linux-fsdevel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ian Kent <raven@themaw.net>
To: Al Viro <viro@zeniv.linux.org.uk>,
	syzbot <syzbot+5399ed0832693e29f392@syzkaller.appspotmail.com>,
	Andrew Morton <akpm@linux-foundation.org>,
	DmitryVyukov <dvyukov@google.com>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: kernel BUG at fs/inode.c:LINE!
Date: Tue, 18 Dec 2018 18:42:35 +0800	[thread overview]
Message-ID: <95ae4c9893c89189d4309fe673ade6f389280101.camel@themaw.net> (raw)
In-Reply-To: <20181217072144.GQ2217@ZenIV.linux.org.uk>

On Mon, 2018-12-17 at 07:21 +0000, Al Viro wrote:
> On Sun, Dec 16, 2018 at 10:11:04PM -0800, syzbot wrote:
> > Hello,
> > 
> > syzbot found the following crash on:
> > 
> > HEAD commit:    d14b746c6c1c Add linux-next specific files for 20181214
> > git tree:       linux-next
> > console output: https://syzkaller.appspot.com/x/log.txt?x=13706347400000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=1da6d2d18f803140
> > dashboard link: https://syzkaller.appspot.com/bug?extid=5399ed0832693e29f392
> > compiler:       gcc (GCC) 8.0.1 20180413 (experimental)
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=101032b3400000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16534063400000
> > 
> > IMPORTANT: if you fix the bug, please add the following tag to the commit:
> > Reported-by: syzbot+5399ed0832693e29f392@syzkaller.appspotmail.com
> > 
> >  slab_pre_alloc_hook mm/slab.h:423 [inline]
> >  slab_alloc mm/slab.c:3365 [inline]
> >  kmem_cache_alloc+0x2c4/0x730 mm/slab.c:3539
> >  __d_alloc+0xc8/0xb90 fs/dcache.c:1599
> > ------------[ cut here ]------------
> > kernel BUG at fs/inode.c:1566!
> >  d_alloc_anon fs/dcache.c:1698 [inline]
> >  d_make_root+0x43/0xc0 fs/dcache.c:1885
> >  autofs_fill_super+0x6f1/0x1c30 fs/autofs/inode.c:273
> 
> Huh?  BUG is in iput(), AFAICS, so the stack trace is rather misreported.
> iput() can be called by d_make_root(), provided that dentry allocation
> fails.  So the most straightforward interpretation would be that we
> had an allocation failure (injected?), followed by iput() of the inode
> passed to d_make_root().  Which happened to find I_CLEAR in ->i_state
> of that inode somehow, which should be impossible short of seriously
> buggered inode refcounting somewhere - the inode has just been returned
> by new_inode(), which clears i_state, and it would have to have passed
> clear_inode() (i.e. has been through inode eviction) since then...

Sorry Al, that's my bad.

See https://www.ozlabs.org/~akpm/mmotm/broken-out/autofs-fix-possible-inode-leak-in-autofs_fill_super.patch

I think this will fix it, I'll forward it to Andrew if you agree:

autofs - fix handling of d_make_root() return in autofs_fill_super()

From: Ian Kent <raven@themaw.net>

A previous change to handle a possible inode leak in autofs_fill_super()
added an iput() on d_make_root() failure but d_make_root() already puts
the passed in inode on failure.

Reported-by: syzbot+5399ed0832693e29f392@syzkaller.appspotmail.com
Signed-off-by: Ian Kent <raven@themaw.net>
---
 fs/autofs/inode.c |    4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 501833cc49a8..953f76b95172 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -271,7 +271,7 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
 	}
 	root = d_make_root(root_inode);
 	if (!root)
-		goto fail_iput;
+		goto fail_ino;
 	pipe = NULL;
 
 	root->d_fsdata = ino;
@@ -347,8 +347,6 @@ int autofs_fill_super(struct super_block *s, void *data, int silent)
 fail_dput:
 	dput(root);
 	goto fail_free;
-fail_iput:
-	iput(root_inode);
 fail_ino:
 	autofs_free_ino(ino);
 fail_free:

  parent reply	other threads:[~2018-12-18 10:42 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-17  6:11 kernel BUG at fs/inode.c:LINE! syzbot
2018-12-17  7:21 ` Al Viro
2018-12-17 10:08   ` Dmitry Vyukov
2018-12-18 10:40     ` Tetsuo Handa
2018-12-18 10:42   ` Ian Kent [this message]
2018-12-18 11:01     ` Amir Goldstein
2018-12-18 11:52       ` Ian Kent
2018-12-18 11:34     ` Ian Kent
2018-12-18 12:27       ` Dmitry Vyukov
2018-12-18 12:42         ` Ian Kent
2018-12-18 13:19           ` Dmitry Vyukov
2018-12-18 14:40             ` Ian Kent
2018-12-18 21:09       ` Andrew Morton
2018-12-19  0:05         ` Ian Kent
2018-12-18 13:51     ` Al Viro
2019-04-09 14:36 ` syzbot
2019-04-10  0:26   ` Al Viro
2019-04-10  8:27     ` Dmitry Vyukov
2019-04-10 10:35       ` Ian Kent
2019-04-10 11:40         ` Dmitry Vyukov
2019-04-10 11:57           ` Ian Kent
2019-04-10 12:02             ` Dmitry Vyukov
2019-04-10 12:03               ` Dmitry Vyukov
2019-04-10 12:07             ` Ian Kent
2019-04-10 12:11               ` Al Viro
2019-04-10 12:41                 ` Dmitry Vyukov
2019-04-11  0:50                   ` Ian Kent
2019-04-11  2:22                     ` Al Viro
2019-04-12 11:04                       ` Dmitry Vyukov
2019-04-12 19:46                         ` Eric Biggers
2019-04-12 10:59                     ` Dmitry Vyukov
2019-04-12 19:19                       ` Al Viro
2019-04-10 12:39               ` Dmitry Vyukov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=95ae4c9893c89189d4309fe673ade6f389280101.camel@themaw.net \
    --to=raven@themaw.net \
    --cc=akpm@linux-foundation.org \
    --cc=dvyukov@google.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=syzbot+5399ed0832693e29f392@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).