memory leak in reiserfs_fill_super

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 6794862a Merge tag 'for-5.5-rc1-kconfig-tag' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1158c12ee00000
kernel config: https://syzkaller.appspot.com/x/.config?x=bbf3a35184a3ed64
dashboard link: https://syzkaller.appspot.com/bug?extid=1c6756baf4b16b94d2a6
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=165a64fae00000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12083661e00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+1c6756...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88811ff310c0 (size 32):
comm "syz-executor671", pid 7128, jiffies 4294943335 (age 13.580s)
hex dump (first 32 bytes):
2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
01 00 00 00 01 00 00 00 18 00 00 00 00 00 00 00 ................
backtrace:
[<000000004089eb3d>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<000000004089eb3d>] slab_post_alloc_hook mm/slab.h:586 [inline]
[<000000004089eb3d>] slab_alloc mm/slab.c:3320 [inline]
[<000000004089eb3d>] __do_kmalloc mm/slab.c:3654 [inline]
[<000000004089eb3d>] __kmalloc_track_caller+0x165/0x300 mm/slab.c:3671
[<000000008421832f>] kstrdup+0x3a/0x70 mm/util.c:60
[<0000000043bf75e5>] reiserfs_fill_super+0x500/0x1120
fs/reiserfs/super.c:1946
[<000000009cbc0e69>] mount_bdev+0x1ce/0x210 fs/super.c:1415
[<00000000934dd7f3>] get_super_block+0x35/0x40 fs/reiserfs/super.c:2604
[<00000000cf77f9c8>] legacy_get_tree+0x27/0x80 fs/fs_context.c:647
[<000000000d70f443>] vfs_get_tree+0x2d/0xe0 fs/super.c:1545
[<00000000be5ed892>] do_new_mount fs/namespace.c:2822 [inline]
[<00000000be5ed892>] do_mount+0x97c/0xc80 fs/namespace.c:3142
[<00000000f546ac03>] ksys_mount+0xab/0x120 fs/namespace.c:3351
[<000000005818601f>] __do_sys_mount fs/namespace.c:3365 [inline]
[<000000005818601f>] __se_sys_mount fs/namespace.c:3362 [inline]
[<000000005818601f>] __x64_sys_mount+0x26/0x30 fs/namespace.c:3362
[<00000000a358ffb7>] do_syscall_64+0x73/0x220
arch/x86/entry/common.c:294
[<00000000cb1c9cc8>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881232e08e0 (size 32):
comm "syz-executor671", pid 7135, jiffies 4294943878 (age 8.150s)
hex dump (first 32 bytes):
2e 00 63 75 72 69 74 79 2e 73 65 6c 69 6e 75 78 ..curity.selinux
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000004089eb3d>] kmemleak_alloc_recursive
include/linux/kmemleak.h:43 [inline]
[<000000004089eb3d>] slab_post_alloc_hook mm/slab.h:586 [inline]
[<000000004089eb3d>] slab_alloc mm/slab.c:3320 [inline]
[<000000004089eb3d>] __do_kmalloc mm/slab.c:3654 [inline]
[<000000004089eb3d>] __kmalloc_track_caller+0x165/0x300 mm/slab.c:3671
[<000000008421832f>] kstrdup+0x3a/0x70 mm/util.c:60
[<0000000043bf75e5>] reiserfs_fill_super+0x500/0x1120
fs/reiserfs/super.c:1946
[<000000009cbc0e69>] mount_bdev+0x1ce/0x210 fs/super.c:1415
[<00000000934dd7f3>] get_super_block+0x35/0x40 fs/reiserfs/super.c:2604
[<00000000cf77f9c8>] legacy_get_tree+0x27/0x80 fs/fs_context.c:647
[<000000000d70f443>] vfs_get_tree+0x2d/0xe0 fs/super.c:1545
[<00000000be5ed892>] do_new_mount fs/namespace.c:2822 [inline]
[<00000000be5ed892>] do_mount+0x97c/0xc80 fs/namespace.c:3142
[<00000000f546ac03>] ksys_mount+0xab/0x120 fs/namespace.c:3351
[<000000005818601f>] __do_sys_mount fs/namespace.c:3365 [inline]
[<000000005818601f>] __se_sys_mount fs/namespace.c:3362 [inline]
[<000000005818601f>] __x64_sys_mount+0x26/0x30 fs/namespace.c:3362
[<00000000a358ffb7>] do_syscall_64+0x73/0x220
arch/x86/entry/common.c:294
[<00000000cb1c9cc8>] entry_SYSCALL_64_after_hwframe+0x44/0xa9



---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[syzbot]

Hello,

syzbot tried to test the proposed patch but build/boot failed:

t-in.a
CC drivers/xen/events/events_fifo.o
CC net/netfilter/nft_reject.o
CC net/netfilter/nft_reject_inet.o
CC net/netfilter/nft_tunnel.o
CC drivers/scsi/virtio_scsi.o
CC drivers/scsi/st.o
CC drivers/scsi/sd.o
CC drivers/xen/xenbus/xenbus_client.o
CC drivers/scsi/sd_dif.o
CC drivers/scsi/sd_zbc.o
CC drivers/tty/tty_port.o
CC drivers/usb/core/buffer.o
CC drivers/tty/tty_mutex.o
CC drivers/xen/xenfs/super.o
CC drivers/gpu/drm/i915/display/intel_cdclk.o
CC drivers/video/fbdev/core/bitblit.o
CC net/netfilter/nft_counter.o
CC drivers/gpu/drm/i915/display/intel_combo_phy.o
CC drivers/gpu/drm/i915/display/intel_color.o
CC drivers/usb/dwc3/trace.o
CC drivers/usb/dwc3/core.o
CC drivers/usb/core/sysfs.o
AR drivers/watchdog/built-in.a
CC drivers/usb/early/ehci-dbgp.o
AR drivers/tty/serial/8250/built-in.a
CC drivers/xen/xenfs/xenstored.o
CC drivers/usb/core/endpoint.o
CC drivers/usb/gadget/function/f_acm.o
CC drivers/scsi/sr.o
CC net/netfilter/nft_log.o
CC drivers/gpu/drm/i915/display/intel_connector.o
CC drivers/xen/xen-pciback/conf_space.o
AR net/sched/built-in.a
CC drivers/usb/core/devio.o
CC drivers/xen/xenfs/xensyms.o
CC drivers/xen/xen-pciback/conf_space_header.o
CC drivers/video/fbdev/core/softcursor.o
CC drivers/usb/core/notify.o
CC drivers/usb/host/pci-quirks.o
AR drivers/virtio/built-in.a
CC drivers/usb/host/ehci-hcd.o
CC drivers/usb/host/ehci-pci.o
CC drivers/usb/core/generic.o
CONMK drivers/tty/vt/consolemap_deftbl.c
CC drivers/scsi/sr_ioctl.o
CC drivers/usb/core/quirks.o
CC drivers/tty/vt/vt.o
CC drivers/xen/xenbus/xenbus_comms.o
SHIPPED drivers/tty/vt/defkeymap.c
CC net/netfilter/nft_masq.o
CC drivers/usb/core/devices.o
CC drivers/usb/core/phy.o
CC drivers/usb/gadget/legacy/multi.o
CC drivers/usb/misc/ezusb.o
CC drivers/xen/xen-pciback/conf_space_capability.o
CC net/netfilter/nft_redir.o
CC drivers/usb/core/port.o
CC drivers/tty/tty_baudrate.o
CC drivers/tty/tty_ldsem.o
CC drivers/usb/core/hcd-pci.o
CC drivers/usb/core/usb-acpi.o
CC net/netfilter/nft_hash.o
CC drivers/xen/xenbus/xenbus_xs.o
CC drivers/usb/gadget/function/u_serial.o
AR net/sunrpc/built-in.a
CC drivers/gpu/drm/i915/display/intel_display.o
CC drivers/xen/xenbus/xenbus_probe.o
CC drivers/xen/xenbus/xenbus_probe_backend.o
CC drivers/usb/mon/mon_main.o
CC drivers/gpu/drm/i915/display/intel_display_power.o
CC drivers/tty/vt/consolemap_deftbl.o
CC drivers/video/fbdev/core/tileblit.o
AR drivers/net/built-in.a
CC drivers/video/fbdev/core/cfbfillrect.o
CC net/netfilter/nft_fib.o
CC drivers/video/fbdev/core/cfbcopyarea.o
CC drivers/usb/dwc3/gadget.o
AR drivers/xen/xenfs/built-in.a
CC net/netfilter/nft_fib_inet.o
CC drivers/gpu/drm/i915/display/intel_dpio_phy.o
CC drivers/scsi/sr_vendor.o
CC net/netfilter/nft_fib_netdev.o
CC drivers/gpu/drm/i915/display/intel_dpll_mgr.o
AR drivers/usb/early/built-in.a
CC drivers/xen/xenbus/xenbus_dev_frontend.o
CC drivers/scsi/sg.o
CC drivers/tty/vt/defkeymap.o
CC drivers/usb/mon/mon_stat.o
CC drivers/usb/host/ohci-hcd.o
CC drivers/scsi/scsi_sysfs.o
CC drivers/usb/gadget/udc/core.o
CC drivers/video/fbdev/core/cfbimgblt.o
AR drivers/xen/events/built-in.a
CC drivers/xen/xen-pciback/conf_space_quirks.o
CC drivers/tty/tty_jobctrl.o
CC drivers/xen/xen-pciback/vpci.o
CC drivers/xen/cpu_hotplug.o
AR drivers/tty/serial/built-in.a
CC drivers/usb/gadget/function/u_ether.o
CC drivers/video/fbdev/core/sysfillrect.o
CC drivers/usb/phy/phy.o
CC drivers/usb/gadget/function/f_rndis.o
CC drivers/xen/xenbus/xenbus_dev_backend.o
CC drivers/xen/xenbus/xenbus_probe_frontend.o
CC drivers/gpu/drm/i915/display/intel_dsb.o
CC drivers/usb/roles/class.o
CC net/netfilter/nft_socket.o
CC drivers/video/fbdev/core/syscopyarea.o
CC net/netfilter/nft_osf.o
CC net/netfilter/nft_tproxy.o
CC drivers/usb/gadget/udc/trace.o
AR drivers/usb/gadget/legacy/built-in.a
AR drivers/usb/misc/built-in.a
CC drivers/xen/grant-table.o
CC drivers/usb/mon/mon_text.o
CC drivers/usb/mon/mon_bin.o
CC drivers/xen/balloon.o
CC drivers/xen/features.o
CC drivers/usb/gadget/function/rndis.o
CC net/netfilter/nft_xfrm.o
CC drivers/video/fbdev/core/sysimgblt.o
CC net/netfilter/nft_chain_nat.o
CC drivers/video/fbdev/core/fb_sys_fops.o
CC net/netfilter/nft_dup_netdev.o
CC drivers/usb/gadget/usbstring.o
CC drivers/tty/n_null.o
CC net/netfilter/nft_fwd_netdev.o
CC drivers/xen/xen-pciback/passthrough.o
CC drivers/usb/dwc3/ep0.o
CC drivers/tty/tty_audit.o
CC drivers/tty/pty.o
CC drivers/usb/dwc3/debugfs.o
CC net/netfilter/nf_flow_table_core.o
CC drivers/gpu/drm/i915/display/intel_fbc.o
CC drivers/gpu/drm/i915/display/intel_fifo_underrun.o
CC drivers/gpu/drm/i915/display/intel_frontbuffer.o
CC drivers/gpu/drm/i915/display/intel_hdcp.o
CC drivers/usb/phy/phy-generic.o
CC drivers/usb/dwc3/dwc3-pci.o
CC drivers/gpu/drm/i915/display/intel_hotplug.o
CC drivers/usb/dwc3/dwc3-haps.o
CC drivers/xen/manage.o
CC drivers/usb/host/ohci-pci.o
CC net/netfilter/nf_flow_table_ip.o
CC net/netfilter/nf_flow_table_offload.o
CC drivers/usb/gadget/config.o
CC drivers/tty/sysrq.o
AR drivers/usb/roles/built-in.a
CC drivers/usb/serial/usb-serial.o
CC drivers/usb/serial/generic.o
CC drivers/usb/serial/bus.o
AR drivers/usb/core/built-in.a
CC drivers/usb/serial/ch341.o
CC drivers/usb/serial/ftdi_sio.o
CC drivers/usb/serial/keyspan.o
CC drivers/usb/serial/cp210x.o
CC drivers/usb/gadget/function/f_mass_storage.o
CC drivers/usb/gadget/function/storage_common.o
CC drivers/xen/preempt.o
CC drivers/usb/gadget/epautoconf.o
CC drivers/usb/serial/option.o
CC drivers/usb/gadget/composite.o
CC drivers/tty/n_hdlc.o
CC drivers/gpu/drm/i915/display/intel_lpe_audio.o
CC drivers/xen/time.o
AR drivers/xen/xenbus/built-in.a
AR drivers/xen/xen-pciback/built-in.a
CC drivers/usb/gadget/function/f_fs.o
CC drivers/xen/mem-reservation.o
CC drivers/usb/host/uhci-hcd.o
AR drivers/usb/mon/built-in.a
CC drivers/xen/pci.o
CC drivers/usb/gadget/function/f_midi.o
AR drivers/video/fbdev/core/built-in.a
CC drivers/usb/gadget/functions.o
CC drivers/tty/ttynull.o
CC drivers/usb/host/xhci.o
AR drivers/video/fbdev/built-in.a
AR drivers/video/built-in.a
CC drivers/usb/gadget/configfs.o
CC drivers/usb/gadget/u_f.o
CC drivers/usb/serial/oti6858.o
CC drivers/usb/host/xhci-mem.o
CC drivers/usb/serial/pl2303.o
CC drivers/usb/storage/uas.o
AR drivers/usb/typec/altmodes/built-in.a
CC drivers/usb/usbip/usbip_common.o
CC drivers/xen/dbgp.o
AR drivers/usb/typec/mux/built-in.a
CC net/netfilter/nf_flow_table_inet.o
CC drivers/usb/typec/tcpm/tcpm.o
AR drivers/usb/gadget/udc/built-in.a
CC drivers/xen/acpi.o
CC drivers/usb/host/xhci-ext-caps.o
CC drivers/usb/host/xhci-hub.o
CC drivers/usb/host/xhci-ring.o
CC drivers/usb/usbip/usbip_event.o
CC net/netfilter/x_tables.o
AR drivers/usb/phy/built-in.a
CC drivers/xen/xen-acpi-pad.o
CC net/netfilter/xt_tcpudp.o
CC drivers/gpu/drm/i915/display/intel_overlay.o
CC drivers/gpu/drm/i915/display/intel_psr.o
CC drivers/xen/pcpu.o
CC drivers/usb/host/xhci-dbg.o
AR drivers/tty/vt/built-in.a
CC drivers/gpu/drm/i915/display/intel_quirks.o
CC drivers/usb/usbip/vhci_sysfs.o
CC drivers/gpu/drm/i915/display/intel_sprite.o
CC drivers/usb/storage/scsiglue.o
CC drivers/usb/storage/protocol.o
CC drivers/gpu/drm/i915/display/intel_vga.o
CC drivers/gpu/drm/i915/display/intel_tc.o
CC drivers/usb/storage/transport.o
CC drivers/usb/usbip/vhci_tx.o
CC drivers/usb/usbip/vhci_rx.o
CC drivers/usb/storage/initializers.o
CC drivers/usb/storage/usb.o
CC drivers/usb/serial/qcserial.o
CC drivers/usb/storage/sierra_ms.o
AR drivers/usb/dwc3/built-in.a
CC drivers/usb/serial/sierra.o
CC net/netfilter/xt_mark.o
CC drivers/gpu/drm/i915/display/intel_acpi.o
CC net/netfilter/xt_connmark.o
CC drivers/usb/host/xhci-trace.o
CC drivers/usb/serial/usb-serial-simple.o
CC drivers/gpu/drm/i915/display/intel_opregion.o
CC drivers/usb/host/xhci-pci.o
CC drivers/usb/serial/usb_wwan.o
CC drivers/usb/host/xhci-debugfs.o
CC drivers/xen/biomerge.o
CC drivers/xen/xen-balloon.o
CC net/netfilter/xt_set.o
CC drivers/usb/typec/ucsi/ucsi.o
CC drivers/usb/typec/ucsi/trace.o
CC net/netfilter/xt_nat.o
CC net/netfilter/xt_AUDIT.o
AR drivers/tty/built-in.a
CC drivers/usb/typec/ucsi/ucsi_acpi.o
CC drivers/usb/usbip/vhci_hcd.o
CC drivers/usb/typec/class.o
CC net/netfilter/xt_CHECKSUM.o
CC drivers/usb/usbip/stub_dev.o
CC drivers/usb/typec/mux.o
CC drivers/usb/storage/option_ms.o
CC drivers/usb/host/xhci-plat.o
CC drivers/gpu/drm/i915/display/intel_fbdev.o
CC drivers/usb/storage/usual-tables.o
CC drivers/xen/evtchn.o
CC drivers/usb/usbip/stub_main.o
AR drivers/scsi/built-in.a
CC drivers/xen/gntdev.o
CC drivers/gpu/drm/i915/display/dvo_ch7017.o
CC drivers/usb/storage/realtek_cr.o
CC drivers/gpu/drm/i915/display/dvo_ch7xxx.o
CC net/netfilter/xt_CLASSIFY.o
CC drivers/xen/gntalloc.o
CC drivers/xen/sys-hypervisor.o
CC drivers/gpu/drm/i915/display/dvo_ivch.o
CC net/netfilter/xt_CONNSECMARK.o
CC net/netfilter/xt_CT.o
CC drivers/usb/typec/bus.o
CC drivers/xen/platform-pci.o
CC net/netfilter/xt_DSCP.o
CC net/netfilter/xt_HMARK.o
CC net/netfilter/xt_HL.o
CC drivers/usb/usbip/stub_rx.o
CC drivers/usb/usbip/stub_tx.o
CC drivers/xen/swiotlb-xen.o
CC drivers/xen/mcelog.o
CC drivers/gpu/drm/i915/display/dvo_ns2501.o
CC drivers/gpu/drm/i915/display/dvo_sil164.o
CC drivers/gpu/drm/i915/display/dvo_tfp410.o
CC drivers/xen/privcmd.o
CC drivers/gpu/drm/i915/display/icl_dsi.o
CC drivers/xen/privcmd-buf.o
CC net/netfilter/xt_LED.o
CC drivers/xen/xen-acpi-processor.o
CC drivers/xen/efi.o
CC drivers/xen/xlate_mmu.o
CC drivers/xen/pvcalls-back.o
CC drivers/gpu/drm/i915/display/intel_crt.o
CC drivers/usb/usbip/vudc_dev.o
CC drivers/usb/usbip/vudc_sysfs.o
CC drivers/xen/pvcalls-front.o
CC drivers/usb/usbip/vudc_tx.o
CC drivers/xen/xen-front-pgdir-shbuf.o
CC drivers/usb/usbip/vudc_rx.o
CC drivers/gpu/drm/i915/display/intel_ddi.o
CC drivers/usb/usbip/vudc_transfer.o
CC net/netfilter/xt_LOG.o
CC drivers/gpu/drm/i915/display/intel_dp.o
CC drivers/usb/usbip/vudc_main.o
AR drivers/usb/serial/built-in.a
CC net/netfilter/xt_NETMAP.o
CC net/netfilter/xt_NFLOG.o
CC drivers/gpu/drm/i915/display/intel_dp_aux_backlight.o
AR drivers/usb/typec/ucsi/built-in.a
CC drivers/gpu/drm/i915/display/intel_dp_link_training.o
CC net/netfilter/xt_NFQUEUE.o
CC drivers/gpu/drm/i915/display/intel_dp_mst.o
CC drivers/gpu/drm/i915/display/intel_dsi.o
CC net/netfilter/xt_RATEEST.o
CC drivers/gpu/drm/i915/display/intel_dsi_dcs_backlight.o
CC net/netfilter/xt_REDIRECT.o
AR drivers/usb/gadget/function/built-in.a
AR drivers/usb/storage/built-in.a
AR drivers/usb/gadget/built-in.a
CC drivers/gpu/drm/i915/display/intel_dsi_vbt.o
CC drivers/gpu/drm/i915/display/intel_dvo.o
CC net/netfilter/xt_MASQUERADE.o
CC drivers/gpu/drm/i915/display/intel_hdmi.o
CC drivers/gpu/drm/i915/display/intel_gmbus.o
CC net/netfilter/xt_SECMARK.o
CC net/netfilter/xt_TPROXY.o
CC net/netfilter/xt_TCPMSS.o
CC net/netfilter/xt_TCPOPTSTRIP.o
CC net/netfilter/xt_TRACE.o
CC net/netfilter/xt_TEE.o
CC net/netfilter/xt_IDLETIMER.o
CC net/netfilter/xt_addrtype.o
CC drivers/gpu/drm/i915/display/intel_lspcon.o
CC net/netfilter/xt_cluster.o
CC net/netfilter/xt_bpf.o
CC net/netfilter/xt_comment.o
CC drivers/gpu/drm/i915/display/intel_lvds.o
CC drivers/gpu/drm/i915/display/intel_panel.o
CC net/netfilter/xt_connbytes.o
CC drivers/gpu/drm/i915/display/intel_sdvo.o
CC net/netfilter/xt_conntrack.o
CC net/netfilter/xt_connlabel.o
CC drivers/gpu/drm/i915/display/intel_tv.o
CC net/netfilter/xt_connlimit.o
AR drivers/usb/typec/tcpm/built-in.a
AR drivers/usb/typec/built-in.a
CC net/netfilter/xt_cpu.o
CC drivers/gpu/drm/i915/display/intel_vdsc.o
CC drivers/gpu/drm/i915/display/vlv_dsi.o
CC net/netfilter/xt_dccp.o
CC net/netfilter/xt_devgroup.o
CC net/netfilter/xt_dscp.o
CC drivers/gpu/drm/i915/display/vlv_dsi_pll.o
CC net/netfilter/xt_ecn.o
CC drivers/gpu/drm/i915/oa/i915_oa_bdw.o
CC drivers/gpu/drm/i915/oa/i915_oa_hsw.o
CC net/netfilter/xt_esp.o
CC net/netfilter/xt_hashlimit.o
CC net/netfilter/xt_helper.o
CC drivers/gpu/drm/i915/oa/i915_oa_chv.o
CC drivers/gpu/drm/i915/oa/i915_oa_sklgt3.o
CC drivers/gpu/drm/i915/oa/i915_oa_sklgt2.o
CC drivers/gpu/drm/i915/oa/i915_oa_bxt.o
CC drivers/gpu/drm/i915/oa/i915_oa_sklgt4.o
CC net/netfilter/xt_hl.o
CC drivers/gpu/drm/i915/oa/i915_oa_kblgt2.o
AR drivers/usb/usbip/built-in.a
CC net/netfilter/xt_ipcomp.o
AR drivers/usb/host/built-in.a
AR drivers/usb/built-in.a
CC drivers/gpu/drm/i915/oa/i915_oa_kblgt3.o
CC net/netfilter/xt_iprange.o
CC net/netfilter/xt_ipvs.o
CC drivers/gpu/drm/i915/oa/i915_oa_glk.o
CC net/netfilter/xt_l2tp.o
CC net/netfilter/xt_length.o
CC drivers/gpu/drm/i915/oa/i915_oa_cflgt2.o
CC drivers/gpu/drm/i915/oa/i915_oa_cflgt3.o
CC net/netfilter/xt_limit.o
CC net/netfilter/xt_mac.o
CC drivers/gpu/drm/i915/oa/i915_oa_cnl.o
CC net/netfilter/xt_multiport.o
CC drivers/gpu/drm/i915/oa/i915_oa_icl.o
CC drivers/gpu/drm/i915/oa/i915_oa_tgl.o
CC drivers/gpu/drm/i915/i915_perf.o
CC net/netfilter/xt_nfacct.o
CC drivers/gpu/drm/i915/i915_gpu_error.o
CC net/netfilter/xt_osf.o
CC net/netfilter/xt_owner.o
CC net/netfilter/xt_physdev.o
CC drivers/gpu/drm/i915/i915_vgpu.o
CC net/netfilter/xt_cgroup.o
CC net/netfilter/xt_pkttype.o
CC net/netfilter/xt_policy.o
CC net/netfilter/xt_quota.o
CC net/netfilter/xt_rateest.o
CC net/netfilter/xt_realm.o
AR drivers/xen/built-in.a
CC net/netfilter/xt_recent.o
CC net/netfilter/xt_sctp.o
CC net/netfilter/xt_socket.o
CC net/netfilter/xt_state.o
CC net/netfilter/xt_statistic.o
CC net/netfilter/xt_string.o
CC net/netfilter/xt_tcpmss.o
CC net/netfilter/xt_time.o
CC net/netfilter/xt_u32.o
AR net/netfilter/built-in.a
AR net/built-in.a
AR drivers/gpu/drm/i915/built-in.a
AR drivers/gpu/drm/built-in.a
AR drivers/gpu/built-in.a
AR drivers/built-in.a


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=10df6fdae00000


Tested on:

commit: 687dec9b Merge tag 'erofs-for-5.5-rc2-fixes' of git://git...
git tree:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

dashboard link: https://syzkaller.appspot.com/bug?extid=1c6756baf4b16b94d2a6
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=1593a20ae00000

[Randy Dunlap]

From: Randy Dunlap <rdu...@infradead.org>

fill_super() conditionally allocates a jdev string if "jdev=x"
is specified. put_super() should free that memory.

Reported-by: syzbot+1c6756...@syzkaller.appspotmail.com
Signed-off-by: Randy Dunlap <rdu...@infradead.org>
---
fs/reiserfs/super.c | 1 +
1 file changed, 1 insertion(+)

--- linux-next-20191213.orig/fs/reiserfs/super.c
+++ linux-next-20191213/fs/reiserfs/super.c
@@ -629,6 +629,7 @@ static void reiserfs_put_super(struct su
reiserfs_write_unlock(s);
mutex_destroy(&REISERFS_SB(s)->lock);
destroy_workqueue(REISERFS_SB(s)->commit_wq);
+ kfree(REISERFS_SB(s)->s_jdev);
kfree(s->s_fs_info);
s->s_fs_info = NULL;
}

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger
crash:

Reported-and-tested-by:
syzbot+1c6756...@syzkaller.appspotmail.com

Tested on:

commit: 687dec9b Merge tag 'erofs-for-5.5-rc2-fixes' of git://git...
git tree:
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

kernel config: https://syzkaller.appspot.com/x/.config?x=bbf3a35184a3ed64

dashboard link: https://syzkaller.appspot.com/bug?extid=1c6756baf4b16b94d2a6
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=15895c99e00000

Note: testing is done by a robot and is best-effort only.

[Jan Kara]

On Sat 14-12-19 15:12:57, Randy Dunlap wrote:
> From: Randy Dunlap <rdu...@infradead.org>
>
> fill_super() conditionally allocates a jdev string if "jdev=x"
> is specified. put_super() should free that memory.
>
> Reported-by: syzbot+1c6756...@syzkaller.appspotmail.com
> Signed-off-by: Randy Dunlap <rdu...@infradead.org>

Thanks Randy but I've already sent a similar (and more complete) fix to this
bug as part of [1].

Honza

[1] https://lore.kernel.org/linux-fsdevel/201912121050...@suse.cz/

> ---
> fs/reiserfs/super.c | 1 +
> 1 file changed, 1 insertion(+)
>
> --- linux-next-20191213.orig/fs/reiserfs/super.c
> +++ linux-next-20191213/fs/reiserfs/super.c
> @@ -629,6 +629,7 @@ static void reiserfs_put_super(struct su
> reiserfs_write_unlock(s);
> mutex_destroy(&REISERFS_SB(s)->lock);
> destroy_workqueue(REISERFS_SB(s)->commit_wq);
> + kfree(REISERFS_SB(s)->s_jdev);
> kfree(s->s_fs_info);
> s->s_fs_info = NULL;
> }
>

--
Jan Kara <ja...@suse.com>
SUSE Labs, CR