mm: double-free in cgwb_bdi_init

[Dmitry Vyukov]

Hello,

syzkaller hit the following report on linux-next
eb60f01302b24ce93108414e2c4c673cb7cd6e05:

BUG: Double free or freeing an invalid pointer
CPU: 0 PID: 15931 Comm: syz-executor2 Not tainted 4.10.0-rc7-next-20170207 #1
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 01/01/2011

Call Trace:
 kfree+0xd3/0x250 mm/slab.c:3819
 cgwb_bdi_init mm/backing-dev.c:764 [inline]
 bdi_init+0xbf5/0xed0 mm/backing-dev.c:788
 bdi_setup_and_register+0x70/0x100 mm/backing-dev.c:929
 v9fs_session_init+0x17b/0x1a00 fs/9p/v9fs.c:335
 v9fs_mount+0x81/0x830 fs/9p/vfs_super.c:130
 mount_fs+0x97/0x2e0 fs/super.c:1223
 vfs_kern_mount.part.24+0xc6/0x430 fs/namespace.c:976
 vfs_kern_mount fs/namespace.c:2509 [inline]
 do_new_mount fs/namespace.c:2512 [inline]
 do_mount+0x426/0x2ec0 fs/namespace.c:2834
 SYSC_mount fs/namespace.c:3050 [inline]
 SyS_mount+0xab/0x120 fs/namespace.c:3027
 entry_SYSCALL_64_fastpath+0x1f/0xc2

Object at ffff8801d1c30340, in cache kmalloc-32 size: 32
Allocated:
PID = 15931
[<ffffffff8193e1d6>] kzalloc include/linux/slab.h:638 [inline]
[<ffffffff8193e1d6>] cgwb_bdi_init mm/backing-dev.c:758 [inline]
[<ffffffff8193e1d6>] bdi_init+0x346/0xed0 mm/backing-dev.c:788
[<ffffffff8193f5e0>] bdi_setup_and_register+0x70/0x100 mm/backing-dev.c:929
[<ffffffff8209815b>] v9fs_session_init+0x17b/0x1a00 fs/9p/v9fs.c:335
[<ffffffff82086101>] v9fs_mount+0x81/0x830 fs/9p/vfs_super.c:130
[<ffffffff81a92ff7>] mount_fs+0x97/0x2e0 fs/super.c:1223
[<ffffffff81b0c036>] vfs_kern_mount.part.24+0xc6/0x430 fs/namespace.c:976
[<ffffffff81b16c56>] vfs_kern_mount fs/namespace.c:2509 [inline]
[<ffffffff81b16c56>] do_new_mount fs/namespace.c:2512 [inline]
[<ffffffff81b16c56>] do_mount+0x426/0x2ec0 fs/namespace.c:2834
[<ffffffff81b1a23b>] SYSC_mount fs/namespace.c:3050 [inline]
[<ffffffff81b1a23b>] SyS_mount+0xab/0x120 fs/namespace.c:3027

Freed:
PID = 15931
[<ffffffff81a360d3>] kfree+0xd3/0x250 mm/slab.c:3819
[<ffffffff8193ea97>] wb_congested_put include/linux/backing-dev.h:440 [inline]
[<ffffffff8193ea97>] wb_init mm/backing-dev.c:337 [inline]
[<ffffffff8193ea97>] cgwb_bdi_init mm/backing-dev.c:762 [inline]
[<ffffffff8193ea97>] bdi_init+0xc07/0xed0 mm/backing-dev.c:788
[<ffffffff8193f5e0>] bdi_setup_and_register+0x70/0x100 mm/backing-dev.c:929
[<ffffffff8209815b>] v9fs_session_init+0x17b/0x1a00 fs/9p/v9fs.c:335
[<ffffffff82086101>] v9fs_mount+0x81/0x830 fs/9p/vfs_super.c:130
[<ffffffff81a92ff7>] mount_fs+0x97/0x2e0 fs/super.c:1223
[<ffffffff81b0c036>] vfs_kern_mount.part.24+0xc6/0x430 fs/namespace.c:976
[<ffffffff81b16c56>] vfs_kern_mount fs/namespace.c:2509 [inline]
[<ffffffff81b16c56>] do_new_mount fs/namespace.c:2512 [inline]
[<ffffffff81b16c56>] do_mount+0x426/0x2ec0 fs/namespace.c:2834
[<ffffffff81b1a23b>] SYSC_mount fs/namespace.c:3050 [inline]
[<ffffffff81b1a23b>] SyS_mount+0xab/0x120 fs/namespace.c:3027
[<ffffffff844ca541>] entry_SYSCALL_64_fastpath+0x1f/0xc2


It all happens in the context on a single syscall. Also right before
that there was a bunch of allocation failures:

https://gist.githubusercontent.com/dvyukov/a840e280871136fc9654833e59970342/raw/385864d7584a4575ca5b9e2cc70815b9516b6598/gistfile1.txt

So this looks like a straight double-free on error path.