Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
Date:   Mon, 28 Mar 2022 17:38:53 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Cc:     axboe@kernel.dk, linux-block@vger.kernel.org,
        linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
        "James E.J. Bottomley" <jejb@linux.ibm.com>,
        "Martin K. Petersen" <martin.petersen@oracle.com>,
        linux-scsi@vger.kernel.org,
        syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
Subject: Re: [PATCH] scsi: sd: Jump to out_free_index if device_add{,_disk}()
 fail
Message-ID: <20220328143853.GU3293@kadam>
References: <20220328084452.11479-1-fmdefrancesco@gmail.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220328084452.11479-1-fmdefrancesco@gmail.com>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?u6QxlEuCOwn6y7za/FOy/XuCr/n7yVprhjtzxZTDhX/oM9dRbOLDw6dm3gbF?=
 =?us-ascii?Q?EvjEwQT0Jqed2hQ3NLopD/Kqgbp65QanBhRRbHTNRRmq+wSzm5um7aQU6uzw?=
 =?us-ascii?Q?ux9s7DAns8+vPtF5AZRIQue33nKXIaHWL6Rvi+1N7hKk930jNsvofRqcGQE3?=
 =?us-ascii?Q?f0wZ6UPqdRvG115oohUR9qRSPlM18mGA+yctnfVYeqAX4dY2mfPzqPCmooCz?=
 =?us-ascii?Q?CyFRwUW/RgK9qIxrcOx+1oFaLf2hG7QQsaucr0GQMnHLk8JO9CfFWjX8sR2v?=
 =?us-ascii?Q?chmAsZ9EETg3SbEtvj1GjAX4YJehkso22pv94mY0sFMZ/I8xjmg39JWLEBDP?=
 =?us-ascii?Q?HNnPqJdccpS/UxZKHRUyRZSbwqdsffJKT+GgMpDR940HfK+aM/uriGT9gHoi?=
 =?us-ascii?Q?wfDUmaBp5egYP3MHFcBhQxR3dH0l3ScT4ELzwlYnbnn83SWbSxhKwwPY48Pp?=
 =?us-ascii?Q?sI13lB9W9yYIXJ0pmMR1fIsDTw+TFhymJeQ1N95WnsTEsCdxQNqW3o9J2bSZ?=
 =?us-ascii?Q?9YP1RPxq3qAnilNRl3nqyqoIga8IdeaRRFUgDmwzwz27vjuXjIpLWwkKWh+B?=
 =?us-ascii?Q?UQIS3QhxlBHxImH7yMW5XYXT30SVzxW+jWKDjKfn/qiNmEKMmlK0x3A+CTHn?=
 =?us-ascii?Q?qUPLlOnPHxavRjx/OzURgQ68IF9wo3feGndpmSR8WKYwX7bRbbfHx9IJuoHs?=
 =?us-ascii?Q?l6273k1ywMUo+Q/IKxyD2pPqbbTQuF94xi1kJe/nHCwURIafDZsYqkvbevoU?=
 =?us-ascii?Q?lYhJ22/Vywao59LjZI8f28vs0F4Xvc89wQA735qeWudpPwLRdvltbok+xg5M?=
 =?us-ascii?Q?pcCfTS/ZjDAYZ+YjOppD89IYdoH1Vwf+p6uqN3JSBXlnDClS6JB6Cb1GDdJj?=
 =?us-ascii?Q?E2KQOVjNJ2UDr6rOUZGR8mOlR/q4wi3RGRxBC2TtkWnzVjl3FHj2Vkbm1+l3?=
 =?us-ascii?Q?g5tceV5s7/bNyRnglZNOkCE/JfJChhQy5cDxZposoDD1rQgWhvc/vPvs7Oeb?=
 =?us-ascii?Q?uUSh9Weq/3oc1dkpE6gkEW03ZKOfBpEfCu33r9RLE18ZbeUO1eme9f3DqtkC?=
 =?us-ascii?Q?ncuBkgp8leSoCSbHrofEbVeyJIyDTNfvSZ9Qaay63fViyiXt2ZOJkJilodW2?=
 =?us-ascii?Q?YPgI0DRHgjZhC/Rdv77MW7DwW155DMhDf/NXMIsBmYa6/Vpce9InEm/geZw+?=
 =?us-ascii?Q?9JvOIQSn/nImwazj+fI6D3do/lQ76mmBcu+E1tYPzpIxEknF+P8z9Q6Z8CSI?=
 =?us-ascii?Q?YrA3fG+zzdRlTXPH/Bsts5MOG1UmQ69BmtPQCb02RIZhVJQT2NoMw9kBnaoF?=
 =?us-ascii?Q?CEatAp5ZwT+TfFvtQ2HqjZKtXCcoG9MbEYkDcpSwZxxGPvZs4VmC8B/PLVdq?=
 =?us-ascii?Q?i2XpBpyMTJaKGJn+aGgmi86pLdL2JuukW/8fcHuc8zTObaW1r+AWfGKPDisz?=
 =?us-ascii?Q?m8oBi8XFsdwVNkh1FdPTpk9VM4GmOxwqIPZtV+mRmYw/4xv0kIGj6MTacYnR?=
 =?us-ascii?Q?K5Eph0f6QhqSYu3Y3Xvdu3lS6O56XrM+nVRXWe6DI09Vc7rBJozEX/sdkmsa?=
 =?us-ascii?Q?JwO+BLYkS9IO8qTSrjTWKgquWdkWplMDAFFErHjmp6xetiRMdO4N+7I3KlX+?=
 =?us-ascii?Q?PtvC1LhN8i3o8wh0OAIElU6LqZXmmqHp2SbuRr/Mm0uizKjYyEupJ1TY2JxC?=
 =?us-ascii?Q?XtoA7LcmGG+qPon0pcyHicNegsVHD9lQT9yxsa+oj0btE/60a1BBF0GRigyX?=
 =?us-ascii?Q?vo6Q+65fG7/qR53B5T1yRHx3RBkSCuc=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f627684f-505f-41fd-603f-08da10c8bb4e
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Mar 2022 14:39:15.0669
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6TyILaKor3hUAcAdEclVxVS+GfyEJSMENA/ugsT8WapvKV1uU/KODNMZ3wJ1biiDS1GCsGqCvaVJCeCK1a/3Eyq2kWN8Gk6zkZ40kPQwBK0=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BYAPR10MB2487
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10299 signatures=694973
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=817 spamscore=0
 adultscore=0 mlxscore=0 phishscore=0 bulkscore=0 suspectscore=0
 malwarescore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2202240000 definitions=main-2203280083
X-Proofpoint-ORIG-GUID: 8f3yojNLV82vVM5LuQVc_Amia6nEgLBS
X-Proofpoint-GUID: 8f3yojNLV82vVM5LuQVc_Amia6nEgLBS
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Mar 28, 2022 at 10:44:52AM +0200, Fabio M. De Francesco wrote:
> Currently, if device_add() or device_add_disk() fail, the code jumps to
> the "out" label. Doing so we get a memory leak as Syzbot reports.[1]
> 
> Fix this bug by jumping to the "out_free_index" label.
> 
> [1] https://groups.google.com/g/syzkaller-bugs/c/BvuqG6YGb6I
> 
> Reported-and-tested-by: syzbot+f08c77040fa163a75a46@syzkaller.appspotmail.com
> Fixes: 2a7a891f4c40 ("scsi: sd: Add error handling support for add_disk()")
> Fixes: 265dfe8ebbab ("scsi: sd: Free scsi_disk device via put_device()")
> Signed-off-by: Fabio M. De Francesco <fmdefrancesco@gmail.com>
> ---
>  drivers/scsi/sd.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index a390679cf458..61fcf653ef5a 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -3434,7 +3434,7 @@ static int sd_probe(struct device *dev)
>  	error = device_add(&sdkp->disk_dev);
>  	if (error) {
>  		put_device(&sdkp->disk_dev);
> -		goto out;
> +		goto out_free_index;

The put_device calls scsi_disk_release() so this change will introduce
use after frees and double frees.

There is a larger process issue here.  We need to figure out why syzbot
did not detect that this patch introduces bugs.

regards,
dan carpenter