From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752297AbdBHWbI (ORCPT ); Wed, 8 Feb 2017 17:31:08 -0500 Received: from mx0a-00082601.pphosted.com ([67.231.145.42]:41492 "EHLO mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752260AbdBHWbF (ORCPT ); Wed, 8 Feb 2017 17:31:05 -0500 Subject: Re: [PATCH] block: fix double-free in the failure path of cgwb_bdi_init() To: Tejun Heo , Dmitry Vyukov References: <20170208201907.GC25826@htj.duckdns.org> CC: Andrew Morton , , Vlastimil Babka , Joe Perches , Mel Gorman , Michal Hocko , "linux-mm@kvack.org" , LKML , syzkaller From: Jens Axboe Message-ID: <66bc2094-3f13-91da-41c2-78fa1e8a81e8@fb.com> Date: Wed, 8 Feb 2017 13:52:52 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 MIME-Version: 1.0 In-Reply-To: <20170208201907.GC25826@htj.duckdns.org> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [216.160.245.98] X-ClientProxiedBy: BY2PR01CA0072.prod.exchangelabs.com (10.163.25.40) To CY4PR15MB1192.namprd15.prod.outlook.com (10.172.177.14) X-MS-Office365-Filtering-Correlation-Id: 691350b0-d5e6-4240-4467-08d4506475c7 X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(22001);SRVR:CY4PR15MB1192; X-Microsoft-Exchange-Diagnostics: 1;CY4PR15MB1192;3:e5XLOs6WxxDhRImdQ6CB+mpMjHVc8n7mHBY9LROj3mquGIMcGUvNiuU9NsqAIdffk7ciaRcmB25IOQONm0sOA6OGiwyKclhJAT90fGuJyi51BoqQalEzUbKz4xgGnb0N8ADhmES6myKHCrbEpWjyuPVMZ8m2YGQrnPes4Cw6arp+JwNd3us7u2CRBtrOGnAYMWOPWw4YFD5tCFSrT5TNUDkvT0VaQOwuswNLgpXqyLXOF6s2AlV/bATdSaBmhprM4B41QFbjSdTS1ZF9OpF+7w==;25:zGriYHzwDRuY0Qo2loL0a7AURB0cF+zrwPTGwSxto56uMelfD4EAJMfzU8UhbXWCR4zf2h1u1UwKpfZ3R3aHYmTNL/9wUqlqpQJ7oJ2+e/orn3/3DZt1N+vvdnXV8hsI40Ss2xXfTKu3A1ev7vrenS60ZYJhrP1zK5yAAsUddfb5XCP5M9ghatfxF8t+irPWUQ40xOoWCJJKhjthznAMVWX85QK8LCm6TgRF6sggul7Epk7itRzLN7U24PvWceVeiV/cO3ewl3tKrt+2a95so2PrnGLWjsB93t+AZw+TmGdD7PGRcVQQGB4kD9qadIdFPcJbPFIq+jF8Kj1Ffy6c4nBRWJ5uR3BEB8rWPNJ/ikjtIOdKt0E0fppNT8C3B/J4eJNeT7KPtCw0KlB+12GYpP7G0iIeFjqcVxdJStvyZSenez65l4I9oeHBsCZ5gJtjViWEwCv0fTjPwa0b1R3xbA== X-Microsoft-Exchange-Diagnostics: 1;CY4PR15MB1192;31:JjZVQ/m7T2xXh4P3IwHvDWYwpVhN/GHRHJtOOYVvKHkAL78iejAq/wkwZli6ZtYwmHdfnBlLrT33e350ruy9bTVTlNJF+YmPUXdHfhLhUSrrb/G8xq04JVCEnUkxqlGIjvFJwH4GCb024UbZ4NpT6bz5NXVJjuyb7ryx8g0j90Ux++f7/dI3Yr0fNAHQpxBBjOc4UpVgYmh30tnzAoUn6lNSaEJdBYuiMlqOEhlZurY3XQwaEYob+1me+l/x6Fh14y1z2qtOwqHDFBd1namkPQ==;20:DajQPqSCeoWWXOtoPVDcHhDvmnimSb9I+nlfFM6YxGPGTuk8MwUyCMcZL8NJUliFZPsSNRKkmTMOnWiw7CxFubffnQP/zcvfSkZkevkAo6xUsNcHlaSRunKsn2h/hxlVLje3mzzbYn05TkYHRpURws7SKXDHFbUYu7stbKNGVcfRcnbUsYAPoOXUInWisPzFNPXW6va762i5uIkxRhnPCXzA+9/WQyM9Tf9csWxYCLIqib0CEyCLPZQHu+hgr8N8p/AI5pI4bAH8ugNy6yb4Soy7lzKyS4P/townLhVH1ujqGb/EGpRCriE1TDAa3qppTpVIgNIsQB9biC9Qdq7ZDo2qlv4eku19swETC6GTzeKyDGgBHmk+1vlyNfdY4ttAPxCvkeZp6qnjSicK9l3hEgJnynaEcOLXKHg2qWDUucZntmxxvgNnw5Hy4H6x9+ZOaYxcOBwxFfgiQaDWn8VtDDXItVQ2zLcDD5SBkC4EQrim/+x1/n4klurlO+OGkPm6 X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040375)(601004)(2401047)(2017020702029)(5005006)(20170203043)(8121501046)(10201501046)(3002001)(6041248)(20161123560025)(20161123555025)(20161123558025)(20161123564025)(20161123562025)(6072148);SRVR:CY4PR15MB1192;BCL:0;PCL:0;RULEID:;SRVR:CY4PR15MB1192; X-Microsoft-Exchange-Diagnostics: 1;CY4PR15MB1192;4:iNj2MGG89UybA63xajg3M1LFKlirWUoiwuJVNI+N38LjFI7VbcknJUyDWKAzMXZ8wwqrBwIawA2Lqcr1Dyp6Up4LipK5wXjqyMfw3erXmP33Ouzqahth3MVDhdRUDCVHApNliEoUiLejIjjRJSwjctHcYNcZKNHa/Q7iovC1zgHFZOD8ICwAxcEaZlGdHOxLGVJRvvmxgBs+qECVK9kBt8XPBLf/I4YyQT0CtXy9ozAkrA8j7/6SH6VD3B2x0zFwMVaXuxgLka2XdKuJAKPEZR1NBjwheqfh/Zt47h9ONL9w2KIQqgqjuadwyHT2Asx1JruT7OJOTOIx8xLjFfn2N8dOnHVgLc5eV0PcLjr2YIUne6F9qgKjalKoXWraFzkcnuiWmd8VW4qR67UykkT3v0O4fR5v6vx/xhr05f7M0b4N0pTLk4Cr1wFTjY4HsNWsV5WaOkVsfAcqcvYfH+Yquo3l1IMWeRcsnv46NW232rsgiHepKuUaUlQU/YtC0xo7P1FBuX25nB5I+PkdDdSj+p8djeTon8p9WRkCABjPI2Qzwtu38pAHbomsSnBtlQLbfZ3P5AdfqT11DQr8uPhVTM5W9QtfSdDD+j7S5vOnm3M2Daiog8D1fOwYhJZQemIkIZaLUaHbPqGEFvGw1FzvekbZvaemdHlXmWcIorr0ZUs= X-Forefront-PRVS: 0212BDE3BE X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6009001)(6049001)(7916002)(39410400002)(39450400003)(39830400002)(24454002)(199003)(377454003)(189002)(105586002)(7416002)(53546003)(6246003)(31696002)(4326007)(3846002)(53936002)(65826007)(5660300001)(7736002)(106356001)(77096006)(83506001)(230700001)(90366009)(4001350100001)(6116002)(189998001)(92566002)(2906002)(97736004)(305945005)(25786008)(6486002)(76176999)(64126003)(229853002)(50986999)(54356999)(101416001)(38730400002)(23746002)(42186005)(54906002)(33646002)(31686004)(47776003)(65956001)(50466002)(86362001)(81156014)(8676002)(68736007)(81166006)(65806001)(117156001)(2950100002)(6666003)(36756003)(66066001);DIR:OUT;SFP:1102;SCL:1;SRVR:CY4PR15MB1192;H:[192.168.1.154];FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?Windows-1252?Q?1;CY4PR15MB1192;23:MNBgty9PX+qECA4Hc7vtX8k//3VNh1JvpDzo4?= =?Windows-1252?Q?1u73k0d+jqUE55V6tT5YUxeTK5WwSwoPKeEWgEUBEqC/gkqv5ZMsLVPP?= =?Windows-1252?Q?kgsDtRK7IO9jyOe/mxLM05ew8uR/mkEkTXztV6dVsIT/LSEi/LXP2ycR?= =?Windows-1252?Q?MikTEVRWpzpOmAa6sBJNZNGSqybpmDJUpVHRWamYcXn94d2+yYcmkuTs?= =?Windows-1252?Q?Q7NVMDacCBDk2UQ197fGBWUUzYXVc3+vLs2iXBtyJEy3Z5Se2HdYyIua?= =?Windows-1252?Q?z8di/n3X38evQglzkz/qxZk76oq3C7/eEAPF6T9otIqmjGL9FC7wV/ww?= =?Windows-1252?Q?k08W/iEuGgXXu/AcXcg5pJ4nTdLRub2q1TUFSZXHD049GOJMX63Wbn/U?= =?Windows-1252?Q?Af9TtMFlpw6j0JXbBTh2e2TammnvuwSh38MOzPx0WZ3H6DeRhlHhR36S?= =?Windows-1252?Q?jeC3p6xzgQrPddt0+5TcmJ4UuGQVF4Q6ONGVwYqLiVen7Seg1nJN9MU/?= =?Windows-1252?Q?F9nsDyCDJubtSsIjf8v+Tl46ytGNp/iLPVh2+quIN10ZmYqVBM6feE8F?= =?Windows-1252?Q?8DUXuT/eicWsF41rcD4MX4bLkZ6Xz+NviT59hnVMPHms5jmVvrMk7ppG?= =?Windows-1252?Q?7NyiVDRlT9EWQ9QaObQLcyQknwb+Wmv+FTVdsg8ovO73xlt9nPUIaXcz?= =?Windows-1252?Q?h+TbY2T8HwLu2Lf5RycG2uzFRg5Njs0UXZtrismm72KJixyKC5Ki4zS0?= =?Windows-1252?Q?1g+qYAI+cQwmh8sResqgcaKz5EtSgCQZ1pEv6OibzF+JVgcV0Wm/Na6K?= =?Windows-1252?Q?nBnRtheC/NkxY5ISfUxxoM5NyIEftVfY2+afG8wUH0X0bTG7EQx1sz7T?= =?Windows-1252?Q?hBdI9C+koGrq2liqUMbrrgEqnq6b+no0pENMoJfgHZ9AW0NZ8wYWEoO0?= =?Windows-1252?Q?EE34twcLK5qLlh4gzn2awlFrVvH/om0AlPUvFK6qWGp9Qj981go8bwkJ?= =?Windows-1252?Q?qwI4P4k2vfU9mPLZygzOgFoJ7dgFFv1pFAa6zVXJH24fvdRl7f9kqh6+?= =?Windows-1252?Q?A0fYmC4U/Phy+0sDvdMe8nzcRho84jl2rcGFh2q3sPs/VUGIwOcanNw+?= =?Windows-1252?Q?T1MQEIFF9KiW9SJN4objHDh2iZ4/kXu1p8UrK/uPw64xMbuZm8qmRisz?= =?Windows-1252?Q?WKjKFoDo5vwGcAilP44zxEwyjX/SwS1TyGNFS9DOmSDGf1ByBxrY4faD?= =?Windows-1252?Q?xfpE9XRH/6EwDkVD5UicOBAYtWwDwK3gmHF6jDRlYX4dgGpB/chVq6pe?= =?Windows-1252?Q?ziGsK/7link/UR0l37vm9A0HHFQUl8viQryYZuaB+Z2+AvRr4yrv7NsS?= =?Windows-1252?Q?rTDc0NqLIgWeoGxcIgSwOaDCHt6ym+F9P09RRgfE1GsGWdsA0TPpV14x?= =?Windows-1252?Q?Q74tmnhyIbwQt7PpwiVt53LdCmz/u+iCCQQ8mYh3BZsiP30GTmtoa+NL?= =?Windows-1252?Q?kBLpgT2EWJfAswvzX/n4CuivJaARDJKeGcBZa/LxFGAWY5IW8K7cZRkS?= =?Windows-1252?Q?TrCH1i5XcZznqNZ/35bANVWmhG6WNFTm/EutaRz3nry4AaW9VAnvmrEN?= =?Windows-1252?B?UT09?= X-Microsoft-Exchange-Diagnostics: 1;CY4PR15MB1192;6:ptWUaJ1Da6Av5XX3bJVcNgogNiOtbH409bmY+GyQX2rp34X56K8gmEAS45mIn/j0b6byjeIodTw4ricZnPK/Zx63VvpZQc2uZ4inbVFDwAI5CxvrB+/1+Rh99We/jSRTPRAPJwzGa/tHbrvNIDiVLN6N8J8JOcnTkQ/t6WRJmUwMRYy6LdfZcT8w4ULwmfISQEcyarTz1bLoREEwOLbPXT36D47D+rBKWrYrq6qC5hWiAL7Oq+wztaI3qGORBbXen41BcVs7h9F8W3ceGpHtEiYwhuRb0FGtTkXTqFHk6ESgdcUh0OVaRs1NXVQDSycSUUXByZ04eGA8x/FPTfYU4+p9Hb2pBD97o1f5uw5oDL95/hF4L1y2Uj/upQ1ACQR2CvkJDek3C26JRZ3liEs9kw==;5:7YaHTLQUYch861iqMFlYkpvmbqdkAUf2qGTgQ3xpM2xvpXcrxjJN1SIuFIeFk6bzmKdLJrcOX8kIT1Scpu5XDl5fPq7UODKMIYjj4VNE+hVx6G9CHBSx5qlH0vacNen2PzvTtBKyJg/sq1OOV/YStA==;24:NxrExkMbhqW+/oYKI2rIox3luaQkwwDTn+652vy7Hk8WD2jWIY7daJkH1oeEKuMfDiBylSbT/+iUL1iHkn0sDu0bAdyetvpCa0OoXX56Lvg= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;CY4PR15MB1192;7:DLOq+aEgBjNxECDLDMUMIKW0We7jeB6u7Ty8m+sTsaMICef4mT+8m3GuDG18szASpPDoZKuvzmqus60nlE5mFU+r0GpURtX7mXMy8Utfhjx/ymxP2bbfBsmOOp6lYUVlDYBlCVhHUF5gg1gn6sU8hVZT2Hoj9LYBEqY6BXhM3DI7nC15C/gRSeN98DEhwQFG7BcOdWc64htxoTbnqDWiEVwlRc0D6nRIQHeOlnzvg0J2F5wLHMty0VTsxGushpQMNP/ClgmU3l6GKvaJOGlTcQ3x5uuZ7cENQZhDHA2pnGjTTaeRpsSxmw5qZxlkDWTcttKeIxCPlS9M72JKZtWJuDrMx+6Cyxzth+3AA3fTbPXQN3kzAS7Z3k4de3FaqNsKPTMY8XKNsyP2etZJWo1QtfpmJ9fb+SS+6UkKzIXxyqb6fXnjJtWnJUhwlbT17gUKx4uWli6DPBZudk6abSepOUzQIU9DNRcEPqC84gZbtyReP6JqspAWND9RqTYpRb1kk+fEYpZhFbFwYYDvu1v6AQ==;20:4Z1WEvkMaF5FyB7hS6cbIQUbDMsEwgS5Fi+oKqaVqK8zpNwk1ump8Wq805X7qi22FciTEbvSLsiFpoqk2J0q3MitZmKyg5kMeZM8owzSsyDH3TV2aLkbAb9DyACRIaALJZq/cso9qyTH2bEnE9sNeoYx9PGQ/VJFi7NDDQmONWE= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Feb 2017 20:52:56.0600 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR15MB1192 X-OriginatorOrg: fb.com X-Proofpoint-Spam-Reason: safe X-FB-Internal: Safe X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-02-08_12:,, signatures=0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 02/08/2017 01:19 PM, Tejun Heo wrote: > When !CONFIG_CGROUP_WRITEBACK, bdi has single bdi_writeback_congested > at bdi->wb_congested. cgwb_bdi_init() allocates it with kzalloc() and > doesn't do further initialization. This usually works fine as the > reference count gets bumped to 1 by wb_init() and the put from > wb_exit() releases it. > > However, when wb_init() fails, it puts the wb base ref automatically > freeing the wb and the explicit kfree() in cgwb_bdi_init() error path > ends up trying to free the same pointer the second time causing a > double-free. > > Fix it by explicitly initilizing the refcnt to 1 and putting the base > ref from cgwb_bdi_destroy(). Queued up for 4.11. -- Jens Axboe