• Wang Hai's avatar
    mm/slub: fix a memory leak in sysfs_slab_add() · dde3c6b7
    Wang Hai authored
    syzkaller reports for memory leak when kobject_init_and_add() returns an
    error in the function sysfs_slab_add() [1]
    
    When this happened, the function kobject_put() is not called for the
    corresponding kobject, which potentially leads to memory leak.
    
    This patch fixes the issue by calling kobject_put() even if
    kobject_init_and_add() fails.
    
    [1]
      BUG: memory leak
      unreferenced object 0xffff8880a6d4be88 (size 8):
      comm "syz-executor.3", pid 946, jiffies 4295772514 (age 18.396s)
      hex dump (first 8 bytes):
        70 69 64 5f 33 00 ff ff                          pid_3...
      backtrace:
         kstrdup+0x35/0x70 mm/util.c:60
         kstrdup_const+0x3d/0x50 mm/util.c:82
         kvasprintf_const+0x112/0x170 lib/kasprintf.c:48
         kobject_set_name_vargs+0x55/0x130 lib/kobject.c:289
         kobject_add_varg lib/kobject.c:384 [inline]
         kobject_init_and_add+0xd8/0x170 lib/kobject.c:473
         sysfs_slab_add+0x1d8/0x290 mm/slub.c:5811
         __kmem_cache_create+0x50a/0x570 mm/slub.c:4384
         create_cache+0x113/0x1e0 mm/slab_common.c:407
         kmem_cache_create_usercopy+0x1a1/0x260 mm/slab_common.c:505
         kmem_cache_create+0xd/0x10 mm/slab_common.c:564
         create_pid_cachep kernel/pid_namespace.c:54 [inline]
         create_pid_namespace kernel/pid_namespace.c:96 [inline]
         copy_pid_ns+0x77c/0x8f0 kernel/pid_namespace.c:148
         create_new_namespaces+0x26b/0xa30 kernel/nsproxy.c:95
         unshare_nsproxy_namespaces+0xa7/0x1e0 kernel/nsproxy.c:229
         ksys_unshare+0x3d2/0x770 kernel/fork.c:2969
         __do_sys_unshare kernel/fork.c:3037 [inline]
         __se_sys_unshare kernel/fork.c:3035 [inline]
         __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3035
         do_syscall_64+0xa1/0x530 arch/x86/entry/common.c:295
    
    Fixes: 80da026a ("mm/slub: fix slab double-free in case of duplicate sysfs filename")
    Reported-by: default avatarHulk Robot <hulkci@huawei.com>
    Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Christoph Lameter <cl@linux.com>
    Cc: Pekka Enberg <penberg@kernel.org>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
    Link: http://lkml.kernel.org/r/20200602115033.1054-1-wanghai38@huawei.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    dde3c6b7
slub.c 146 KB