Messages in this thread Patch in this message | | | Date | Wed, 20 Jul 2022 23:47:55 +0900 | From | Tetsuo Handa <> | Subject | [PATCH] mm: shrinkers: fix double kfree on shrinker name |
| |
syzbot is reporting double kfree() at free_prealloced_shrinker() [1], for destroy_unused_super() calls free_prealloced_shrinker() even if prealloc_shrinker() returned an error. Explicitly clear shrinker name when prealloc_shrinker() called kfree().
Link: https://syzkaller.appspot.com/bug?extid=8b481578352d4637f510 [1] Reported-by: syzbot <syzbot+8b481578352d4637f510@syzkaller.appspotmail.com> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Fixes: e33c267ab70de424 ("mm: shrinkers: provide shrinkers with names") --- mm/vmscan.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/mm/vmscan.c b/mm/vmscan.c index 64ffdcd019a9..3302d9ed332e 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -707,8 +707,10 @@ int register_shrinker(struct shrinker *shrinker, const char *fmt, ...) return -ENOMEM; err = __register_shrinker(shrinker); - if (err) + if (err) { kfree_const(shrinker->name); + shrinker->name = NULL; + } return err; } #else -- 2.18.4
| |