* [syzbot] memory leak in blk_mq_init_tags
@ 2022-03-27 20:08 syzbot
2022-03-28 7:21 ` Fabio M. De Francesco
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: syzbot @ 2022-03-27 20:08 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 6b1f86f8e9c7 Merge tag 'folio-5.18b' of git://git.infradea..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13b41dcb700000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6e80763d853259b
dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1564ecb3700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff888118503c00 (size 192):
comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff822c042b>] kmalloc_node include/linux/slab.h:602 [inline]
[<ffffffff822c042b>] kzalloc_node include/linux/slab.h:728 [inline]
[<ffffffff822c042b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
[<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
[<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
[<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
[<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
[<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
[<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
[<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
[<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
[<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
[<ffffffff8126b3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
[<ffffffff8126bd19>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
BUG: memory leak
unreferenced object 0xffff888117fee680 (size 128):
comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff8240b6be>] kmalloc_array_node include/linux/slab.h:679 [inline]
[<ffffffff8240b6be>] kcalloc_node include/linux/slab.h:684 [inline]
[<ffffffff8240b6be>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
[<ffffffff8240b8ec>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
[<ffffffff822c0347>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c0347>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
[<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
[<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
[<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
[<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
[<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
[<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
[<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
BUG: memory leak
unreferenced object 0xffff888116df4c00 (size 512):
comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
10 4c df 16 81 88 ff ff 10 4c df 16 81 88 ff ff .L.......L......
backtrace:
[<ffffffff8240b9b8>] kmalloc_node include/linux/slab.h:602 [inline]
[<ffffffff8240b9b8>] kzalloc_node include/linux/slab.h:728 [inline]
[<ffffffff8240b9b8>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
[<ffffffff822c0377>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c0377>] blk_mq_init_bitmaps+0x87/0xf0 block/blk-mq-tag.c:557
[<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
[<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
[<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
[<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
[<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
[<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
[<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
[<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
[<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] memory leak in blk_mq_init_tags
2022-03-27 20:08 [syzbot] memory leak in blk_mq_init_tags syzbot
@ 2022-03-28 7:21 ` Fabio M. De Francesco
2022-03-28 7:29 ` syzbot
2022-03-28 7:56 ` Fabio M. De Francesco
2022-04-03 13:38 ` syzbot
2 siblings, 1 reply; 6+ messages in thread
From: Fabio M. De Francesco @ 2022-03-28 7:21 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs; +Cc: syzbot
[-- Attachment #1: Type: text/plain, Size: 7884 bytes --]
On domenica 27 marzo 2022 22:08:18 CEST syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 6b1f86f8e9c7 Merge tag 'folio-5.18b' of git://git.infradea..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13b41dcb700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c6e80763d853259b
> dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1564ecb3700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff888118503c00 (size 192):
> comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
> hex dump (first 32 bytes):
> 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffffffff822c042b>] kmalloc_node include/linux/slab.h:602 [inline]
> [<ffffffff822c042b>] kzalloc_node include/linux/slab.h:728 [inline]
> [<ffffffff822c042b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
> [<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
> [<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
> [<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
> [<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
> [<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
> [<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
> [<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
> [<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
> [<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
> [<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
> [<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
> [<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
> [<ffffffff8126b3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
> [<ffffffff8126bd19>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
>
> BUG: memory leak
> unreferenced object 0xffff888117fee680 (size 128):
> comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffffffff8240b6be>] kmalloc_array_node include/linux/slab.h:679 [inline]
> [<ffffffff8240b6be>] kcalloc_node include/linux/slab.h:684 [inline]
> [<ffffffff8240b6be>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
> [<ffffffff8240b8ec>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
> [<ffffffff822c0347>] bt_alloc block/blk-mq-tag.c:543 [inline]
> [<ffffffff822c0347>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
> [<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
> [<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
> [<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
> [<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
> [<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
> [<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
> [<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
> [<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
> [<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
> [<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
> [<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
> [<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
>
> BUG: memory leak
> unreferenced object 0xffff888116df4c00 (size 512):
> comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 10 4c df 16 81 88 ff ff 10 4c df 16 81 88 ff ff .L.......L......
> backtrace:
> [<ffffffff8240b9b8>] kmalloc_node include/linux/slab.h:602 [inline]
> [<ffffffff8240b9b8>] kzalloc_node include/linux/slab.h:728 [inline]
> [<ffffffff8240b9b8>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
> [<ffffffff822c0377>] bt_alloc block/blk-mq-tag.c:543 [inline]
> [<ffffffff822c0377>] blk_mq_init_bitmaps+0x87/0xf0 block/blk-mq-tag.c:557
> [<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
> [<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
> [<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
> [<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
> [<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
> [<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
> [<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
> [<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
> [<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
> [<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
> [<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
> [<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
> [<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000c341cc05db38c1b0%40google.com.
>
I think that, if device_add_disk() fails, the code should jump to the
"out_free_index" label.
Let's try if my argument is correct...
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Fabio
[-- Attachment #2: diff --]
[-- Type: text/x-patch, Size: 360 bytes --]
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a390679cf458..cd310eb406bb 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -3434,7 +3434,7 @@ static int sd_probe(struct device *dev)
error = device_add(&sdkp->disk_dev);
if (error) {
put_device(&sdkp->disk_dev);
- goto out;
+ goto out_free_index;
}
dev_set_drvdata(dev, sdkp);
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [syzbot] memory leak in blk_mq_init_tags
2022-03-28 7:21 ` Fabio M. De Francesco
@ 2022-03-28 7:29 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2022-03-28 7:29 UTC (permalink / raw)
To: axboe, fmdefrancesco, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
Tested on:
commit: ae085d7f mm: kfence: fix missing objcg housekeeping fo..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=6583b67d32c256f1
dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=1461d105700000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] memory leak in blk_mq_init_tags
2022-03-27 20:08 [syzbot] memory leak in blk_mq_init_tags syzbot
2022-03-28 7:21 ` Fabio M. De Francesco
@ 2022-03-28 7:56 ` Fabio M. De Francesco
2022-03-28 8:04 ` syzbot
2022-04-03 13:38 ` syzbot
2 siblings, 1 reply; 6+ messages in thread
From: Fabio M. De Francesco @ 2022-03-28 7:56 UTC (permalink / raw)
To: axboe, linux-block, linux-kernel, syzkaller-bugs; +Cc: syzbot
[-- Attachment #1: Type: text/plain, Size: 8011 bytes --]
On domenica 27 marzo 2022 22:08:18 CEST syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 6b1f86f8e9c7 Merge tag 'folio-5.18b' of git://git.infradea..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=13b41dcb700000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c6e80763d853259b
> dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
> compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1564ecb3700000
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
>
> BUG: memory leak
> unreferenced object 0xffff888118503c00 (size 192):
> comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
> hex dump (first 32 bytes):
> 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffffffff822c042b>] kmalloc_node include/linux/slab.h:602 [inline]
> [<ffffffff822c042b>] kzalloc_node include/linux/slab.h:728 [inline]
> [<ffffffff822c042b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
> [<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
> [<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
> [<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
> [<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
> [<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
> [<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
> [<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
> [<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
> [<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
> [<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
> [<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
> [<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
> [<ffffffff8126b3ef>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2307
> [<ffffffff8126bd19>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2454
>
> BUG: memory leak
> unreferenced object 0xffff888117fee680 (size 128):
> comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> backtrace:
> [<ffffffff8240b6be>] kmalloc_array_node include/linux/slab.h:679 [inline]
> [<ffffffff8240b6be>] kcalloc_node include/linux/slab.h:684 [inline]
> [<ffffffff8240b6be>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
> [<ffffffff8240b8ec>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
> [<ffffffff822c0347>] bt_alloc block/blk-mq-tag.c:543 [inline]
> [<ffffffff822c0347>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
> [<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
> [<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
> [<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
> [<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
> [<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
> [<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
> [<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
> [<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
> [<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
> [<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
> [<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
> [<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
>
> BUG: memory leak
> unreferenced object 0xffff888116df4c00 (size 512):
> comm "kworker/u4:2", pid 52, jiffies 4294961137 (age 11.420s)
> hex dump (first 32 bytes):
> 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
> 10 4c df 16 81 88 ff ff 10 4c df 16 81 88 ff ff .L.......L......
> backtrace:
> [<ffffffff8240b9b8>] kmalloc_node include/linux/slab.h:602 [inline]
> [<ffffffff8240b9b8>] kzalloc_node include/linux/slab.h:728 [inline]
> [<ffffffff8240b9b8>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
> [<ffffffff822c0377>] bt_alloc block/blk-mq-tag.c:543 [inline]
> [<ffffffff822c0377>] blk_mq_init_bitmaps+0x87/0xf0 block/blk-mq-tag.c:557
> [<ffffffff822c0468>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
> [<ffffffff822b6caa>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3169
> [<ffffffff822bbb86>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3620
> [<ffffffff822c3437>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
> [<ffffffff822c3437>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
> [<ffffffff8229e6f9>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
> [<ffffffff822c7085>] device_add_disk+0x25/0x510 block/genhd.c:421
> [<ffffffff82846437>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3551
> [<ffffffff8270c477>] call_driver_probe drivers/base/dd.c:517 [inline]
> [<ffffffff8270c477>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
> [<ffffffff8270c81c>] really_probe drivers/base/dd.c:558 [inline]
> [<ffffffff8270c81c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:755
> [<ffffffff8270c91a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:785
> [<ffffffff8270d186>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:902
> [<ffffffff827093e7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
> [<ffffffff8270b9ef>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:931
> [<ffffffff8127cf94>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
> syzbot can test patches for this issue, for details see:
> https://goo.gl/tpsmEJ#testing-patches
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000c341cc05db38c1b0%40google.com.
>
Oh, now I see that both the failures of device_add() or device_add_disk()
should make the code to jump to the "out_free_index" label.
Even if my first change was tested and didn't trigger any issue, I'd like
to try again with both changes too.
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Fabio M. De Francesco
[-- Attachment #2: diff --]
[-- Type: text/x-patch, Size: 576 bytes --]
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index a390679cf458..61fcf653ef5a 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -3434,7 +3434,7 @@ static int sd_probe(struct device *dev)
error = device_add(&sdkp->disk_dev);
if (error) {
put_device(&sdkp->disk_dev);
- goto out;
+ goto out_free_index;
}
dev_set_drvdata(dev, sdkp);
@@ -3475,7 +3475,7 @@ static int sd_probe(struct device *dev)
error = device_add_disk(dev, gd, NULL);
if (error) {
put_device(&sdkp->disk_dev);
- goto out;
+ goto out_free_index;
}
if (sdkp->capacity)
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [syzbot] memory leak in blk_mq_init_tags
2022-03-28 7:56 ` Fabio M. De Francesco
@ 2022-03-28 8:04 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2022-03-28 8:04 UTC (permalink / raw)
To: axboe, fmdefrancesco, linux-block, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-and-tested-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
Tested on:
commit: ae085d7f mm: kfence: fix missing objcg housekeeping fo..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=6583b67d32c256f1
dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
patch: https://syzkaller.appspot.com/x/patch.diff?x=120b3e8b700000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] memory leak in blk_mq_init_tags
2022-03-27 20:08 [syzbot] memory leak in blk_mq_init_tags syzbot
2022-03-28 7:21 ` Fabio M. De Francesco
2022-03-28 7:56 ` Fabio M. De Francesco
@ 2022-04-03 13:38 ` syzbot
2 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2022-04-03 13:38 UTC (permalink / raw)
To: axboe, dan.carpenter, fmdefrancesco, haowenchao, hch, jejb,
linfeilong, linux-block, linux-kernel, linux-scsi,
martin.petersen, syzkaller-bugs, wubo40
syzbot has found a reproducer for the following issue on:
HEAD commit: be2d3ecedd99 Merge tag 'perf-tools-for-v5.18-2022-04-02' o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=17c30c5f700000
kernel config: https://syzkaller.appspot.com/x/.config?x=58ae7615fea18863
dashboard link: https://syzkaller.appspot.com/bug?extid=f08c77040fa163a75a46
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11aff7e7700000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1195476b700000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
BUG: memory leak
unreferenced object 0xffff88810dbc1240 (size 192):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 17.570s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff822c3f2b>] kmalloc_node include/linux/slab.h:599 [inline]
[<ffffffff822c3f2b>] kzalloc_node include/linux/slab.h:725 [inline]
[<ffffffff822c3f2b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826fc6bf>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:927
[<ffffffff8127ce74>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
[<ffffffff8126b28f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
[<ffffffff8126bbb9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
BUG: memory leak
unreferenced object 0xffff888109d6da00 (size 128):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 17.570s)
hex dump (first 32 bytes):
03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff814a70de>] kmalloc_node include/linux/slab.h:604 [inline]
[<ffffffff814a70de>] kvmalloc_node+0x3e/0x130 mm/util.c:580
[<ffffffff8240fbee>] kvzalloc_node include/linux/slab.h:735 [inline]
[<ffffffff8240fbee>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
[<ffffffff8241045c>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
[<ffffffff822c3e47>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c3e47>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c3f68>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
BUG: memory leak
unreferenced object 0xffff88810c0e1600 (size 512):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 17.570s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
10 16 0e 0c 81 88 ff ff 10 16 0e 0c 81 88 ff ff ................
backtrace:
[<ffffffff82410528>] kmalloc_node include/linux/slab.h:599 [inline]
[<ffffffff82410528>] kzalloc_node include/linux/slab.h:725 [inline]
[<ffffffff82410528>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
[<ffffffff822c3e47>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c3e47>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c3f68>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826fc6bf>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:927
[<ffffffff8127ce74>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
BUG: memory leak
unreferenced object 0xffff88810dbc1240 (size 192):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 20.380s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff822c3f2b>] kmalloc_node include/linux/slab.h:599 [inline]
[<ffffffff822c3f2b>] kzalloc_node include/linux/slab.h:725 [inline]
[<ffffffff822c3f2b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826fc6bf>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:927
[<ffffffff8127ce74>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
[<ffffffff8126b28f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
[<ffffffff8126bbb9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
BUG: memory leak
unreferenced object 0xffff888109d6da00 (size 128):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 20.380s)
hex dump (first 32 bytes):
03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff814a70de>] kmalloc_node include/linux/slab.h:604 [inline]
[<ffffffff814a70de>] kvmalloc_node+0x3e/0x130 mm/util.c:580
[<ffffffff8240fbee>] kvzalloc_node include/linux/slab.h:735 [inline]
[<ffffffff8240fbee>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
[<ffffffff8241045c>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
[<ffffffff822c3e47>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c3e47>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c3f68>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
BUG: memory leak
unreferenced object 0xffff88810c0e1600 (size 512):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 20.380s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
10 16 0e 0c 81 88 ff ff 10 16 0e 0c 81 88 ff ff ................
backtrace:
[<ffffffff82410528>] kmalloc_node include/linux/slab.h:599 [inline]
[<ffffffff82410528>] kzalloc_node include/linux/slab.h:725 [inline]
[<ffffffff82410528>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
[<ffffffff822c3e47>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c3e47>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c3f68>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826fc6bf>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:927
[<ffffffff8127ce74>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
BUG: memory leak
unreferenced object 0xffff88810dbc1240 (size 192):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 21.330s)
hex dump (first 32 bytes):
02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
02 00 00 00 06 00 00 00 01 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff822c3f2b>] kmalloc_node include/linux/slab.h:599 [inline]
[<ffffffff822c3f2b>] kzalloc_node include/linux/slab.h:725 [inline]
[<ffffffff822c3f2b>] blk_mq_init_tags+0x4b/0xc0 block/blk-mq-tag.c:578
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826fc6bf>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:927
[<ffffffff8127ce74>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
[<ffffffff8126b28f>] process_one_work+0x2bf/0x600 kernel/workqueue.c:2289
[<ffffffff8126bbb9>] worker_thread+0x59/0x5b0 kernel/workqueue.c:2436
BUG: memory leak
unreferenced object 0xffff888109d6da00 (size 128):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 21.330s)
hex dump (first 32 bytes):
03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff814a70de>] kmalloc_node include/linux/slab.h:604 [inline]
[<ffffffff814a70de>] kvmalloc_node+0x3e/0x130 mm/util.c:580
[<ffffffff8240fbee>] kvzalloc_node include/linux/slab.h:735 [inline]
[<ffffffff8240fbee>] sbitmap_init_node+0xde/0x2d0 lib/sbitmap.c:113
[<ffffffff8241045c>] sbitmap_queue_init_node+0x3c/0x1f0 lib/sbitmap.c:428
[<ffffffff822c3e47>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c3e47>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c3f68>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
BUG: memory leak
unreferenced object 0xffff88810c0e1600 (size 512):
comm "kworker/u4:2", pid 53, jiffies 4294997418 (age 21.330s)
hex dump (first 32 bytes):
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
10 16 0e 0c 81 88 ff ff 10 16 0e 0c 81 88 ff ff ................
backtrace:
[<ffffffff82410528>] kmalloc_node include/linux/slab.h:599 [inline]
[<ffffffff82410528>] kzalloc_node include/linux/slab.h:725 [inline]
[<ffffffff82410528>] sbitmap_queue_init_node+0x108/0x1f0 lib/sbitmap.c:438
[<ffffffff822c3e47>] bt_alloc block/blk-mq-tag.c:543 [inline]
[<ffffffff822c3e47>] blk_mq_init_bitmaps+0x57/0xf0 block/blk-mq-tag.c:555
[<ffffffff822c3f68>] blk_mq_init_tags+0x88/0xc0 block/blk-mq-tag.c:586
[<ffffffff822ba7ba>] blk_mq_alloc_rq_map+0xea/0x1a0 block/blk-mq.c:3168
[<ffffffff822bf686>] blk_mq_alloc_map_and_rqs+0x26/0xb0 block/blk-mq.c:3619
[<ffffffff822c6f37>] blk_mq_sched_alloc_map_and_rqs block/blk-mq-sched.c:507 [inline]
[<ffffffff822c6f37>] blk_mq_init_sched+0x127/0x2e0 block/blk-mq-sched.c:587
[<ffffffff822a2f69>] elevator_init_mq+0x1f9/0x240 block/elevator.c:709
[<ffffffff822cabad>] device_add_disk+0x4d/0x520 block/genhd.c:425
[<ffffffff82833357>] sd_probe+0x457/0x670 drivers/scsi/sd.c:3475
[<ffffffff826fce97>] call_driver_probe drivers/base/dd.c:541 [inline]
[<ffffffff826fce97>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:620
[<ffffffff826fd1cc>] really_probe drivers/base/dd.c:582 [inline]
[<ffffffff826fd1cc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826fd2ca>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff826fdb36>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff826fa037>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826fc6bf>] __device_attach_async_helper+0xcf/0x110 drivers/base/dd.c:927
[<ffffffff8127ce74>] async_run_entry_fn+0x24/0xf0 kernel/async.c:127
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
executing program
executing program
executing program
executing program
executing program
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-04-03 13:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-03-27 20:08 [syzbot] memory leak in blk_mq_init_tags syzbot
2022-03-28 7:21 ` Fabio M. De Francesco
2022-03-28 7:29 ` syzbot
2022-03-28 7:56 ` Fabio M. De Francesco
2022-03-28 8:04 ` syzbot
2022-04-03 13:38 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).