* [PATCH AUTOSEL 4.4 2/8] ceph: lockdep annotations for try_nonblocking_invalidate
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
@ 2021-09-13 22:35 ` Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 3/8] nilfs2: fix memory leak in nilfs_sysfs_create_device_group Sasha Levin
` (5 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:35 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Jeff Layton, Ilya Dryomov, Sasha Levin, ceph-devel
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 3eaf5aa1cfa8c97c72f5824e2e9263d6cc977b03 ]
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/caps.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 9d74cd37b395..154c47282a34 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1545,6 +1545,8 @@ static int __mark_caps_flushing(struct inode *inode,
* try to invalidate mapping pages without blocking.
*/
static int try_nonblocking_invalidate(struct inode *inode)
+ __releases(ci->i_ceph_lock)
+ __acquires(ci->i_ceph_lock)
{
struct ceph_inode_info *ci = ceph_inode(inode);
u32 invalidating_gen = ci->i_rdcache_gen;
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 4.4 3/8] nilfs2: fix memory leak in nilfs_sysfs_create_device_group
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 2/8] ceph: lockdep annotations for try_nonblocking_invalidate Sasha Levin
@ 2021-09-13 22:35 ` Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 4/8] nilfs2: fix NULL pointer in nilfs_##name##_attr_release Sasha Levin
` (4 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nanyong Sun, Hulk Robot, Ryusuke Konishi, Andrew Morton,
Linus Torvalds, Sasha Levin, linux-nilfs
From: Nanyong Sun <sunnanyong@huawei.com>
[ Upstream commit 5f5dec07aca7067216ed4c1342e464e7307a9197 ]
Patch series "nilfs2: fix incorrect usage of kobject".
This patchset from Nanyong Sun fixes memory leak issues and a NULL
pointer dereference issue caused by incorrect usage of kboject in nilfs2
sysfs implementation.
This patch (of 6):
Reported by syzkaller:
BUG: memory leak
unreferenced object 0xffff888100ca8988 (size 8):
comm "syz-executor.1", pid 1930, jiffies 4294745569 (age 18.052s)
hex dump (first 8 bytes):
6c 6f 6f 70 31 00 ff ff loop1...
backtrace:
kstrdup+0x36/0x70 mm/util.c:60
kstrdup_const+0x35/0x60 mm/util.c:83
kvasprintf_const+0xf1/0x180 lib/kasprintf.c:48
kobject_set_name_vargs+0x56/0x150 lib/kobject.c:289
kobject_add_varg lib/kobject.c:384 [inline]
kobject_init_and_add+0xc9/0x150 lib/kobject.c:473
nilfs_sysfs_create_device_group+0x150/0x7d0 fs/nilfs2/sysfs.c:986
init_nilfs+0xa21/0xea0 fs/nilfs2/the_nilfs.c:637
nilfs_fill_super fs/nilfs2/super.c:1046 [inline]
nilfs_mount+0x7b4/0xe80 fs/nilfs2/super.c:1316
legacy_get_tree+0x105/0x210 fs/fs_context.c:592
vfs_get_tree+0x8e/0x2d0 fs/super.c:1498
do_new_mount fs/namespace.c:2905 [inline]
path_mount+0xf9b/0x1990 fs/namespace.c:3235
do_mount+0xea/0x100 fs/namespace.c:3248
__do_sys_mount fs/namespace.c:3456 [inline]
__se_sys_mount fs/namespace.c:3433 [inline]
__x64_sys_mount+0x14b/0x1f0 fs/namespace.c:3433
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
If kobject_init_and_add return with error, then the cleanup of kobject
is needed because memory may be allocated in kobject_init_and_add
without freeing.
And the place of cleanup_dev_kobject should use kobject_put to free the
memory associated with the kobject. As the section "Kobject removal" of
"Documentation/core-api/kobject.rst" says, kobject_del() just makes the
kobject "invisible", but it is not cleaned up. And no more cleanup will
do after cleanup_dev_kobject, so kobject_put is needed here.
Link: https://lkml.kernel.org/r/1625651306-10829-1-git-send-email-konishi.ryusuke@gmail.com
Link: https://lkml.kernel.org/r/1625651306-10829-2-git-send-email-konishi.ryusuke@gmail.com
Reported-by: Hulk Robot <hulkci@huawei.com>
Link: https://lkml.kernel.org/r/20210629022556.3985106-2-sunnanyong@huawei.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index c3b629eec294..69a8f302170e 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -1008,7 +1008,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
err = kobject_init_and_add(&nilfs->ns_dev_kobj, &nilfs_dev_ktype, NULL,
"%s", sb->s_id);
if (err)
- goto free_dev_subgroups;
+ goto cleanup_dev_kobject;
err = nilfs_sysfs_create_mounted_snapshots_group(nilfs);
if (err)
@@ -1045,9 +1045,7 @@ int nilfs_sysfs_create_device_group(struct super_block *sb)
nilfs_sysfs_delete_mounted_snapshots_group(nilfs);
cleanup_dev_kobject:
- kobject_del(&nilfs->ns_dev_kobj);
-
-free_dev_subgroups:
+ kobject_put(&nilfs->ns_dev_kobj);
kfree(nilfs->ns_dev_subgroups);
failed_create_device_group:
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 4.4 4/8] nilfs2: fix NULL pointer in nilfs_##name##_attr_release
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 2/8] ceph: lockdep annotations for try_nonblocking_invalidate Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 3/8] nilfs2: fix memory leak in nilfs_sysfs_create_device_group Sasha Levin
@ 2021-09-13 22:35 ` Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 5/8] nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group Sasha Levin
` (3 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nanyong Sun, Ryusuke Konishi, Andrew Morton, Linus Torvalds,
Sasha Levin, linux-nilfs
From: Nanyong Sun <sunnanyong@huawei.com>
[ Upstream commit dbc6e7d44a514f231a64d9d5676e001b660b6448 ]
In nilfs_##name##_attr_release, kobj->parent should not be referenced
because it is a NULL pointer. The release() method of kobject is always
called in kobject_put(kobj), in the implementation of kobject_put(), the
kobj->parent will be assigned as NULL before call the release() method.
So just use kobj to get the subgroups, which is more efficient and can fix
a NULL pointer reference problem.
Link: https://lkml.kernel.org/r/20210629022556.3985106-3-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-3-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 69a8f302170e..d7d6791c408e 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -73,11 +73,9 @@ static const struct sysfs_ops nilfs_##name##_attr_ops = { \
#define NILFS_DEV_INT_GROUP_TYPE(name, parent_name) \
static void nilfs_##name##_attr_release(struct kobject *kobj) \
{ \
- struct nilfs_sysfs_##parent_name##_subgroups *subgroups; \
- struct the_nilfs *nilfs = container_of(kobj->parent, \
- struct the_nilfs, \
- ns_##parent_name##_kobj); \
- subgroups = nilfs->ns_##parent_name##_subgroups; \
+ struct nilfs_sysfs_##parent_name##_subgroups *subgroups = container_of(kobj, \
+ struct nilfs_sysfs_##parent_name##_subgroups, \
+ sg_##name##_kobj); \
complete(&subgroups->sg_##name##_kobj_unregister); \
} \
static struct kobj_type nilfs_##name##_ktype = { \
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 4.4 5/8] nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
` (2 preceding siblings ...)
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 4/8] nilfs2: fix NULL pointer in nilfs_##name##_attr_release Sasha Levin
@ 2021-09-13 22:35 ` Sasha Levin
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 6/8] nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group Sasha Levin
` (2 subsequent siblings)
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nanyong Sun, Ryusuke Konishi, Andrew Morton, Linus Torvalds,
Sasha Levin, linux-nilfs
From: Nanyong Sun <sunnanyong@huawei.com>
[ Upstream commit 24f8cb1ed057c840728167dab33b32e44147c86f ]
If kobject_init_and_add return with error, kobject_put() is needed here to
avoid memory leak, because kobject_init_and_add may return error without
freeing the memory associated with the kobject it allocated.
Link: https://lkml.kernel.org/r/20210629022556.3985106-4-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-4-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index d7d6791c408e..e8d4828287c3 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -101,8 +101,8 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \
err = kobject_init_and_add(kobj, &nilfs_##name##_ktype, parent, \
#name); \
if (err) \
- return err; \
- return 0; \
+ kobject_put(kobj); \
+ return err; \
} \
static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \
{ \
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 4.4 6/8] nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
` (3 preceding siblings ...)
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 5/8] nilfs2: fix memory leak in nilfs_sysfs_create_##name##_group Sasha Levin
@ 2021-09-13 22:35 ` Sasha Levin
2021-09-13 22:36 ` [PATCH AUTOSEL 4.4 7/8] nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group Sasha Levin
2021-09-13 22:36 ` [PATCH AUTOSEL 4.4 8/8] nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group Sasha Levin
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:35 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nanyong Sun, Ryusuke Konishi, Andrew Morton, Linus Torvalds,
Sasha Levin, linux-nilfs
From: Nanyong Sun <sunnanyong@huawei.com>
[ Upstream commit a3e181259ddd61fd378390977a1e4e2316853afa ]
The kobject_put() should be used to cleanup the memory associated with the
kobject instead of kobject_del. See the section "Kobject removal" of
"Documentation/core-api/kobject.rst".
Link: https://lkml.kernel.org/r/20210629022556.3985106-5-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-5-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index e8d4828287c3..8a0af1e378c1 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -106,7 +106,7 @@ static int nilfs_sysfs_create_##name##_group(struct the_nilfs *nilfs) \
} \
static void nilfs_sysfs_delete_##name##_group(struct the_nilfs *nilfs) \
{ \
- kobject_del(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \
+ kobject_put(&nilfs->ns_##parent_name##_subgroups->sg_##name##_kobj); \
}
/************************************************************************
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 4.4 7/8] nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
` (4 preceding siblings ...)
2021-09-13 22:35 ` [PATCH AUTOSEL 4.4 6/8] nilfs2: fix memory leak in nilfs_sysfs_delete_##name##_group Sasha Levin
@ 2021-09-13 22:36 ` Sasha Levin
2021-09-13 22:36 ` [PATCH AUTOSEL 4.4 8/8] nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group Sasha Levin
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nanyong Sun, Ryusuke Konishi, Andrew Morton, Linus Torvalds,
Sasha Levin, linux-nilfs
From: Nanyong Sun <sunnanyong@huawei.com>
[ Upstream commit b2fe39c248f3fa4bbb2a20759b4fdd83504190f7 ]
If kobject_init_and_add returns with error, kobject_put() is needed here
to avoid memory leak, because kobject_init_and_add may return error
without freeing the memory associated with the kobject it allocated.
Link: https://lkml.kernel.org/r/20210629022556.3985106-6-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-6-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 8a0af1e378c1..73d872a24a21 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -217,9 +217,9 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
}
if (err)
- return err;
+ kobject_put(&root->snapshot_kobj);
- return 0;
+ return err;
}
void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [PATCH AUTOSEL 4.4 8/8] nilfs2: fix memory leak in nilfs_sysfs_delete_snapshot_group
2021-09-13 22:35 [PATCH AUTOSEL 4.4 1/8] dmaengine: ioat: depends on !UML Sasha Levin
` (5 preceding siblings ...)
2021-09-13 22:36 ` [PATCH AUTOSEL 4.4 7/8] nilfs2: fix memory leak in nilfs_sysfs_create_snapshot_group Sasha Levin
@ 2021-09-13 22:36 ` Sasha Levin
6 siblings, 0 replies; 8+ messages in thread
From: Sasha Levin @ 2021-09-13 22:36 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Nanyong Sun, Ryusuke Konishi, Andrew Morton, Linus Torvalds,
Sasha Levin, linux-nilfs
From: Nanyong Sun <sunnanyong@huawei.com>
[ Upstream commit 17243e1c3072b8417a5ebfc53065d0a87af7ca77 ]
kobject_put() should be used to cleanup the memory associated with the
kobject instead of kobject_del(). See the section "Kobject removal" of
"Documentation/core-api/kobject.rst".
Link: https://lkml.kernel.org/r/20210629022556.3985106-7-sunnanyong@huawei.com
Link: https://lkml.kernel.org/r/1625651306-10829-7-git-send-email-konishi.ryusuke@gmail.com
Signed-off-by: Nanyong Sun <sunnanyong@huawei.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nilfs2/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/nilfs2/sysfs.c b/fs/nilfs2/sysfs.c
index 73d872a24a21..49a148ebbcda 100644
--- a/fs/nilfs2/sysfs.c
+++ b/fs/nilfs2/sysfs.c
@@ -224,7 +224,7 @@ int nilfs_sysfs_create_snapshot_group(struct nilfs_root *root)
void nilfs_sysfs_delete_snapshot_group(struct nilfs_root *root)
{
- kobject_del(&root->snapshot_kobj);
+ kobject_put(&root->snapshot_kobj);
}
/************************************************************************
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread