Re: Fw:Re: [PATCH] fs: nilfs2: fix memory leak in nilfs sysfs create device group

[Pavel Skripkin <paskripkin@gmail.com>]

Hi Dongliang,

On 3/9/22 11:30, Dongliang Mu wrote:
>> Now I am checking the log and trying to find error injection in the
>> log file, as said by Pavel.
> 
> Attached is the report and log file.
> 
> @Pavel Skripkin I don't find any useful error injection in the log file.
> 
> In case I made some mistakes, I will clean up my local crash reports,
> update to the latest upstream kernel and restart the syzkaller. Let's
> see if the crash still occurs.

The execution path is clear from the logs. Quick grep for nilfs shows 
these lines

[  886.701044][T25972] NILFS (loop2): broken superblock, retrying with 
spare superblock (blocksize = 1024)
[  886.703251][T25972] NILFS (loop2): broken superblock, retrying with 
spare superblock (blocksize = 4096)
[  886.706454][T25972] NILFS (loop2): error -4 creating segctord thread

So here is calltrace:

nilfs_fill_super
   nilfs_attach_log_writer
     nilfs_segctor_start_thread <- failed


In case of nilfs_attach_log_writer() error code jumps to 
failed_checkpoint label and calls destroy_nilfs() which should call 
nilfs_sysfs_delete_device_group().


So I can really see how this leak is possible on top of current Linus' HEAD.


Also in the log there are onlyh 4 syz_mount_image$nilfs2 programs, so 
only one of them may be a reproducer. If you have spare time you can try 
to execute them using syz-execprog and see if it works :))



With regards,
Pavel Skripkin