[syzbot] memory leak in kobject_set_name_vargs (5)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4b35035bcf80 Merge tag 'nfs-for-5.19-2' of git://git.linux..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16db143ff00000
kernel config: https://syzkaller.appspot.com/x/.config?x=3136c902c03fdd37
dashboard link: https://syzkaller.appspot.com/bug?extid=7381dc4ad60658ca4c05
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=111c8c1ff00000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7381dc...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88811943b700 (size 32):
comm "syz-executor.7", pid 3953, jiffies 4294958653 (age 15.830s)
hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff814b7106>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814b7193>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239acd2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff8249179b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82491c1d>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82491c1d>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e2c07a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81e1482c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81e004db>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81e004db>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8163fb5b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815d95c8>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff8161d097>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff8161d097>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff8161dcce>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff8161dcce>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff8161dcce>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff8161dcce>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845a9cb5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845a9cb5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff8460006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: b44f2fd87919 Merge tag 'drm-next-2022-08-03' of git://anon..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=105fdbca080000
kernel config: https://syzkaller.appspot.com/x/.config?x=358668a360d9b702

dashboard link: https://syzkaller.appspot.com/bug?extid=7381dc4ad60658ca4c05
compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11c685ca080000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=120a0fe2080000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+7381dc...@syzkaller.appspotmail.com

BUG: memory leak

unreferenced object 0xffff88810c35db80 (size 32):
comm "syz-executor261", pid 3645, jiffies 4294950822 (age 25.990s)

hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:

[<ffffffff814bf836>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814bf8c3>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239c002>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82492b6b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82492fed>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82492fed>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e10e8a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81df964c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81de57ab>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81de57ab>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8164981b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815e2c68>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff81626e27>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff81626e27>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff81627a5e>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff81627a5e>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff81627a5e>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff81627a5e>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845cad15>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845cad15>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810c35db80 (size 32):
comm "syz-executor261", pid 3645, jiffies 4294950822 (age 27.260s)

hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:

[<ffffffff814bf836>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814bf8c3>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239c002>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82492b6b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82492fed>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82492fed>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e10e8a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81df964c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81de57ab>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81de57ab>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8164981b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815e2c68>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff81626e27>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff81626e27>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff81627a5e>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff81627a5e>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff81627a5e>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff81627a5e>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845cad15>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845cad15>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810c35db80 (size 32):
comm "syz-executor261", pid 3645, jiffies 4294950822 (age 28.520s)

hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:

[<ffffffff814bf836>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814bf8c3>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239c002>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82492b6b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82492fed>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82492fed>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e10e8a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81df964c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81de57ab>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81de57ab>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8164981b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815e2c68>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff81626e27>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff81626e27>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff81627a5e>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff81627a5e>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff81627a5e>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff81627a5e>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845cad15>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845cad15>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810c35db80 (size 32):
comm "syz-executor261", pid 3645, jiffies 4294950822 (age 31.000s)

hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:

[<ffffffff814bf836>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814bf8c3>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239c002>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82492b6b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82492fed>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82492fed>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e10e8a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81df964c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81de57ab>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81de57ab>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8164981b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815e2c68>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff81626e27>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff81626e27>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff81627a5e>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff81627a5e>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff81627a5e>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff81627a5e>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845cad15>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845cad15>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810c35db80 (size 32):
comm "syz-executor261", pid 3645, jiffies 4294950822 (age 31.040s)

hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:

[<ffffffff814bf836>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814bf8c3>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239c002>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82492b6b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82492fed>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82492fed>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e10e8a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81df964c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81de57ab>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81de57ab>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8164981b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815e2c68>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff81626e27>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff81626e27>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff81627a5e>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff81627a5e>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff81627a5e>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff81627a5e>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845cad15>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845cad15>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

BUG: memory leak
unreferenced object 0xffff88810c35db80 (size 32):
comm "syz-executor261", pid 3645, jiffies 4294950822 (age 31.080s)

hex dump (first 32 bytes):
6c 6f 6f 70 37 00 00 00 00 00 00 00 00 00 00 00 loop7...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:

[<ffffffff814bf836>] kstrdup+0x36/0x70 mm/util.c:61
[<ffffffff814bf8c3>] kstrdup_const+0x53/0x80 mm/util.c:84
[<ffffffff8239c002>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82492b6b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:257
[<ffffffff82492fed>] kobject_add_varg lib/kobject.c:352 [inline]
[<ffffffff82492fed>] kobject_init_and_add+0x6d/0xc0 lib/kobject.c:441
[<ffffffff81e10e8a>] nilfs_sysfs_create_device_group+0x9a/0x3d0 fs/nilfs2/sysfs.c:991
[<ffffffff81df964c>] init_nilfs+0x51c/0x680 fs/nilfs2/the_nilfs.c:637
[<ffffffff81de57ab>] nilfs_fill_super fs/nilfs2/super.c:1047 [inline]
[<ffffffff81de57ab>] nilfs_mount+0x51b/0x890 fs/nilfs2/super.c:1317
[<ffffffff8164981b>] legacy_get_tree+0x2b/0x90 fs/fs_context.c:610
[<ffffffff815e2c68>] vfs_get_tree+0x28/0x100 fs/super.c:1497
[<ffffffff81626e27>] do_new_mount fs/namespace.c:3040 [inline]
[<ffffffff81626e27>] path_mount+0xc37/0x1120 fs/namespace.c:3370
[<ffffffff81627a5e>] do_mount fs/namespace.c:3383 [inline]
[<ffffffff81627a5e>] __do_sys_mount fs/namespace.c:3591 [inline]
[<ffffffff81627a5e>] __se_sys_mount fs/namespace.c:3568 [inline]
[<ffffffff81627a5e>] __x64_sys_mount+0x18e/0x1d0 fs/namespace.c:3568
[<ffffffff845cad15>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff845cad15>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
[<ffffffff84600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
executing program
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory
executing program
write to /proc/sys/kernel/hung_task_check_interval_secs failed: No such file or directory
write to /proc/sys/kernel/softlockup_all_cpu_backtrace failed: No such file or directory

[Ryusuke Konishi]

If nilfs_attach_log_writer() failed to create a log writer thread, it
frees a data structure of the log writer without any cleanup. After
commit e912a5b66837 ("nilfs2: use root object to get ifile"), this
causes a leak of struct nilfs_root, which started to leak an ifile
metadata inode and a kobject on that struct.

In addition, if the kernel is booted with panic_on_warn, the above
ifile metadata inode leak will cause the following panic when the
nilfs2 kernel module is removed:

kmem_cache_destroy nilfs2_inode_cache: Slab cache still has objects when
called from nilfs_destroy_cachep+0x16/0x3a [nilfs2]
WARNING: CPU: 8 PID: 1464 at mm/slab_common.c:494 kmem_cache_destroy+0x138/0x140
...
RIP: 0010:kmem_cache_destroy+0x138/0x140
Code: 00 20 00 00 e8 a9 55 d8 ff e9 76 ff ff ff 48 8b 53 60 48 c7 c6 20 70 65 86 48 c7 c7 d8 69 9c 86 48 8b 4c 24 28 e8 ef 71 c7 00 <0f> 0b e9 53 ff ff ff c3 48 81 ff ff 0f 00 00 77 03 31 c0 c3 53 48
...
Call Trace:
<TASK>
? nilfs_palloc_freev.cold.24+0x58/0x58 [nilfs2]
nilfs_destroy_cachep+0x16/0x3a [nilfs2]
exit_nilfs_fs+0xa/0x1b [nilfs2]
__x64_sys_delete_module+0x1d9/0x3a0
? __sanitizer_cov_trace_pc+0x1a/0x50
? syscall_trace_enter.isra.19+0x119/0x190
do_syscall_64+0x34/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
...
</TASK>
Kernel panic - not syncing: panic_on_warn set ...

This patch fixes these issues by calling nilfs_detach_log_writer()
cleanup function if spawning the log writer thread fails.

Signed-off-by: Ryusuke Konishi <konishi...@gmail.com>
Fixes: e912a5b66837 ("nilfs2: use root object to get ifile")
Reported-by: syzbot+7381dc...@syzkaller.appspotmail.com
Tested-by: Ryusuke Konishi <konishi...@gmail.com>
Cc: sta...@vger.kernel.org
---
fs/nilfs2/segment.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 0afe0832c754..5276ab525f01 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -2786,10 +2786,9 @@ int nilfs_attach_log_writer(struct super_block *sb, struct nilfs_root *root)
inode_attach_wb(nilfs->ns_bdev->bd_inode, NULL);

err = nilfs_segctor_start_thread(nilfs->ns_writer);
- if (err) {
- kfree(nilfs->ns_writer);
- nilfs->ns_writer = NULL;
- }
+ if (unlikely(err))
+ nilfs_detach_log_writer(sb);
+
return err;
}

--
2.34.1