linux-yocto/drivers/block
Nilay Shroff f1718da051 null_blk: fix kmemleak by releasing references to fault configfs items
commit 40b94ec7edbbb867c4e26a1a43d2b898f04b93c5 upstream.

When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk
driver sets up fault injection support by creating the timeout_inject,
requeue_inject, and init_hctx_fault_inject configfs items as children
of the top-level nullbX configfs group.

However, when the nullbX device is removed, the references taken to
these fault-config configfs items are not released. As a result,
kmemleak reports a memory leak, for example:

unreferenced object 0xc00000021ff25c40 (size 32):
  comm "mkdir", pid 10665, jiffies 4322121578
  hex dump (first 32 bytes):
    69 6e 69 74 5f 68 63 74 78 5f 66 61 75 6c 74 5f  init_hctx_fault_
    69 6e 6a 65 63 74 00 88 00 00 00 00 00 00 00 00  inject..........
  backtrace (crc 1a018c86):
    __kmalloc_node_track_caller_noprof+0x494/0xbd8
    kvasprintf+0x74/0xf4
    config_item_set_name+0xf0/0x104
    config_group_init_type_name+0x48/0xfc
    fault_config_init+0x48/0xf0
    0xc0080000180559e4
    configfs_mkdir+0x304/0x814
    vfs_mkdir+0x49c/0x604
    do_mkdirat+0x314/0x3d0
    sys_mkdir+0xa0/0xd8
    system_call_exception+0x1b0/0x4f0
    system_call_vectored_common+0x15c/0x2ec

Fix this by explicitly releasing the references to the fault-config
configfs items when dropping the reference to the top-level nullbX
configfs group.

Cc: stable@vger.kernel.org
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Fixes: bb4c19e030 ("block: null_blk: make fault-injection dynamically configurable per device")
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-01-23 11:21:24 +01:00
..
aoe Summary of significant series in this pull request: 2025-10-02 18:18:33 -07:00
drbd drbd: init queue_limits->max_hw_wzeroes_unmap_sectors parameter 2025-09-17 08:20:49 -06:00
mtip32xx block: switch ->getgeo() to struct gendisk 2025-08-13 02:59:29 -04:00
null_blk null_blk: fix kmemleak by releasing references to fault configfs items 2026-01-23 11:21:24 +01:00
rnbd block: rnbd-clt: Fix signedness bug in init_dev() 2026-01-02 12:57:04 +01:00
rnull rnull: add soft-irq completion support 2025-09-02 05:23:56 -06:00
xen-blkback xen/blkback: convert timeouts to secs_to_jiffies() 2025-01-12 20:21:03 -08:00
zram Summary of significant series in this pull request: 2025-10-02 18:18:33 -07:00
amiflop.c block: switch ->getgeo() to struct gendisk 2025-08-13 02:59:29 -04:00
ataflop.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
brd.c brd: use page reference to protect page lifetime 2025-09-01 08:37:29 -06:00
floppy.c floppy: fix for PAGE_SIZE != 4KB 2026-01-02 12:57:08 +01:00
Kconfig rnull: move driver to separate directory 2025-09-02 05:23:56 -06:00
loop.c loop: remove redundant __GFP_NOWARN flag 2025-10-08 06:27:53 -06:00
Makefile rnull: move driver to separate directory 2025-09-02 05:23:56 -06:00
n64cart.c
nbd.c nbd: defer config unlock in nbd_genl_connect 2025-12-18 14:02:56 +01:00
ps3disk.c ps3disk: use memcpy_{from,to}_bvec index 2025-12-18 14:03:00 +01:00
ps3vram.c
rbd_types.h
rbd.c drivers/block: WQ_PERCPU added to alloc_workqueue users 2025-09-09 09:11:31 -06:00
sunvdc.c drivers/block: WQ_PERCPU added to alloc_workqueue users 2025-09-09 09:11:31 -06:00
swim_asm.S
swim.c block: switch ->getgeo() to struct gendisk 2025-08-13 02:59:29 -04:00
swim3.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ublk_drv.c ublk: fix use-after-free in ublk_partition_scan_work 2026-01-17 16:35:30 +01:00
virtio_blk.c drivers/block: WQ_PERCPU added to alloc_workqueue users 2025-09-09 09:11:31 -06:00
xen-blkfront.c block: switch ->getgeo() to struct gendisk 2025-08-13 02:59:29 -04:00
z2ram.c block: remove BLK_MQ_F_SHOULD_MERGE 2024-12-23 08:17:23 -07:00
zloop.c zloop: make the write pointer of full zones invalid 2026-01-02 12:57:28 +01:00