Re: [syzbot] [fs?] memory leak in path_openat (3)

[Christian Brauner]

On Fri, Jun 12, 2026 at 06:28:24PM -0700, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    2b414a95b8f7 Merge tag 's390-7.1-5' of git://git.kernel.or..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=157e78ae580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=4044c5352cad3e68
> dashboard link: https://syzkaller.appspot.com/bug?extid=2cd473471e77bda12b0e
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=131d98ae580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=14838986580000
> 
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/86194cb79270/disk-2b414a95.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/11136f1a297f/vmlinux-2b414a95.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/809371abba53/bzImage-2b414a95.xz
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+2cd473471e77bda12b0e@xxxxxxxxxxxxxxxxxxxxxxxxx

#syz set subsystems: io-uring

The path_openat()/alloc_empty_file() backtrace is just where the leaked
struct file was allocated. The reference leak itself is in the io_uring
NOP opcode's fixed-file handling. Looks already addressed by:

"io_uring/nop: fix file reference leak with IOSQE_FIXED_FILE"