BUG: memory leak
unreferenced object 0xffff888121de9800 (size 2048):
  comm "syz-executor.0", pid 7022, jiffies 4294942122 (age 20.320s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    20 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00   ...............
  backtrace:
    [<0000000076df5eba>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000076df5eba>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000076df5eba>] slab_alloc mm/slab.c:3319 [inline]
    [<0000000076df5eba>] __do_kmalloc mm/slab.c:3653 [inline]
    [<0000000076df5eba>] __kmalloc+0x169/0x300 mm/slab.c:3664
    [<000000000e678f91>] kmalloc include/linux/slab.h:557 [inline]
    [<000000000e678f91>] bio_alloc_bioset+0x1b8/0x2c0 block/bio.c:440
    [<000000006c1b7491>] bio_kmalloc include/linux/bio.h:405 [inline]
    [<000000006c1b7491>] bio_copy_user_iov+0x112/0x4b0 block/bio.c:1263
    [<000000009698375a>] __blk_rq_map_user_iov block/blk-map.c:73 [inline]
    [<000000009698375a>] blk_rq_map_user_iov+0xc6/0x2b0 block/blk-map.c:142
    [<0000000051ef31bf>] blk_rq_map_user+0x71/0xb0 block/blk-map.c:172
    [<000000003ad50574>] sg_start_req drivers/scsi/sg.c:1813 [inline]
    [<000000003ad50574>] sg_common_write.isra.0+0x619/0xa10 drivers/scsi/sg.c:809
    [<0000000008f6a9b1>] sg_write.part.0+0x325/0x570 drivers/scsi/sg.c:709
    [<00000000f68a55f7>] sg_write+0x44/0x64 drivers/scsi/sg.c:617
    [<000000002ba2c608>] __vfs_write+0x43/0xa0 fs/read_write.c:494
    [<00000000b96a44f1>] vfs_write fs/read_write.c:558 [inline]
    [<00000000b96a44f1>] vfs_write+0xee/0x210 fs/read_write.c:542
    [<0000000081b799ac>] ksys_write+0x7c/0x130 fs/read_write.c:611
    [<00000000a6555b3d>] __do_sys_write fs/read_write.c:623 [inline]
    [<00000000a6555b3d>] __se_sys_write fs/read_write.c:620 [inline]
    [<00000000a6555b3d>] __x64_sys_write+0x1e/0x30 fs/read_write.c:620
    [<00000000796acaa7>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<00000000626b1e27>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881201de800 (size 2048):
  comm "syz-executor.0", pid 7028, jiffies 4294942733 (age 14.210s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    20 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00   ...............
  backtrace:
    [<0000000076df5eba>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<0000000076df5eba>] slab_post_alloc_hook mm/slab.h:522 [inline]
    [<0000000076df5eba>] slab_alloc mm/slab.c:3319 [inline]
    [<0000000076df5eba>] __do_kmalloc mm/slab.c:3653 [inline]
    [<0000000076df5eba>] __kmalloc+0x169/0x300 mm/slab.c:3664
    [<000000000e678f91>] kmalloc include/linux/slab.h:557 [inline]
    [<000000000e678f91>] bio_alloc_bioset+0x1b8/0x2c0 block/bio.c:440
    [<000000006c1b7491>] bio_kmalloc include/linux/bio.h:405 [inline]
    [<000000006c1b7491>] bio_copy_user_iov+0x112/0x4b0 block/bio.c:1263
    [<000000009698375a>] __blk_rq_map_user_iov block/blk-map.c:73 [inline]
    [<000000009698375a>] blk_rq_map_user_iov+0xc6/0x2b0 block/blk-map.c:142
    [<0000000051ef31bf>] blk_rq_map_user+0x71/0xb0 block/blk-map.c:172
    [<000000003ad50574>] sg_start_req drivers/scsi/sg.c:1813 [inline]
    [<000000003ad50574>] sg_common_write.isra.0+0x619/0xa10 drivers/scsi/sg.c:809
    [<0000000008f6a9b1>] sg_write.part.0+0x325/0x570 drivers/scsi/sg.c:709
    [<00000000f68a55f7>] sg_write+0x44/0x64 drivers/scsi/sg.c:617
    [<000000002ba2c608>] __vfs_write+0x43/0xa0 fs/read_write.c:494
    [<00000000b96a44f1>] vfs_write fs/read_write.c:558 [inline]
    [<00000000b96a44f1>] vfs_write+0xee/0x210 fs/read_write.c:542
    [<0000000081b799ac>] ksys_write+0x7c/0x130 fs/read_write.c:611
    [<00000000a6555b3d>] __do_sys_write fs/read_write.c:623 [inline]
    [<00000000a6555b3d>] __se_sys_write fs/read_write.c:620 [inline]
    [<00000000a6555b3d>] __x64_sys_write+0x1e/0x30 fs/read_write.c:620
    [<00000000796acaa7>] do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:296
    [<00000000626b1e27>] entry_SYSCALL_64_after_hwframe+0x44/0xa9