memory leak in v9fs_session_init

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: abdfd52a Merge tag 'armsoc-defconfig' of git://git.kernel...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=163046afa00000
kernel config: https://syzkaller.appspot.com/x/.config?x=d31de3d88059b7fa
dashboard link: https://syzkaller.appspot.com/bug?extid=15b759334fd44cd9785a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735466c600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117e0cf0600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+15b759...@syzkaller.appspotmail.com

BUG: memory leak
unreferenced object 0xffff88811181c360 (size 32):
comm "syz-executor114", pid 7075, jiffies 4294946393 (age 16.360s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 46 04 00 ea ff ff 80 4a 46 04 00 ea ff ff r.F......JF.....
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109294a0 (size 32):
comm "syz-executor114", pid 7076, jiffies 4294946394 (age 16.350s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888110929b40 (size 32):
comm "syz-executor114", pid 7080, jiffies 4294946394 (age 16.350s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109292a0 (size 32):
comm "syz-executor114", pid 7081, jiffies 4294946395 (age 16.340s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 6b 65 72 6e 65 6c 5f 74 3a 73 30 00 00 00 r.kernel_t:s0...
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811181c360 (size 32):
comm "syz-executor114", pid 7075, jiffies 4294946393 (age 16.410s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 46 04 00 ea ff ff 80 4a 46 04 00 ea ff ff r.F......JF.....
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109294a0 (size 32):
comm "syz-executor114", pid 7076, jiffies 4294946394 (age 16.400s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888110929b40 (size 32):
comm "syz-executor114", pid 7080, jiffies 4294946394 (age 16.400s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109292a0 (size 32):
comm "syz-executor114", pid 7081, jiffies 4294946395 (age 16.390s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 6b 65 72 6e 65 6c 5f 74 3a 73 30 00 00 00 r.kernel_t:s0...
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811181c360 (size 32):
comm "syz-executor114", pid 7075, jiffies 4294946393 (age 17.280s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 46 04 00 ea ff ff 80 4a 46 04 00 ea ff ff r.F......JF.....
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109294a0 (size 32):
comm "syz-executor114", pid 7076, jiffies 4294946394 (age 17.270s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888110929b40 (size 32):
comm "syz-executor114", pid 7080, jiffies 4294946394 (age 17.270s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109292a0 (size 32):
comm "syz-executor114", pid 7081, jiffies 4294946395 (age 17.260s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 6b 65 72 6e 65 6c 5f 74 3a 73 30 00 00 00 r.kernel_t:s0...
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811181c360 (size 32):
comm "syz-executor114", pid 7075, jiffies 4294946393 (age 18.150s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 46 04 00 ea ff ff 80 4a 46 04 00 ea ff ff r.F......JF.....
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109294a0 (size 32):
comm "syz-executor114", pid 7076, jiffies 4294946394 (age 18.140s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888110929b40 (size 32):
comm "syz-executor114", pid 7080, jiffies 4294946394 (age 18.140s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109292a0 (size 32):
comm "syz-executor114", pid 7081, jiffies 4294946395 (age 18.130s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 6b 65 72 6e 65 6c 5f 74 3a 73 30 00 00 00 r.kernel_t:s0...
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811181c360 (size 32):
comm "syz-executor114", pid 7075, jiffies 4294946393 (age 19.020s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 46 04 00 ea ff ff 80 4a 46 04 00 ea ff ff r.F......JF.....
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109294a0 (size 32):
comm "syz-executor114", pid 7076, jiffies 4294946394 (age 19.010s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888110929b40 (size 32):
comm "syz-executor114", pid 7080, jiffies 4294946394 (age 19.010s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109292a0 (size 32):
comm "syz-executor114", pid 7081, jiffies 4294946395 (age 19.000s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 6b 65 72 6e 65 6c 5f 74 3a 73 30 00 00 00 r.kernel_t:s0...
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff88811181c360 (size 32):
comm "syz-executor114", pid 7075, jiffies 4294946393 (age 19.070s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 46 04 00 ea ff ff 80 4a 46 04 00 ea ff ff r.F......JF.....
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109294a0 (size 32):
comm "syz-executor114", pid 7076, jiffies 4294946394 (age 19.060s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff888110929b40 (size 32):
comm "syz-executor114", pid 7080, jiffies 4294946394 (age 19.060s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 r...............
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

BUG: memory leak
unreferenced object 0xffff8881109292a0 (size 32):
comm "syz-executor114", pid 7081, jiffies 4294946395 (age 19.050s)
hex dump (first 32 bytes):
77 66 64 6e 6f 25 61 63 63 65 73 73 3d 75 73 65 wfdno%access=use
72 00 6b 65 72 6e 65 6c 5f 74 3a 73 30 00 00 00 r.kernel_t:s0...
backtrace:
[<00000000830cd797>] kmemleak_alloc_recursive
/./include/linux/kmemleak.h:43 [inline]
[<00000000830cd797>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<00000000830cd797>] slab_alloc /mm/slab.c:3319 [inline]
[<00000000830cd797>] __do_kmalloc /mm/slab.c:3653 [inline]
[<00000000830cd797>] __kmalloc_track_caller+0x165/0x300 /mm/slab.c:3670
[<000000004c2bde0e>] kmemdup_nul+0x31/0x80 /mm/util.c:143
[<00000000d3b2a6b1>] match_strdup+0x21/0x30 /lib/parser.c:322
[<00000000cb5a9103>] v9fs_parse_options /fs/9p/v9fs.c:281 [inline]
[<00000000cb5a9103>] v9fs_session_init+0x29e/0x880 /fs/9p/v9fs.c:422
[<0000000060a9624b>] v9fs_mount+0x5e/0x3a0 /fs/9p/vfs_super.c:120
[<0000000045c47d3a>] legacy_get_tree+0x27/0x80 /fs/fs_context.c:661
[<00000000966bd655>] vfs_get_tree+0x2e/0x110 /fs/super.c:1416
[<000000004bdabb83>] do_new_mount /fs/namespace.c:2795 [inline]
[<000000004bdabb83>] do_mount+0x94e/0xc70 /fs/namespace.c:3115
[<000000008f276989>] ksys_mount+0xab/0x120 /fs/namespace.c:3324
[<000000003dd28c22>] __do_sys_mount /fs/namespace.c:3338 [inline]
[<000000003dd28c22>] __se_sys_mount /fs/namespace.c:3335 [inline]
[<000000003dd28c22>] __x64_sys_mount+0x26/0x30 /fs/namespace.c:3335
[<00000000b6179601>] do_syscall_64+0x76/0x1a0
/arch/x86/entry/common.c:296
[<000000005924437c>] entry_SYSCALL_64_after_hwframe+0x44/0xa9

executing program
executing program


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches

[Dmitry Vyukov]

On Wed, Jul 24, 2019 at 2:08 PM syzbot
<syzbot+15b759...@syzkaller.appspotmail.com> wrote:
>
> Hello,
>
> syzbot found the following crash on:
>
> HEAD commit: abdfd52a Merge tag 'armsoc-defconfig' of git://git.kernel...
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=163046afa00000
> kernel config: https://syzkaller.appspot.com/x/.config?x=d31de3d88059b7fa
> dashboard link: https://syzkaller.appspot.com/bug?extid=15b759334fd44cd9785a
> compiler: gcc (GCC) 9.0.0 20181231 (experimental)
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735466c600000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117e0cf0600000
>
> IMPORTANT: if you fix the bug, please add the following tag to the commit:
> Reported-by: syzbot+15b759...@syzkaller.appspotmail.com

+fs/9p/v9fs.c maintainers

> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bug...@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/00000000000070c81a058e6c2917%40google.com.

[syzbot]

syzbot has bisected this bug to:

commit 16490980e396fac079248b23b1dd81e7d48bebf3
Author: Linus Torvalds <torv...@linux-foundation.org>
Date: Tue May 17 02:51:04 2016 +0000

Merge tag 'device-properties-4.7-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=115e94cc600000
start commit: abdfd52a Merge tag 'armsoc-defconfig' of git://git.kernel...
git tree: upstream
final crash: https://syzkaller.appspot.com/x/report.txt?x=135e94cc600000
console output: https://syzkaller.appspot.com/x/log.txt?x=155e94cc600000

kernel config: https://syzkaller.appspot.com/x/.config?x=d31de3d88059b7fa
dashboard link: https://syzkaller.appspot.com/bug?extid=15b759334fd44cd9785a

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735466c600000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=117e0cf0600000

Reported-by: syzbot+15b759...@syzkaller.appspotmail.com
Fixes: 16490980e396 ("Merge tag 'device-properties-4.7-rc1' of
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

[Rikard Falkeborn]

Syzbot reports memory leaks of v9fs->cachetag. The leaks are always
preceded by a "Duplicate cookie detected" printout from
fscache_acquire_cookie(), which returns NULL if a duplicate cookie is
detected.

If this happens, v9fs->fscache is NULL but v9fs->cachetag must still be
freed, since it is dynamically allocated in either v9fs_parse_options()
or v9fs_random_cachetag().

To fix this, we need to unconditionally free v9fs->cachetag.

There was a previous attempt to fix the memory leak done in
commit 962a991c5de1 ("9p/cache.c: Fix memory leak in
v9fs_cache_session_get_cookie") but that commit was incomplete, since it
did not take fscache_acquire_cookie() returning NULL into account.

Fixes: 60e78d2c993e ("9p: Add fscache support to 9p")
Reported-by: syzbot+f577fd...@syzkaller.appspotmail.com
Reported-by: syzbot+15b759...@syzkaller.appspotmail.com
Signed-off-by: Rikard Falkeborn <rikard.f...@gmail.com>
---
I'm sending this out for syzbot testing, I'll resend with the proper
recipients after syzbot has tested it.

fs/9p/v9fs.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 15a99f9c7253..39def020a074 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -500,10 +500,9 @@ void v9fs_session_close(struct v9fs_session_info *v9ses)
}

#ifdef CONFIG_9P_FSCACHE
- if (v9ses->fscache) {
+ if (v9ses->fscache)
v9fs_cache_session_put_cookie(v9ses);
- kfree(v9ses->cachetag);
- }
+ kfree(v9ses->cachetag);
#endif
kfree(v9ses->uname);
kfree(v9ses->aname);
--
2.26.0

[Rikard Falkeborn]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer still triggered crash:
no output from test machine



Tested on:

commit: ae46d2aa mm/gup: Let __get_user_pages_locked() return -EIN..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1197e657e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a8663b8b0701983

dashboard link: https://syzkaller.appspot.com/bug?extid=15b759334fd44cd9785a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=15cadcede00000

[Rikard Falkeborn]

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer still triggered crash:
no output from test machine



Tested on:

commit: ae46d2aa mm/gup: Let __get_user_pages_locked() return -EIN..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=15de6e57e00000

kernel config: https://syzkaller.appspot.com/x/.config?x=4a8663b8b0701983
dashboard link: https://syzkaller.appspot.com/bug?extid=15b759334fd44cd9785a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=14de6e57e00000

[Rikard Falkeborn]

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.6

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer still triggered crash:
no output from test machine



Tested on:

commit: 7111951b Linux 5.6
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git v5.6
console output: https://syzkaller.appspot.com/x/log.txt?x=162ed61be00000
kernel config: https://syzkaller.appspot.com/x/.config?x=be85e2815b5a36e7

dashboard link: https://syzkaller.appspot.com/bug?extid=15b759334fd44cd9785a
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

patch: https://syzkaller.appspot.com/x/patch.diff?x=12aab43be00000

[syzbot]

Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.