commit ba2d9befae88c57e7e9c4d3e0405c07b8dbf9095
author Pavel Skripkin <paskripkin@gmail.com> Mon Apr 12 22:44:57 2021 +0300
committer Pavel Skripkin <paskripkin@gmail.com> Mon Apr 12 22:54:58 2021 +0300
tree b6c63257811cc3e584ad8bb423d3f606694e7f4b
parent 17e7124aad766b3f158943acb51467f86220afe9

ext4: fix memory leak in ext4_fill_super

syzbot reported memory leak in ext4 subsyetem.
The problem was in case sbi->s_mmp_tsk hasn’t started
at the time of kthread_stop() call. In that case data allocated
for this thread won't be freed.

Reported-by: syzbot+d9e482e303930fa4f6ff@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Change-Id: Iad957917c0cbaa52dfbe677b6fe0d1635da9c2bf

fs/ext4/super.c

diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index b969368..9c33e97 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -5156,8 +5156,10 @@
 failed_mount3:
 	flush_work(&sbi->s_error_work);
 	del_timer_sync(&sbi->s_err_report);
-	if (sbi->s_mmp_tsk)
-		kthread_stop(sbi->s_mmp_tsk);
+	if (sbi->s_mmp_tsk) {
+		if (kthread_stop(sbi->s_mmp_tsk) == -EINTR)
+			kfree(kthread_data(sbi->s_mmp_tsk));
+	}
 failed_mount2:
 	rcu_read_lock();
 	group_desc = rcu_dereference(sbi->s_group_desc);