RDMA/uverbs: Fix radix tree node leak in uapi_add_elm() syzbot
2026-11-05 13:33 ` syzbot
2026-11-06 8:42 ` syzbot [this message]
2026-11-06 8:42 ` [syzbot] [rdma?] [f2fs?] memory leak in radix_tree_insert (3) syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6aed92ff.a716b02e.a4a62.0000.GAE@google.com \
--to=syzbot+d60be66dd00b4490fa96@syzkaller.appspotmail.com \
--cc=chao@kernel.org \
--cc=edwards@nvidia.com \
--cc=hemanth.selam@gmail.com \
--cc=jaegeuk@kernel.org \
--cc=jgg@ziepe.ca \
--cc=kartikey406@gmail.com \
--cc=leon@kernel.org \
--cc=linux-f2fs-devel@lists.sourceforge.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=michael.j.ruhl@intel.com \
--cc=mrgolin@amazon.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yishaih@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.