From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ua0-f199.google.com (mail-ua0-f199.google.com [209.85.217.199]) by kanga.kvack.org (Postfix) with ESMTP id EF7F76B0033 for ; Wed, 8 Feb 2017 04:55:49 -0500 (EST) Received: by mail-ua0-f199.google.com with SMTP id f2so74521869uaf.2 for ; Wed, 08 Feb 2017 01:55:49 -0800 (PST) Received: from mail-ua0-x22f.google.com (mail-ua0-x22f.google.com. [2607:f8b0:400c:c08::22f]) by mx.google.com with ESMTPS id 64si2160575uap.118.2017.02.08.01.55.48 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 08 Feb 2017 01:55:49 -0800 (PST) Received: by mail-ua0-x22f.google.com with SMTP id i68so105263940uad.0 for ; Wed, 08 Feb 2017 01:55:48 -0800 (PST) MIME-Version: 1.0 From: Dmitry Vyukov Date: Wed, 8 Feb 2017 10:55:28 +0100 Message-ID: Subject: mm: double-free in cgwb_bdi_init Content-Type: text/plain; charset=UTF-8 Sender: owner-linux-mm@kvack.org List-ID: To: Andrew Morton , Jens Axboe , Tejun Heo , xiakaixu@huawei.com, Vlastimil Babka , Joe Perches , Mel Gorman , Michal Hocko , "linux-mm@kvack.org" , LKML Cc: syzkaller Hello, syzkaller hit the following report on linux-next eb60f01302b24ce93108414e2c4c673cb7cd6e05: BUG: Double free or freeing an invalid pointer CPU: 0 PID: 15931 Comm: syz-executor2 Not tainted 4.10.0-rc7-next-20170207 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: kfree+0xd3/0x250 mm/slab.c:3819 cgwb_bdi_init mm/backing-dev.c:764 [inline] bdi_init+0xbf5/0xed0 mm/backing-dev.c:788 bdi_setup_and_register+0x70/0x100 mm/backing-dev.c:929 v9fs_session_init+0x17b/0x1a00 fs/9p/v9fs.c:335 v9fs_mount+0x81/0x830 fs/9p/vfs_super.c:130 mount_fs+0x97/0x2e0 fs/super.c:1223 vfs_kern_mount.part.24+0xc6/0x430 fs/namespace.c:976 vfs_kern_mount fs/namespace.c:2509 [inline] do_new_mount fs/namespace.c:2512 [inline] do_mount+0x426/0x2ec0 fs/namespace.c:2834 SYSC_mount fs/namespace.c:3050 [inline] SyS_mount+0xab/0x120 fs/namespace.c:3027 entry_SYSCALL_64_fastpath+0x1f/0xc2 Object at ffff8801d1c30340, in cache kmalloc-32 size: 32 Allocated: PID = 15931 [] kzalloc include/linux/slab.h:638 [inline] [] cgwb_bdi_init mm/backing-dev.c:758 [inline] [] bdi_init+0x346/0xed0 mm/backing-dev.c:788 [] bdi_setup_and_register+0x70/0x100 mm/backing-dev.c:929 [] v9fs_session_init+0x17b/0x1a00 fs/9p/v9fs.c:335 [] v9fs_mount+0x81/0x830 fs/9p/vfs_super.c:130 [] mount_fs+0x97/0x2e0 fs/super.c:1223 [] vfs_kern_mount.part.24+0xc6/0x430 fs/namespace.c:976 [] vfs_kern_mount fs/namespace.c:2509 [inline] [] do_new_mount fs/namespace.c:2512 [inline] [] do_mount+0x426/0x2ec0 fs/namespace.c:2834 [] SYSC_mount fs/namespace.c:3050 [inline] [] SyS_mount+0xab/0x120 fs/namespace.c:3027 Freed: PID = 15931 [] kfree+0xd3/0x250 mm/slab.c:3819 [] wb_congested_put include/linux/backing-dev.h:440 [inline] [] wb_init mm/backing-dev.c:337 [inline] [] cgwb_bdi_init mm/backing-dev.c:762 [inline] [] bdi_init+0xc07/0xed0 mm/backing-dev.c:788 [] bdi_setup_and_register+0x70/0x100 mm/backing-dev.c:929 [] v9fs_session_init+0x17b/0x1a00 fs/9p/v9fs.c:335 [] v9fs_mount+0x81/0x830 fs/9p/vfs_super.c:130 [] mount_fs+0x97/0x2e0 fs/super.c:1223 [] vfs_kern_mount.part.24+0xc6/0x430 fs/namespace.c:976 [] vfs_kern_mount fs/namespace.c:2509 [inline] [] do_new_mount fs/namespace.c:2512 [inline] [] do_mount+0x426/0x2ec0 fs/namespace.c:2834 [] SYSC_mount fs/namespace.c:3050 [inline] [] SyS_mount+0xab/0x120 fs/namespace.c:3027 [] entry_SYSCALL_64_fastpath+0x1f/0xc2 It all happens in the context on a single syscall. Also right before that there was a bunch of allocation failures: https://gist.githubusercontent.com/dvyukov/a840e280871136fc9654833e59970342/raw/385864d7584a4575ca5b9e2cc70815b9516b6598/gistfile1.txt So this looks like a straight double-free on error path. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org