From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f51.google.com (mail-wr1-f51.google.com [209.85.221.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7744145C6F6 for ; Tue, 11 Aug 2026 20:43:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.51 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786480989; cv=none; b=ucEMhmepvFITpvjR8Gs8SFEQPQZOArG81vIKdPIXw/xAgZUzWuImqV+ZPjMW4UdE7MtmVLief2cLOCKWUM3kFLbtH2ZAp3GVfutw2JJ/KFCKoHgRIxxnCpXmZX2AcWxlV62UBl/B+x29dd/Y3oCN8ttgO5CdpE6VqNRZFd5YGek= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786480989; c=relaxed/simple; bh=sHpa5fjeGnCP/yQZunKQW3d8rmujSYCW/f7sc+jrXRs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=d2SA1Jg29AUF8Ad/7rjGXskNWmP1xdv60ufH3uKMI4MpRGC5ywBiyl2CfpS/e4RIgc4rHdbafEOWGWT+TkFSed7e6Z+HPeqUYYinRM58K5Dds5XVz3Ftd9QH9dQ1dPZeOR82te2+a6Rk4miyqImuFDxxrQNCZdQGctOzq56lXjg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=T1abMFk0; arc=none smtp.client-ip=209.85.221.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="T1abMFk0" Received: by mail-wr1-f51.google.com with SMTP id ffacd0b85a97d-4813ea321cdso1037652f8f.1 for ; Tue, 11 Aug 2026 13:43:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786480986; x=1787085786; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=bYHzlD8AP97+5gPoTHx0Gjj8ze70RRZtR6DtOoDWTFc=; b=T1abMFk0Stwcvs2j921kU1f3kL309hxjHbRVkWiBPfp0B8fPwpQsaXv26gvA0LiLlZ BosDCc7V4z14TZzaGsE7nOTuS7x+YyXiGGoGpR3s7ue4GmfcIHYkS1SXz+atLyU4b5pU 5veYwx5OwsEPiVF+blAwC3LaU3GCCJ/2X7KNzUZIftyVEAOqEvk9Mo/qpA57UVweFgr1 cggSuCN/Mt/ImdqIkXCZv+dVKpDlDvltNrVvMicDQMsv8Okr5PIoueQeY7h3inWI4Lzg PRTVVFtuwL0nTcmKwUAS0VWwQVMhLpLZLGE31oo6xsQNBtIZCHVEXk9r3We/mqKonhnC /ujA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786480986; x=1787085786; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=bYHzlD8AP97+5gPoTHx0Gjj8ze70RRZtR6DtOoDWTFc=; b=YDITSufEk4NihpiT4ZK3Hz2foBAQ9IMlyRWa9sL60jxzZcB4b6vHu/IM9o4HHxvp5A aFWKZUYsXy1EZebN4FHGcyNAGQB3VNv2EdTfnvFLSRyuh78CI8AHs+AJoubtxDVdiirp EUiTj4Uq6DFHIHdE36SPd0lqfaw1L5LDv8Q6NTS6grrLxKEQgx/WSLYWXmWldpq8L98c kbJuOHQGBN3foW3ivH52Y2JBnYuLsDg4oR5JmxNiMkUZbDWLDgVQOuHh8k2bfN6G6gRp gPGLnP6SCASheALuXh7588Pj4ksLKy/iaz7nfMoOKTWmUTz0m6VOASraGhwGWHCMRJJx F2dA== X-Forwarded-Encrypted: i=1; AHgh+RrlYhs41CaYx1w8Zrf4AIxCRZKIW5JP56wzFDLPvFt+NGwIUoqX4V3nBR0kIT7mIAP2iek/eMKV10ri6jQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzU1C7YUVFi7gzjmtyU0uoMGpmNBxgc5lK0JDtGz0LdfeEZCV0E 6lBgV2+aYJkxNlzqekry1bItKS6gQI+NiS0wjhKkpvfnGRVdqDcNDx1bJOPjXDnI X-Gm-Gg: AR+sD11lC212Bd0EVINjUU+AZB2AI4ix6vZYBKV5EmnmlSrABCl/ymdQLRUtZinfK5f JDts1+htQLoaKD+xztwwYr5HsgDe5Udg7RYTBHmzEWUDsXC1GPtaGkOAzX8lZ9H7pFPWnBaAfC4 fHd6kWHUePCAvZfSmd7zZ29qeQOCaV+ZtjpZ/S7Y9wNnS2AFqgbYqEegxehcs9uZRZcEWubpJXB 4Nb3PSAk96APkKFtqbr2yCp1PQHwECW66yUBXZDozzbkalB4GGCQoGeDQgFdkJwiQpLujAeak68 Rw3bDlgejwq2etJy1unqowj65CVY/f0jKQ1O+nmirmXVDrT7HYcRov848z8fxJowUBf6tLa22k8 f9mDWTE4Ve1emQhYUhSB30ZbefYDg5ObUO1Qy3Lk03uueGIkHx6d1v9w28NzSqKsIAi5RSuY927 px7w92epyRy3hU3FSRU8zlPw1vD7cyKxDkwCrPim/Rxxye3D0fPiRH16dl6vsYOrXFkibKmPEB8 g37b5mT7jjMkhR3vuuyjgNESMJpiFbrT989ni0I+0J7oI6nMwp726Qlw2xTGwCo X-Received: by 2002:a05:6000:471d:b0:481:50ae:df9a with SMTP id ffacd0b85a97d-48150aedfe1mr1752584f8f.9.1786480985615; Tue, 11 Aug 2026 13:43:05 -0700 (PDT) Received: from valmpani.valmpani (cgn-195-14-219-6.nc.de. [195.14.219.6]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48150d72232sm1069253f8f.37.2026.08.11.13.43.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 11 Aug 2026 13:43:04 -0700 (PDT) From: Vasileios Almpanis Date: Tue, 11 Aug 2026 22:42:52 +0200 Subject: [RFC PATCH] io_uring/cmd: don't skip completion for a non-armed multishot uring_cmd Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260811-io_uring-v1-1-1dc3dd50e0cd@gmail.com> X-B4-Tracking: v=1; b=H4sIAEuJe2oC/6tWKk4tykwtVrJSqFYqSi3LLM7MzwNyDHUUlJIzE vPSU3UzU4B8JSMDIzMDC0ND3cz8+NKizLx0XUMzS2Nj82RzEzNDcyWg8oKi1LTMCrBR0UpBbs4 gsQDHEGcPpViIbHFpUlZqcgnINKXaWgDGAS7KegAAAA== X-Change-ID: 20260811-io_uring-169337c74617 To: Jens Axboe , Ming Lei Cc: io-uring@vger.kernel.org, linux-kernel@vger.kernel.org, syzbot+a4ccdd7ebf452e4d4701@syzkaller.appspotmail.com, Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1786480984; l=2985; i=vasilisalmpanis@gmail.com; s=20260731; h=from:subject:message-id; bh=sHpa5fjeGnCP/yQZunKQW3d8rmujSYCW/f7sc+jrXRs=; b=nY7nDsC/IrTl/1kj140qwPTE61hVItgdLqqhD5PLa9YeZL0bgjxEvNehUB9JGifzb7wLLGcoX ygcOadn7XKjD1L2KzpPa32b0fd9FSCPzYMlTsZLQ8bsjNO2FPA2a4Xv X-Developer-Key: i=vasilisalmpanis@gmail.com; a=ed25519; pk=gn5Uo6yL8Tlpq5uATxA3nqoq+U8eWLRbjD+bOk0qSpU= io_uring_cmd() treats any uring_cmd carrying IORING_URING_CMD_MULTISHOT that returns >= 0 as "multishot armed, completion deferred" and returns IOU_ISSUE_SKIP_COMPLETE, expecting the provider to complete the request later. But the flag is user-controlled and validated only against buffer select, not against provider capability. A ->uring_cmd() handler that does not implement multishot and returns a normal >= 0 result then has its request skipped and never completed, leaking the io_kiocb and its io_async_cmd: BUG: memory leak unreferenced object (size 248): kmem_cache_alloc_bulk_noprof+0x272/0x3f0 __io_alloc_req_refill+0x4a/0x150 io_submit_sqes.cold+0x16e/0x20b __do_sys_io_uring_enter+0x56d/0xd60 syzbot hit this via ublk UBLK_U_CMD_ADD_DEV, but it is kernel-wide: the same leak reproduces with SOCKET_URING_OP_SIOCINQ on any socket fd, which returns the queued byte count and never inspects cmd->flags. No in-tree provider of multishot actually returns >= 0. Both io_cmd_poll_multishot() and ublk_handle_batch_fetch_cmd return -EIOCBQUEUED, Only skip completion when the command is really multishot, i.e. REQ_F_APOLL_MULTISHOT is set. Otherwise fall through and complete the request normally with its result. Fixes: 620a50c92700 ("io_uring: uring_cmd: add multishot support") Reported-by: syzbot+a4ccdd7ebf452e4d4701@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a4ccdd7ebf452e4d4701 Tested-by: syzbot+a4ccdd7ebf452e4d4701@syzkaller.appspotmail.com Signed-off-by: Vasileios Almpanis --- Questions / Notes: - I put this in the core io_uring_cmd() rather than in provider specific code because the leak is independent of the provider. From my research so far no ->uring_cmd() rejects IORING_URING_CMD_MULTISHOT, they just ignore it. The flag is only validated against buffer-select in io_uring_cmd_prep(). So any handler that returns a plain >= 0 result with the user-set flag leaks. - Instead of checking if it has been really armed should we just drop the >= 0 check? The in-tree code that supports multishot returns -EIOCBQUEUED from what I have seen so far. --- io_uring/uring_cmd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index c14c22cff49e..a2899a852879 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -269,7 +269,8 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags) } ret = file->f_op->uring_cmd(ioucmd, issue_flags); - if (ioucmd->flags & IORING_URING_CMD_MULTISHOT) { + if ((ioucmd->flags & IORING_URING_CMD_MULTISHOT) && + (req->flags & REQ_F_APOLL_MULTISHOT)) { if (ret >= 0) return IOU_ISSUE_SKIP_COMPLETE; } --- base-commit: d58772d8520c7ef247c4b95c9bd76d3a25da9ff5 change-id: 20260811-io_uring-169337c74617 Best regards, -- Vasileios Almpanis