From: syzbot <syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com>
To: axboe@kernel.dk, linux-block@vger.kernel.org,
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] memory leak in blk_mq_init_tags
Date: Sun, 27 Mar 2022 13:08:18 -0700 [thread overview]
Message-ID: <000000000000c341cc05db38c1b0@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 6b1f86f8e9c7 Merge tag 'folio-5.18b' of git://git.infradea..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13b41dcb700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6e80763d853259b
dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1564ecb3700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff888118503c00 (size 192):
comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff822c042b>] kmalloc_node include/linux/slab.h:602 [inline]
[<ffffffff822c042b>] kzalloc_node include/linux/slab.h:728 [inline]
[<ffffffff822c042b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
[<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
[<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
[<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
[<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
[<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
[<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
[<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
[<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
[<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
[<ffffffff8126b3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
[<ffffffff8126bd19>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
BUG: memory leak
unreferenced object 0xffff888117fee680 (size 128):
comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8240b6be>] kmalloc_array_node include/linux/slab.h:679 [inline]
[<ffffffff8240b6be>] kcalloc_node include/linux/slab.h:684 [inline]
[<ffffffff8240b6be>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
[<ffffffff8240b8ec>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
[<ffffffff822c0347>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c0347>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
[<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
[<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
[<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
[<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
[<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
[<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
[<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
BUG: memory leak
unreferenced object 0xffff888116df4c00 (size 512):
comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
10 4c df 16 81 88 ff ff 10 4c df 16 81 88 ff ff .L.......L......
backtrace:
[<ffffffff8240b9b8>] kmalloc_node include/linux/slab.h:602 [inline]
[<ffffffff8240b9b8>] kzalloc_node include/linux/slab.h:728 [inline]
[<ffffffff8240b9b8>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
[<ffffffff822c0377>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c0377>] blk_mq_init_bitmaps+0x87/0xf0 block/blk-mq-tag.c:557
[<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
[<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
[<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
[<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
[<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
[<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
[<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
[<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
[<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
next reply other threads:[~2022-03-27 20:08 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-03-27 20:08 syzbot [this message]
2022-03-28 7:21 ` [syzbot] memory leak in blk_mq_init_tags Fabio M. De Francesco
2022-03-28 7:29 ` syzbot
2022-03-28 7:56 ` Fabio M. De Francesco
2022-03-28 8:04 ` syzbot
2022-04-03 13:38 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=000000000000c341cc05db38c1b0@google.com \
--to=syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com \
--cc=axboe@kernel.dk \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).