syzbot wrote:
> > On Sun, Mar 4, 2018 at 6:57 AM, Tetsuo Handa
> > <penguin-kernel@xxxxxxxxxxxxxxxxxxx> wrote:
> >> Switching from mm to fsdevel, for this report says that put_net(net) in
> >> rpc_kill_sb() made net->count < 0 when mount_ns() failed due to
> >> register_shrinker() failure.
>
> >> Relevant commits will be
> >> commit 9ee332d99e4d5a97 ("sget(): handle failures of
> >> register_shrinker()") and
> >> commit d91ee87d8d85a080 ("vfs: Pass data, ns, and ns->userns to
> >> mount_ns.").
>
> >> When sget_userns() in mount_ns() failed, mount_ns() returns an error
> >> code to
> >> the caller without calling fill_super(). That is, get_net(sb->s_fs_info)
> >> was
> >> not called by rpc_fill_super() (via fill_super callback passed to
> >> mount_ns())
> >> but put_net(sb->s_fs_info) is called by rpc_kill_sb() (via fs->kill_sb()
> >> from
> >> deactivate_locked_super()).
>
> >> ----------
> >> static struct dentry *
> >> rpc_mount(struct file_system_type *fs_type,
> >> int flags, const char *dev_name, void *data)
> >> {
> >> struct net *net = current->nsproxy->net_ns;
> >> return mount_ns(fs_type, flags, data, net, net->user_ns,
> >> rpc_fill_super);
> >> }
> >> ----------
>
> > Messed kernel output, this is definitely not in should_fail.
>
> > #syz dup: WARNING: refcount bug in sk_alloc
>
> Can't find the corresponding bug.
>
I don't think this is a dup of existing bug.
We need to fix either 9ee332d99e4d5a97 or d91ee87d8d85a080.
