Forwarded: [PATCH] gfs2: fix missing kmem_cache_destroy() of sd_bufdata in gfs2_kill_sb()

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: [PATCH] gfs2: fix missing kmem_cache_destroy() of sd_bufdata in gfs2_kill_sb()
Author: kartikey406@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master


gfs2_fill_super() creates a per-superblock slab cache for gfs2_bufdata
objects with a name derived from the filesystem name:

  sdp->sd_bufdata = kmem_cache_create("gfs2-bufdata/<fsname>", ...);

However, gfs2_kill_sb() does not call kmem_cache_destroy() on this
cache during unmount. This means the cache persists after the filesystem
is unmounted, and a subsequent mount attempt will try to create a cache
with the same name, triggering a warning in kmem_cache_sanity_check():

  kmem_cache of name 'gfs2-bufdata/syz:syz' already exists
  WARNING: mm/slab_common.c:112

The error path in gfs2_fill_super() already handles this correctly via
the fail_bufdata label. Add the missing kmem_cache_destroy() call to
gfs2_kill_sb() to fix the leak on the normal unmount path.

Reported-by: syzbot+b441db1854c360b83221@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=b441db1854c360b83221
Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
---
 fs/gfs2/ops_fstype.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index b44adb40635d..38e4a9dc96bc 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1803,7 +1803,7 @@ static void gfs2_kill_sb(struct super_block *sb)
 	set_bit(SDF_KILL, &sdp->sd_flags);
 	gfs2_flush_delete_work(sdp);
 	destroy_workqueue(sdp->sd_delete_wq);
-
+	kmem_cache_destroy(sdp->sd_bufdata);
 	kill_block_super(sb);
 }
 
-- 
2.43.0