loop: remember whether sysfs_create_group() was done

syzbot is hitting WARN() triggered by memory allocation fault
injection [1] because loop module is calling sysfs_remove_group()
when sysfs_create_group() failed.
Fix this by remembering whether sysfs_create_group() succeeded.

[1] https://syzkaller.appspot.com/bug?id=3f86c0edf75c86d2633aeb9dd69eccc70bc7e90b

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: syzbot <syzbot+9f03168400f56df89dbc6f1751f4458fe739ff29@syzkaller.appspotmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Renamed sysfs_ready -> sysfs_inited.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 5d4e31655d9629732c42b02a602ebdc20bec2cda..5f0df2efc26c984d41957959378204e385765901 100644 (file)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -809,16 +809,17 @@ static struct attribute_group loop_attribute_group = {
        .attrs= loop_attrs,
 };
 
-static int loop_sysfs_init(struct loop_device *lo)
+static void loop_sysfs_init(struct loop_device *lo)
 {
-       return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
-                                 &loop_attribute_group);
+       lo->sysfs_inited = !sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj,
+                                               &loop_attribute_group);
 }
 
 static void loop_sysfs_exit(struct loop_device *lo)
 {
-       sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
-                          &loop_attribute_group);
+       if (lo->sysfs_inited)
+               sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj,
+                                  &loop_attribute_group);
 }
 
 static void loop_config_discard(struct loop_device *lo)

diff --git a/drivers/block/loop.h b/drivers/block/loop.h
index b78de9879f4f2f95409425d14d2197bc38d0c6c1..4d42c7af7de750e8f72e74bf0edb0b2ce26d2208 100644 (file)
--- a/drivers/block/loop.h
+++ b/drivers/block/loop.h
@@ -58,6 +58,7 @@ struct loop_device {
        struct kthread_worker   worker;
        struct task_struct      *worker_task;
        bool                    use_dio;
+       bool                    sysfs_inited;
 
        struct request_queue    *lo_queue;
        struct blk_mq_tag_set   tag_set;