Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
From:   Kyungtae Kim <kt0755@gmail.com>
Date:   Thu, 26 Mar 2020 01:24:37 -0400
Message-ID: <CAEAjamtSvxgNYqjN1NPrgM=NmcTUKoQdq+y1+Pf-8JJWH6Airg@mail.gmail.com>
Subject: memory leak in scsi_init_io
To:     jejb@linux.ibm.com, martin.petersen@oracle.com
Cc:     Dave Tian <dave.jing.tian@gmail.com>,
        syzkaller <syzkaller@googlegroups.com>,
        LKML <linux-kernel@vger.kernel.org>, linux-scsi@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

We report a bug (in linux-5.5.13) found by FuzzUSB (a modified version
of syzkaller)

A memory buffer (i.e., struct scatterlist) is allocated, and not freed properly.
(not sure about the point where the allocated memory region is leaking.)

==================================================================
BUG: memory leak
unreferenced object 0xffff88805b337280 (size 256):
  comm "syz-executor.6", pid 5934, jiffies 4295016561 (age 16.340s)
  hex dump (first 32 bytes):
    00 46 5f 01 00 ea ff ff 00 00 00 00 00 10 00 00  .F_.............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<000000006305194b>] kmemleak_alloc_recursive
2/./include/linux/kmemleak.h:43 [inline]
    [<000000006305194b>] slab_post_alloc_hook 2/mm/slab.h:586 [inline]
    [<000000006305194b>] slab_alloc_node 2/mm/slub.c:2767 [inline]
    [<000000006305194b>] slab_alloc 2/mm/slub.c:2775 [inline]
    [<000000006305194b>] kmem_cache_alloc+0x165/0x340 2/mm/slub.c:2780
    [<000000003f20764c>] mempool_alloc_slab+0x44/0x70 2/mm/mempool.c:513
    [<00000000561f62bb>] mempool_alloc+0x145/0x370 2/mm/mempool.c:393
    [<00000000322111ed>] sg_pool_alloc+0xe6/0x1a0 2/lib/sg_pool.c:67
    [<00000000b72ca391>] __sg_alloc_table+0xb0/0x370 2/lib/scatterlist.c:302
    [<00000000c61ae208>] sg_alloc_table_chained+0x6c/0x1c0 2/lib/sg_pool.c:132
    [<00000000cd52be39>] scsi_init_sgtable
2/drivers/scsi/scsi_lib.c:990 [inline]
    [<00000000cd52be39>] scsi_init_io+0x10e/0x340 2/drivers/scsi/scsi_lib.c:1025
    [<000000004dccec43>] sd_setup_read_write_cmnd
2/drivers/scsi/sd.c:1174 [inline]
    [<000000004dccec43>] sd_init_command+0xbdc/0x3400 2/drivers/scsi/sd.c:1290
    [<00000000644825df>] scsi_setup_fs_cmnd
2/drivers/scsi/scsi_lib.c:1211 [inline]
    [<00000000644825df>] scsi_setup_cmnd 2/drivers/scsi/scsi_lib.c:1229 [inline]
    [<00000000644825df>] scsi_mq_prep_fn 2/drivers/scsi/scsi_lib.c:1603 [inline]
    [<00000000644825df>] scsi_queue_rq+0xf18/0x2a30
2/drivers/scsi/scsi_lib.c:1671
    [<00000000d4c4c1c8>] blk_mq_dispatch_rq_list+0xa6e/0x1870
2/block/blk-mq.c:1238
    [<00000000e1d472b3>] blk_mq_do_dispatch_sched+0x198/0x3f0
2/block/blk-mq-sched.c:115
    [<000000002542d635>] blk_mq_sched_dispatch_requests+0x39a/0x600
2/block/blk-mq-sched.c:211
    [<000000000ffcbd69>] __blk_mq_run_hw_queue+0x12b/0x250 2/block/blk-mq.c:1368
    [<000000001cbeb84f>] __blk_mq_delay_run_hw_queue+0x467/0x4f0
2/block/blk-mq.c:1436
    [<000000003a7eefb7>] blk_mq_run_hw_queue+0x178/0x320 2/block/blk-mq.c:1473
    [<00000000bf63d47b>] blk_mq_get_tag+0x583/0xa00 2/block/blk-mq-tag.c:139
==================================================================