Revision 757fed1d0898b893d7daa84183947c70f27632f3 authored by Wang Hai on 28 January 2021, 11:32:50 UTC, committed by Linus Torvalds on 28 January 2021, 17:05:44 UTC
This reverts commit dde3c6b72a16c2db826f54b2d49bdea26c3534a2. syzbot report a double-free bug. The following case can cause this bug. - mm/slab_common.c: create_cache(): if the __kmem_cache_create() fails, it does: out_free_cache: kmem_cache_free(kmem_cache, s); - but __kmem_cache_create() - at least for slub() - will have done sysfs_slab_add(s) -> sysfs_create_group() .. fails .. -> kobject_del(&s->kobj); .. which frees s ... We can't remove the kmem_cache_free() in create_cache(), because other error cases of __kmem_cache_create() do not free this. So, revert the commit dde3c6b72a16 ("mm/slub: fix a memory leak in sysfs_slab_add()") to fix this. Reported-by: syzbot+d0bd96b4696c1ef67991@syzkaller.appspotmail.com Fixes: dde3c6b72a16 ("mm/slub: fix a memory leak in sysfs_slab_add()") Acked-by: Vlastimil Babka <vbabka@suse.cz> Signed-off-by: Wang Hai <wanghai38@huawei.com> Cc: <stable@vger.kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 76c057c
File | Mode | Size |
---|---|---|
Makefile | -rw-r--r-- | 1.3 KB |
bpf_sk_storage.c | -rw-r--r-- | 22.9 KB |
datagram.c | -rw-r--r-- | 20.5 KB |
datagram.h | -rw-r--r-- | 322 bytes |
dev.c | -rw-r--r-- | 282.3 KB |
dev_addr_lists.c | -rw-r--r-- | 24.2 KB |
dev_ioctl.c | -rw-r--r-- | 12.1 KB |
devlink.c | -rw-r--r-- | 266.0 KB |
drop_monitor.c | -rw-r--r-- | 40.3 KB |
dst.c | -rw-r--r-- | 7.9 KB |
dst_cache.c | -rw-r--r-- | 3.5 KB |
failover.c | -rw-r--r-- | 7.4 KB |
fib_notifier.c | -rw-r--r-- | 4.8 KB |
fib_rules.c | -rw-r--r-- | 30.1 KB |
filter.c | -rw-r--r-- | 278.8 KB |
flow_dissector.c | -rw-r--r-- | 48.0 KB |
flow_offload.c | -rw-r--r-- | 12.5 KB |
gen_estimator.c | -rw-r--r-- | 7.0 KB |
gen_stats.c | -rw-r--r-- | 11.5 KB |
gro_cells.c | -rw-r--r-- | 2.3 KB |
hwbm.c | -rw-r--r-- | 1.9 KB |
link_watch.c | -rw-r--r-- | 5.7 KB |
lwt_bpf.c | -rw-r--r-- | 14.7 KB |
lwtunnel.c | -rw-r--r-- | 8.8 KB |
neighbour.c | -rw-r--r-- | 91.4 KB |
net-procfs.c | -rw-r--r-- | 8.8 KB |
net-sysfs.c | -rw-r--r-- | 46.0 KB |
net-sysfs.h | -rw-r--r-- | 510 bytes |
net-traces.c | -rw-r--r-- | 1.7 KB |
net_namespace.c | -rw-r--r-- | 32.4 KB |
netclassid_cgroup.c | -rw-r--r-- | 3.3 KB |
netevent.c | -rw-r--r-- | 1.8 KB |
netpoll.c | -rw-r--r-- | 19.5 KB |
netprio_cgroup.c | -rw-r--r-- | 6.6 KB |
page_pool.c | -rw-r--r-- | 15.6 KB |
pktgen.c | -rw-r--r-- | 95.4 KB |
ptp_classifier.c | -rw-r--r-- | 7.4 KB |
request_sock.c | -rw-r--r-- | 5.0 KB |
rtnetlink.c | -rw-r--r-- | 136.3 KB |
scm.c | -rw-r--r-- | 8.3 KB |
secure_seq.c | -rw-r--r-- | 4.9 KB |
skbuff.c | -rw-r--r-- | 157.1 KB |
skmsg.c | -rw-r--r-- | 24.7 KB |
sock.c | -rw-r--r-- | 88.5 KB |
sock_diag.c | -rw-r--r-- | 7.8 KB |
sock_map.c | -rw-r--r-- | 37.2 KB |
sock_reuseport.c | -rw-r--r-- | 9.1 KB |
stream.c | -rw-r--r-- | 5.4 KB |
sysctl_net_core.c | -rw-r--r-- | 15.1 KB |
timestamping.c | -rw-r--r-- | 1.5 KB |
tso.c | -rw-r--r-- | 2.6 KB |
utils.c | -rw-r--r-- | 11.6 KB |
xdp.c | -rw-r--r-- | 12.2 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...