Revision 757fed1d0898b893d7daa84183947c70f27632f3 authored by Wang Hai on 28 January 2021, 11:32:50 UTC, committed by Linus Torvalds on 28 January 2021, 17:05:44 UTC
This reverts commit dde3c6b72a16c2db826f54b2d49bdea26c3534a2.
syzbot report a double-free bug. The following case can cause this bug.
- mm/slab_common.c: create_cache(): if the __kmem_cache_create() fails,
it does:
out_free_cache:
kmem_cache_free(kmem_cache, s);
- but __kmem_cache_create() - at least for slub() - will have done
sysfs_slab_add(s)
-> sysfs_create_group() .. fails ..
-> kobject_del(&s->kobj); .. which frees s ...
We can't remove the kmem_cache_free() in create_cache(), because other
error cases of __kmem_cache_create() do not free this.
So, revert the commit dde3c6b72a16 ("mm/slub: fix a memory leak in
sysfs_slab_add()") to fix this.
Reported-by: syzbot+d0bd96b4696c1ef67991@syzkaller.appspotmail.com
Fixes: dde3c6b72a16 ("mm/slub: fix a memory leak in sysfs_slab_add()")
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Wang Hai <wanghai38@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 76c057c
| File | Mode | Size |
|---|---|---|
| Makefile | -rw-r--r-- | 1.3 KB |
| bpf_sk_storage.c | -rw-r--r-- | 22.9 KB |
| datagram.c | -rw-r--r-- | 20.5 KB |
| datagram.h | -rw-r--r-- | 322 bytes |
| dev.c | -rw-r--r-- | 282.3 KB |
| dev_addr_lists.c | -rw-r--r-- | 24.2 KB |
| dev_ioctl.c | -rw-r--r-- | 12.1 KB |
| devlink.c | -rw-r--r-- | 266.0 KB |
| drop_monitor.c | -rw-r--r-- | 40.3 KB |
| dst.c | -rw-r--r-- | 7.9 KB |
| dst_cache.c | -rw-r--r-- | 3.5 KB |
| failover.c | -rw-r--r-- | 7.4 KB |
| fib_notifier.c | -rw-r--r-- | 4.8 KB |
| fib_rules.c | -rw-r--r-- | 30.1 KB |
| filter.c | -rw-r--r-- | 278.8 KB |
| flow_dissector.c | -rw-r--r-- | 48.0 KB |
| flow_offload.c | -rw-r--r-- | 12.5 KB |
| gen_estimator.c | -rw-r--r-- | 7.0 KB |
| gen_stats.c | -rw-r--r-- | 11.5 KB |
| gro_cells.c | -rw-r--r-- | 2.3 KB |
| hwbm.c | -rw-r--r-- | 1.9 KB |
| link_watch.c | -rw-r--r-- | 5.7 KB |
| lwt_bpf.c | -rw-r--r-- | 14.7 KB |
| lwtunnel.c | -rw-r--r-- | 8.8 KB |
| neighbour.c | -rw-r--r-- | 91.4 KB |
| net-procfs.c | -rw-r--r-- | 8.8 KB |
| net-sysfs.c | -rw-r--r-- | 46.0 KB |
| net-sysfs.h | -rw-r--r-- | 510 bytes |
| net-traces.c | -rw-r--r-- | 1.7 KB |
| net_namespace.c | -rw-r--r-- | 32.4 KB |
| netclassid_cgroup.c | -rw-r--r-- | 3.3 KB |
| netevent.c | -rw-r--r-- | 1.8 KB |
| netpoll.c | -rw-r--r-- | 19.5 KB |
| netprio_cgroup.c | -rw-r--r-- | 6.6 KB |
| page_pool.c | -rw-r--r-- | 15.6 KB |
| pktgen.c | -rw-r--r-- | 95.4 KB |
| ptp_classifier.c | -rw-r--r-- | 7.4 KB |
| request_sock.c | -rw-r--r-- | 5.0 KB |
| rtnetlink.c | -rw-r--r-- | 136.3 KB |
| scm.c | -rw-r--r-- | 8.3 KB |
| secure_seq.c | -rw-r--r-- | 4.9 KB |
| skbuff.c | -rw-r--r-- | 157.1 KB |
| skmsg.c | -rw-r--r-- | 24.7 KB |
| sock.c | -rw-r--r-- | 88.5 KB |
| sock_diag.c | -rw-r--r-- | 7.8 KB |
| sock_map.c | -rw-r--r-- | 37.2 KB |
| sock_reuseport.c | -rw-r--r-- | 9.1 KB |
| stream.c | -rw-r--r-- | 5.4 KB |
| sysctl_net_core.c | -rw-r--r-- | 15.1 KB |
| timestamping.c | -rw-r--r-- | 1.5 KB |
| tso.c | -rw-r--r-- | 2.6 KB |
| utils.c | -rw-r--r-- | 11.6 KB |
| xdp.c | -rw-r--r-- | 12.2 KB |
Computing file changes ...
