]> git.itanic.dy.fi Git - linux-stable/commit
mm: shrinkers: fix double kfree on shrinker name
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Wed, 20 Jul 2022 14:47:55 +0000 (23:47 +0900)
committerakpm <akpm@linux-foundation.org>
Sat, 30 Jul 2022 01:07:13 +0000 (18:07 -0700)
commit14773bfa70e67f4d4ebd60e60cb6e25e8c84d4c0
tree67152cd43719fd51e7975bf56bf1194bafbfa181
parent187e7c41445a0f202bb551f08ca7f8158fea1cd7
mm: shrinkers: fix double kfree on shrinker name

syzbot is reporting double kfree() at free_prealloced_shrinker() [1], for
destroy_unused_super() calls free_prealloced_shrinker() even if
prealloc_shrinker() returned an error.  Explicitly clear shrinker name
when prealloc_shrinker() called kfree().

[roman.gushchin@linux.dev: zero shrinker->name in all cases where shrinker->name is freed]
Link: https://lkml.kernel.org/r/YtgteTnQTgyuKUSY@castle
Link: https://syzkaller.appspot.com/bug?extid=8b481578352d4637f510
Link: https://lkml.kernel.org/r/ffa62ece-6a42-2644-16cf-0d33ef32c676@I-love.SAKURA.ne.jp
Fixes: e33c267ab70de424 ("mm: shrinkers: provide shrinkers with names")
Reported-by: syzbot <syzbot+8b481578352d4637f510@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm/shrinker_debug.c
mm/vmscan.c