[scsi-1130]scsi: scsi_transport_sas: Fix memory leak when removing devices

Bug #1854550 reported by Fred Kimmy on 2019-11-30
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kunpeng920
Undecided
Ike Panhc
Ubuntu-18.04
Undecided
Unassigned
Ubuntu-18.04-hwe
Undecided
Ike Panhc
Ubuntu-19.04
Undecided
Unassigned
Ubuntu-19.10
Undecided
Unassigned
Ubuntu-20.04
Undecided
Ike Panhc
Upstream-kernel
Undecided
Unassigned
linux (Ubuntu)
Undecided
Ike Panhc

Bug Description

[Impact]
kmemleak detects potential leaks and this is the fix

[Test Case]
Not known case, regression test on system with SAS host is needed.

[Fix]
82ea3e0e12 scsi: scsi_transport_sas: Fix memory leak when removing devices

[Regression Risk]
Patch is simple and reviewed on upstream. Since modification is for scsi subsystem not on a single driver, applying on focal gives us enough time for test.

"[Steps to reproduce]
Enable memleak, and do as follows:
root@(none)$ echo 0 > /sys/devices/platform/HISI0162:01/host0/port-0:0/expander-0:0/port-0:0:10/phy-0:0:10/sas_phy/phy-0:0:10/enable
[ 79.857888] hisi_sas_v2_hw HISI0162:01: dev[7:1] is gone
root@(none)$ echo scan > /sys/kernel/debug/kmemleak
[ 131.656603] kmemleak: 3 new suspected memory leaks (see /sys/kernel/debug/kmemleak)
root@(none)$ more /sys/kernel/debug/kmemleak
unreferenced object 0xffff041da5c66000 (size 256):
  comm ""kworker/u128:1"", pid 549, jiffies 4294898543 (age 113.728s)
  hex dump (first 32 bytes):
    00 5e c6 a5 1d 04 ff ff 01 00 00 00 00 00 00 00 .^..............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  backtrace:
    [<(____ptrval____)>] kmem_cache_alloc+0x188/0x260
    [<(____ptrval____)>] bsg_setup_queue+0x48/0x1a8
    [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0
    [<(____ptrval____)>] sas_probe_devices+0x168/0x208
    [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8
    [<(____ptrval____)>] process_one_work+0x3f8/0x690
    [<(____ptrval____)>] worker_thread+0x70/0x6a0
    [<(____ptrval____)>] kthread+0x1b8/0x1c0
    [<(____ptrval____)>] ret_from_fork+0x10/0x18
unreferenced object 0xffff041d8c075400 (size 128):
  comm ""kworker/u128:1"", pid 549, jiffies 4294898543 (age 113.728s)
  hex dump (first 32 bytes):
    00 40 25 97 1d 00 ff ff 00 00 00 00 00 00 00 00 .@%.............
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  backtrace:
    [<(____ptrval____)>] __kmalloc_node+0x1a8/0x2c8
    [<(____ptrval____)>] blk_mq_realloc_tag_set_tags.part.70+0x48/0xd8
    [<(____ptrval____)>] blk_mq_alloc_tag_set+0x1dc/0x530
    [<(____ptrval____)>] bsg_setup_queue+0xe8/0x1a8
    [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0
    [<(____ptrval____)>] sas_probe_devices+0x168/0x208
    [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8
    [<(____ptrval____)>] process_one_work+0x3f8/0x690
    [<(____ptrval____)>] worker_thread+0x70/0x6a0
    [<(____ptrval____)>] kthread+0x1b8/0x1c0
    [<(____ptrval____)>] ret_from_fork+0x10/0x18
unreferenced object 0xffff041da5c65e00 (size 256):
  comm ""kworker/u128:1"", pid 549, jiffies 4294898543 (age 113.728s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
  backtrace:
    [<(____ptrval____)>] __kmalloc_node+0x1a8/0x2c8
    [<(____ptrval____)>] blk_mq_alloc_tag_set+0x254/0x530
    [<(____ptrval____)>] bsg_setup_queue+0xe8/0x1a8
    [<(____ptrval____)>] sas_rphy_add+0x108/0x2d0
    [<(____ptrval____)>] sas_probe_devices+0x168/0x208
    [<(____ptrval____)>] sas_discover_domain+0x660/0x9c8
    [<(____ptrval____)>] process_one_work+0x3f8/0x690
    [<(____ptrval____)>] worker_thread+0x70/0x6a0
    [<(____ptrval____)>] kthread+0x1b8/0x1c0
    [<(____ptrval____)>] ret_from_fork+0x10/0x18
root@(none)$

[solution]
Fix by doing the queue removal in one place - in sas_rphy_remove() -
instead of unregistering the queue in sas_rphy_remove() and finally
cleaning up the queue in calling blk_cleanup_queue() from
sas_end_device_release() or sas_expander_release().

Function bsg_remove_queue() can handle a NULL pointer q, so remove the
precheck in sas_rphy_remove().
"
scsi: scsi_transport_sas: Fix memory leak when removing devices

Ike Panhc (ikepanhc) wrote :

Not yet hit upstream/master.

Changed in kunpeng920:
status: New → Incomplete
dann frazier (dannf) wrote :

This is a fix for a commit that landed in v4.19, so marking Ubuntu-18.04 Invalid.

    Fixes: 651a013649943 ("scsi: scsi_transport_sas: switch to bsg-lib for SMP passthrough")

While it is a small memory leak, it does appear to be something users would be unlikely to hit or notice, so I don't think it would qualify for SRU - but seems like something we should fix for 20.04.

Also, fix is in linux-next, so marking triaged.

Changed in kunpeng920:
status: Incomplete → Triaged
Fred Kimmy (kongzizaixian) wrote :

Can you fix this ubuntu 18.04.4 version?

Ike Panhc (ikepanhc) wrote :

Target is 5.4 kernel. Patch is expected to hit in 5.5 merge window.

dann frazier (dannf) wrote :

@Ike: This is now upstream, could you submit it for focal?

Changed in kunpeng920:
assignee: nobody → Ike Panhc (ikepanhc)
dann frazier (dannf) on 2019-12-11
Changed in linux (Ubuntu):
status: New → Triaged
assignee: nobody → Ike Panhc (ikepanhc)
Fred Kimmy (kongzizaixian) wrote :

if this patch merge into this linus 5.5 version, whether we can backport ubuntu 18.04.4 update version or not?

Ike Panhc (ikepanhc) on 2020-01-07
tags: added: ikeradar
Ike Panhc (ikepanhc) on 2020-01-09
Changed in kunpeng920:
status: Triaged → In Progress
Changed in linux (Ubuntu):
status: Triaged → In Progress
Ike Panhc (ikepanhc) on 2020-01-09
description: updated
Ike Panhc (ikepanhc) wrote :
Ike Panhc (ikepanhc) on 2020-01-10
tags: removed: ikeradar
Seth Forshee (sforshee) on 2020-01-21
Changed in linux (Ubuntu):
status: In Progress → Fix Committed
dann frazier (dannf) on 2020-01-22
Changed in kunpeng920:
status: In Progress → Fix Committed
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers