On 13/2/23 12:27, Ian Kent wrote:
On 12/2/23 03:59, Fedor Pchelkin wrote:
Syzkaller reports the leak [1]. It is reproducible.
The following patch fixes the leak. It was proposed by Takeshi Misawa
and
tested by Syzbot.
In other places of the code the waitqueue is freed when its wait_ctr
becomes zero (see autofs_wait_release). So I think it is not actually
supposed that inside autofs_catatonic_mode wait_ctr cannot be
decreased to
zero. Please correct me if I'm wrong.
This is a bit had to read but I think your saying there's an assumption
that wait_ctr can't become zero in autofs_catatonic_mode().
That's correct, the case of a waiting process getting sent a signal is
not accounted for and this can (as you observed) lead to the wait not
being freed and also not being freed at umount.
I think the change here should be sufficient to resolve the leak and
I can't think of any cases where this could cause a further problem.
Also, looking at the discussion [2] of the '[PATCH] autofs4: use
wake_up()
instead of wake_up_interruptible', shouldn't wake_up_interruptible()
inside autofs_catatonic_mode() be replaced with wake_up()?
This does imply that [2] should have been applied to
autofs_catatonic_mode()
as well, I'm still trying to grok if that change would cause side effects
for the change here but I think not.
I was going to Ack the patch but I wondering if we should wait a little
while and perhaps (probably) include the wake up call change as well.
In any case we need Al to accept it (cc'd).
Hopefully Al will offer his opinion on the changes too.
Ian
