[lvc-project] [PATCH] bcachefs: fix memory leak in bch2_setattr_nonsize_trans()

[Fedor Pchelkin]

On Thu, 20. Aug 19:08, Dmitry Antipov wrote:
> Local fuzzing of 6.12.103 has found the following memory leak:
> 
> unreferenced object 0xffff888105f40700 (size 64):
>   comm "syz.0.17", pid 10384, jiffies 4294952060
>   hex dump (first 32 bytes):
>     01 00 00 00 80 88 ff ff 0c 00 00 00 ad 04 74 01  ..............t.
>     00 00 b0 7f 10 f7 00 00 04 00 00 00 01 00 07 00  ................
>   backtrace (crc 8943d909):
>     kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
>     slab_post_alloc_hook mm/slub.c:4166 [inline]
>     slab_alloc_node mm/slub.c:4211 [inline]
>     __do_kmalloc_node mm/slub.c:4345 [inline]
>     __kmalloc_node_track_caller_noprof+0x1ee/0x3d0 mm/slub.c:4365
>     kmemdup_noprof+0x2b/0x70 mm/util.c:133
>     kmemdup_noprof include/linux/fortify-string.h:753 [inline]
>     posix_acl_clone fs/posix_acl.c:232 [inline]
>     __posix_acl_chmod+0x78/0x500 fs/posix_acl.c:583
>     bch2_acl_chmod+0x523/0x800 fs/bcachefs/acl.c:430
>     bch2_setattr_nonsize+0xbb8/0xfc0 fs/bcachefs/fs.c:1063
>     notify_change+0xb2b/0xe30 fs/attr.c:503
>     chmod_common+0x1a7/0x2f0 fs/open.c:651
>     do_fchmodat+0x91/0x130 fs/open.c:697
>     __do_sys_fchmodat fs/open.c:716 [inline]
>     __se_sys_fchmodat fs/open.c:713 [inline]
>     __x64_sys_fchmodat+0x7d/0x90 fs/open.c:713
>     do_syscall_x64 arch/x86/entry/common.c:47 [inline]
>     do_syscall_64+0xbe/0x1a0 arch/x86/entry/common.c:78
>     entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> Fix this by using 'posix_acl_release()' to balance refcounting
> of the corresponding 'struct posix_acl' object.
> 
> Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>

Please clarify why there is a refcounting problem.  What is the root
cause?