syzbot


memory leak in __kthread_create_on_node

Status: upstream: reported C repro on 2026/01/30 14:23
Subsystems: gfs2
[Documentation on labels]
Reported-by: syzbot+aac438d7a1c44071e04b@syzkaller.appspotmail.com
Fix commit: gfs2: fix memory leaks in gfs2_fill_super error path
Patched on: [ci-upstream-linux-next-kasan-gce-root ci-upstream-rust-kasan-gce], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 8d23h, last: 8d23h
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] [gfs2?] memory leak in __kthread_create_on_node 1 (7) 2026/02/04 18:54
[PATCH v2] gfs2: fix memory leaks in gfs2_fill_super error path 1 (1) 2026/02/03 02:20
[PATCH] gfs2: fix memory leaks in gfs2_fill_super error path 2 (2) 2026/02/02 18:57
Last patch testing requests (5)
Created Duration User Patch Repo Result
2026/02/04 18:54 20m agruenba@redhat.com git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next report log
2026/02/04 11:39 21m agruenba@redhat.com git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next error
2026/02/03 10:01 21m agruenba@redhat.com git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2.git for-next error
2026/01/31 02:38 36m kartikey406@gmail.com patch upstream report log
2026/01/30 14:37 29m kartikey406@gmail.com patch upstream report log

Sample crash report:
BUG: memory leak
unreferenced object 0xffff888125a2dec0 (size 32):
  comm "syz.4.75", pid 6411, jiffies 4294948981
  hex dump (first 32 bytes):
    67 66 73 32 5f 6c 6f 67 64 2f 73 79 7a 3a 73 79  gfs2_logd/syz:sy
    7a 2e 30 00 00 00 00 00 00 00 00 00 00 00 00 00  z.0.............
  backtrace (crc d543dd03):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_node_track_caller_noprof+0x47b/0x690 mm/slub.c:5768
    kvasprintf+0x6e/0xf0 lib/kasprintf.c:25
    __kthread_create_on_node+0x9e/0x1c0 kernel/kthread.c:519
    kthread_create_on_node+0x73/0xa0 kernel/kthread.c:587
    init_threads fs/gfs2/ops_fstype.c:1065 [inline]
    gfs2_fill_super+0xdf8/0x1210 fs/gfs2/ops_fstype.c:1265
    get_tree_bdev_flags+0x1c0/0x290 fs/super.c:1691
    gfs2_get_tree+0x26/0xd0 fs/gfs2/ops_fstype.c:1332
    vfs_get_tree+0x30/0x120 fs/super.c:1751
    fc_mount fs/namespace.c:1199 [inline]
    do_new_mount_fc fs/namespace.c:3636 [inline]
    do_new_mount fs/namespace.c:3712 [inline]
    path_mount+0x5a9/0x1350 fs/namespace.c:4022
    do_mount fs/namespace.c:4035 [inline]
    __do_sys_mount fs/namespace.c:4224 [inline]
    __se_sys_mount fs/namespace.c:4201 [inline]
    __x64_sys_mount+0x1a3/0x1e0 fs/namespace.c:4201
    do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
    do_syscall_64+0xa4/0xf80 arch/x86/entry/syscall_64.c:94
    entry_SYSCALL_64_after_hwframe+0x77/0x7f

BUG: memory leak
unreferenced object 0xffff888126a2a300 (size 4480):
  comm "kthreadd", pid 2, jiffies 4294948981
  hex dump (first 32 bytes):
    00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 01 00 00 00 80 00 00 00 00 00 00 00  ................
  backtrace (crc 4b33760e):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_node_noprof+0x422/0x590 mm/slub.c:5315
    alloc_task_struct_node kernel/fork.c:184 [inline]
    dup_task_struct kernel/fork.c:915 [inline]
    copy_process+0x286/0x2870 kernel/fork.c:2052
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    kernel_thread+0x80/0xb0 kernel/fork.c:2712
    create_kthread kernel/kthread.c:486 [inline]
    kthreadd+0x196/0x260 kernel/kthread.c:844
    ret_from_fork+0x23c/0x320 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

BUG: memory leak
unreferenced object 0xffff888109c85180 (size 184):
  comm "kthreadd", pid 2, jiffies 4294948981
  hex dump (first 32 bytes):
    02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc c5f4f48b):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270
    prepare_creds+0x22/0x600 kernel/cred.c:185
    copy_creds+0x44/0x290 kernel/cred.c:286
    copy_process+0x7a7/0x2870 kernel/fork.c:2086
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    kernel_thread+0x80/0xb0 kernel/fork.c:2712
    create_kthread kernel/kthread.c:486 [inline]
    kthreadd+0x196/0x260 kernel/kthread.c:844
    ret_from_fork+0x23c/0x320 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

BUG: memory leak
unreferenced object 0xffff888102bd9780 (size 32):
  comm "kthreadd", pid 2, jiffies 4294948981
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    f8 52 86 00 81 88 ff ff 00 00 00 00 00 00 00 00  .R..............
  backtrace (crc 336e1c5f):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x465/0x680 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    lsm_blob_alloc+0x4d/0x80 security/security.c:192
    lsm_cred_alloc security/security.c:209 [inline]
    security_prepare_creds+0x2d/0x290 security/security.c:2763
    prepare_creds+0x395/0x600 kernel/cred.c:215
    copy_creds+0x44/0x290 kernel/cred.c:286
    copy_process+0x7a7/0x2870 kernel/fork.c:2086
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    kernel_thread+0x80/0xb0 kernel/fork.c:2712
    create_kthread kernel/kthread.c:486 [inline]
    kthreadd+0x196/0x260 kernel/kthread.c:844
    ret_from_fork+0x23c/0x320 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

BUG: memory leak
unreferenced object 0xffff8881098abc00 (size 192):
  comm "kthreadd", pid 2, jiffies 4294948981
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff  ................
    01 00 00 00 00 00 00 00 80 d5 78 82 ff ff ff ff  ..........x.....
  backtrace (crc 1df624ea):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __kmalloc_cache_noprof+0x41a/0x590 mm/slub.c:5775
    kmalloc_noprof include/linux/slab.h:957 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    set_kthread_struct+0x58/0x150 kernel/kthread.c:125
    copy_process+0x1569/0x2870 kernel/fork.c:2150
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    kernel_thread+0x80/0xb0 kernel/fork.c:2712
    create_kthread kernel/kthread.c:486 [inline]
    kthreadd+0x196/0x260 kernel/kthread.c:844
    ret_from_fork+0x23c/0x320 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

BUG: memory leak
unreferenced object 0xffff88812baec5c0 (size 64):
  comm "kthreadd", pid 2, jiffies 4294948981
  hex dump (first 32 bytes):
    e0 35 8f 89 ff ff ff ff 00 00 00 00 00 00 00 00  .5..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8e7806b9):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    __do_kmalloc_node mm/slub.c:5656 [inline]
    __kmalloc_noprof+0x465/0x680 mm/slub.c:5669
    kmalloc_noprof include/linux/slab.h:961 [inline]
    kzalloc_noprof include/linux/slab.h:1094 [inline]
    lsm_blob_alloc+0x4d/0x80 security/security.c:192
    lsm_task_alloc security/security.c:244 [inline]
    security_task_alloc+0x2a/0x260 security/security.c:2682
    copy_process+0xf07/0x2870 kernel/fork.c:2203
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    kernel_thread+0x80/0xb0 kernel/fork.c:2712
    create_kthread kernel/kthread.c:486 [inline]
    kthreadd+0x196/0x260 kernel/kthread.c:844
    ret_from_fork+0x23c/0x320 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

BUG: memory leak
unreferenced object 0xffff888101e37a80 (size 1152):
  comm "kthreadd", pid 2, jiffies 4294948981
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    90 7a e3 01 81 88 ff ff 90 7a e3 01 81 88 ff ff  .z.......z......
  backtrace (crc 1d024e88):
    kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
    slab_post_alloc_hook mm/slub.c:4958 [inline]
    slab_alloc_node mm/slub.c:5263 [inline]
    kmem_cache_alloc_noprof+0x412/0x580 mm/slub.c:5270
    copy_signal kernel/fork.c:1699 [inline]
    copy_process+0x1102/0x2870 kernel/fork.c:2218
    kernel_clone+0xac/0x6e0 kernel/fork.c:2651
    kernel_thread+0x80/0xb0 kernel/fork.c:2712
    create_kthread kernel/kthread.c:486 [inline]
    kthreadd+0x196/0x260 kernel/kthread.c:844
    ret_from_fork+0x23c/0x320 arch/x86/kernel/process.c:158
    ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

connection error: failed to recv *flatrpc.ExecutorMessageRawT: EOF

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/29 10:26 upstream 8dfce8991b95 b78a7341 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci-upstream-gce-leak memory leak in __kthread_create_on_node
* Struck through repros no longer work on HEAD.