fs: erofs: add sanity check for kobject in erofs_unregister_sysfs

mudongliang · hsiangkao · commit a942da24abc5 · 2022-03-17T00:09:02.000+08:00
Syzkaller hit 'WARNING: kobject bug in erofs_unregister_sysfs'. This bug is triggered by injecting fault in kobject_init_and_add of erofs_unregister_sysfs. Fix this by adding sanity check for kobject in erofs_unregister_sysfs Note that I've tested the patch and the crash does not occur any more. Link: https://lore.kernel.org/r/20220315132814.12332-1-dzm91@hust.edu.cn Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com> Fixes: 168e9a7 ("erofs: add sysfs interface") Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com> Reviewed-by: Chao Yu <chao@kernel.org> Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
diff --git a/fs/erofs/sysfs.c b/fs/erofs/sysfs.c
@@ -221,9 +221,11 @@ void erofs_unregister_sysfs(struct super_block *sb)
 {
 	struct erofs_sb_info *sbi = EROFS_SB(sb);
 
-	kobject_del(&sbi->s_kobj);
-	kobject_put(&sbi->s_kobj);
-	wait_for_completion(&sbi->s_kobj_unregister);
+	if (sbi->s_kobj.state_in_sysfs) {
+		kobject_del(&sbi->s_kobj);
+		kobject_put(&sbi->s_kobj);
+		wait_for_completion(&sbi->s_kobj_unregister);
+	}
 }
 
 int __init erofs_init_sysfs(void)

Original file line number	Diff line number	Diff line change
`@@ -221,9 +221,11 @@ void erofs_unregister_sysfs(struct super_block *sb)`
`221`	`221`	`{`
`222`	`222`	`struct erofs_sb_info *sbi = EROFS_SB(sb);`
`223`	`223`
`224`		`- kobject_del(&sbi->s_kobj);`
`225`		`- kobject_put(&sbi->s_kobj);`
`226`		`- wait_for_completion(&sbi->s_kobj_unregister);`
	`224`	`+ if (sbi->s_kobj.state_in_sysfs) {`
	`225`	`+ kobject_del(&sbi->s_kobj);`
	`226`	`+ kobject_put(&sbi->s_kobj);`
	`227`	`+ wait_for_completion(&sbi->s_kobj_unregister);`
	`228`	`+ }`
`227`	`229`	`}`
`228`	`230`
`229`	`231`	`int __init erofs_init_sysfs(void)`