]>
Commit | Line | Data |
---|---|---|
14d4a023 GKH |
1 | From 3510955b327176fd4cbab5baa75b449f077722a2 Mon Sep 17 00:00:00 2001 |
2 | From: Shakeel Butt <shakeelb@google.com> | |
3 | Date: Thu, 13 Jun 2019 15:55:49 -0700 | |
4 | Subject: mm/list_lru.c: fix memory leak in __memcg_init_list_lru_node | |
5 | ||
6 | From: Shakeel Butt <shakeelb@google.com> | |
7 | ||
8 | commit 3510955b327176fd4cbab5baa75b449f077722a2 upstream. | |
9 | ||
10 | Syzbot reported following memory leak: | |
11 | ||
12 | ffffffffda RBX: 0000000000000003 RCX: 0000000000441f79 | |
13 | BUG: memory leak | |
14 | unreferenced object 0xffff888114f26040 (size 32): | |
15 | comm "syz-executor626", pid 7056, jiffies 4294948701 (age 39.410s) | |
16 | hex dump (first 32 bytes): | |
17 | 40 60 f2 14 81 88 ff ff 40 60 f2 14 81 88 ff ff @`......@`...... | |
18 | 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ | |
19 | backtrace: | |
20 | slab_post_alloc_hook mm/slab.h:439 [inline] | |
21 | slab_alloc mm/slab.c:3326 [inline] | |
22 | kmem_cache_alloc_trace+0x13d/0x280 mm/slab.c:3553 | |
23 | kmalloc include/linux/slab.h:547 [inline] | |
24 | __memcg_init_list_lru_node+0x58/0xf0 mm/list_lru.c:352 | |
25 | memcg_init_list_lru_node mm/list_lru.c:375 [inline] | |
26 | memcg_init_list_lru mm/list_lru.c:459 [inline] | |
27 | __list_lru_init+0x193/0x2a0 mm/list_lru.c:626 | |
28 | alloc_super+0x2e0/0x310 fs/super.c:269 | |
29 | sget_userns+0x94/0x2a0 fs/super.c:609 | |
30 | sget+0x8d/0xb0 fs/super.c:660 | |
31 | mount_nodev+0x31/0xb0 fs/super.c:1387 | |
32 | fuse_mount+0x2d/0x40 fs/fuse/inode.c:1236 | |
33 | legacy_get_tree+0x27/0x80 fs/fs_context.c:661 | |
34 | vfs_get_tree+0x2e/0x120 fs/super.c:1476 | |
35 | do_new_mount fs/namespace.c:2790 [inline] | |
36 | do_mount+0x932/0xc50 fs/namespace.c:3110 | |
37 | ksys_mount+0xab/0x120 fs/namespace.c:3319 | |
38 | __do_sys_mount fs/namespace.c:3333 [inline] | |
39 | __se_sys_mount fs/namespace.c:3330 [inline] | |
40 | __x64_sys_mount+0x26/0x30 fs/namespace.c:3330 | |
41 | do_syscall_64+0x76/0x1a0 arch/x86/entry/common.c:301 | |
42 | entry_SYSCALL_64_after_hwframe+0x44/0xa9 | |
43 | ||
44 | This is a simple off by one bug on the error path. | |
45 | ||
46 | Link: http://lkml.kernel.org/r/20190528043202.99980-1-shakeelb@google.com | |
47 | Fixes: 60d3fd32a7a9 ("list_lru: introduce per-memcg lists") | |
48 | Reported-by: syzbot+f90a420dfe2b1b03cb2c@syzkaller.appspotmail.com | |
49 | Signed-off-by: Shakeel Butt <shakeelb@google.com> | |
50 | Acked-by: Michal Hocko <mhocko@suse.com> | |
51 | Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com> | |
52 | Cc: <stable@vger.kernel.org> [4.0+] | |
53 | Signed-off-by: Andrew Morton <akpm@linux-foundation.org> | |
54 | Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> | |
55 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
56 | ||
57 | --- | |
58 | mm/list_lru.c | 2 +- | |
59 | 1 file changed, 1 insertion(+), 1 deletion(-) | |
60 | ||
61 | --- a/mm/list_lru.c | |
62 | +++ b/mm/list_lru.c | |
63 | @@ -313,7 +313,7 @@ static int __memcg_init_list_lru_node(st | |
64 | } | |
65 | return 0; | |
66 | fail: | |
67 | - __memcg_destroy_list_lru_node(memcg_lrus, begin, i - 1); | |
68 | + __memcg_destroy_list_lru_node(memcg_lrus, begin, i); | |
69 | return -ENOMEM; | |
70 | } | |
71 |