nilfs2: fix memory leak in nilfs_sysfs_create_device_group
Patch series "nilfs2: fix incorrect usage of kobject".
This patchset from Nanyong Sun fixes memory leak issues and a NULL pointer
dereference issue caused by incorrect usage of kboject in nilfs2 sysfs
implementation.
This patch (of 6):
Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888100ca8988 (size 8):
comm "syz-executor.1", pid 1930, jiffies
4294745569 (age 18.052s)
hex dump (first 8 bytes):
6c 6f 6f 70 31 00 ff ff loop1...
backtrace:
[<
000000009d9e0ac4>] slab_alloc_node mm/slub.c:2972 [inline]
[<
000000009d9e0ac4>] slab_alloc mm/slub.c:2980 [inline]
[<
000000009d9e0ac4>] __kmalloc_track_caller+0x164/0x330 mm/slub.c:4644
[<
00000000b1825477>] kstrdup+0x36/0x70 mm/util.c:60
[<
00000000fa081499>] kstrdup_const+0x35/0x60 mm/util.c:83
[<
0000000024d13570>] kvasprintf_const+0xf1/0x180 lib/kasprintf.c:48
[<
0000000024b69715>] kobject_set_name_vargs+0x56/0x150 lib/kobject.c:289
[<
000000003fedac3d>] kobject_add_varg lib/kobject.c:384 [inline]
[<
000000003fedac3d>] kobject_init_and_add+0xc9/0x150 lib/kobject.c:473
[<
000000002795bd99>] nilfs_sysfs_create_device_group+0x150/0x7d0 fs/nilfs2/sysfs.c:986
[<
00000000567fa12d>] init_nilfs+0xa21/0xea0 fs/nilfs2/the_nilfs.c:637
[<
00000000082e7458>] nilfs_fill_super fs/nilfs2/super.c:1046 [inline]
[<
00000000082e7458>] nilfs_mount+0x7b4/0xe80 fs/nilfs2/super.c:1316
[<
00000000adc3fd88>] legacy_get_tree+0x105/0x210 fs/fs_context.c:592
[<
00000000a98c45b8>] vfs_get_tree+0x8e/0x2d0 fs/super.c:1498
[<
00000000e96282d3>] do_new_mount fs/namespace.c:2905 [inline]
[<
00000000e96282d3>] path_mount+0xf9b/0x1990 fs/namespace.c:3235
[<
000000003d2eb1b0>] do_mount+0xea/0x100 fs/namespace.c:3248
[<
00000000e1ce771a>] __do_sys_mount fs/namespace.c:3456 [inline]
[<
00000000e1ce771a>] __se_sys_mount fs/namespace.c:3433 [inline]
[<
00000000e1ce771a>] __x64_sys_mount+0x14b/0x1f0 fs/namespace.c:3433
[<
000000007c7f81e8>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<
000000007c7f81e8>] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
[<
00000000fd23ff06>] entry_SYSCALL_64_after_hwframe+0x44/0xae
If kobject_init_and_add return with error, then the cleanup of kobject is
needed because memory may be allocated in kobject_init_and_add without
freeing.
And the place of cleanup_dev_kobject should use kobject_put to free the
memory associated with the kobject. As the section "Kobject removal" of
"Documentation/core-api/kobject.rst" says, kobject_del() just makes the
kobject "invisible", but it is not cleaned up. And no more cleanup will
do after cleanup_dev_kobject, so kobject_put is needed here.
Link: https://lkml.kernel.org/r/1625651306-10829-1-git-send-email-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/1625651306-10829-2-git-send-email-konishi.ryusuke@gmail.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Link: https://lkml.kernel.org/r/20210629022556.3985106-2-sunnanyong@huawei.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>