loop: remember whether sysfs_create_group() was done

commit d3349b6b3c373ac1fbfb040b810fcee5e2adc7e0 upstream.

syzbot is hitting WARN() triggered by memory allocation fault
injection [1] because loop module is calling sysfs_remove_group()
when sysfs_create_group() failed.
Fix this by remembering whether sysfs_create_group() succeeded.

[1] https://syzkaller.appspot.com/bug?id=3f86c0edf75c86d2633aeb9dd69eccc70bc7e90b

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+9f03168400f56df89dbc6f1751f4458fe739ff29@syzkaller.appspotmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Renamed sysfs_ready -> sysfs_inited.

Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index ac99d2b6e3f543f197c0cc1694996383d3f58f22..6d61633a7f899f0bc2d98eaffc018c46d954205e 100644 (file)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -806,16 +806,17 @@ static struct attribute_group loop_attribute_group = {
        .attrs= loop_attrs,
 };
 
-static int loop_sysfs_init(struct loop_device *lo)
+static void loop_sysfs_init(struct loop_device *lo)
 {
-       return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
-                                 &loop_attribute_group);
+       lo->sysfs_inited = !sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
+                                               &loop_attribute_group);
 }
 
 static void loop_sysfs_exit(struct loop_device *lo)
 {
-       sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
-                          &loop_attribute_group);
+       if (lo->sysfs_inited)
+               sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
+                                  &loop_attribute_group);
 }
 
 static void loop_config_discard(struct loop_device *lo)

diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index 1f3956702993883859070b2ef39a9b164978a213..dfc54ceba410a87c5a42cd7861aff3d543c3cba0 100644 (file)
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -58,6 +58,7 @@ struct loop_device {
        struct kthread_worker   worker;
        struct task_struct      *worker_task;
        bool                    use_dio;
+       bool                    sysfs_inited;
 
        struct request_queue    *lo_queue;
        struct blk_mq_tag_set   tag_set;