A user powers off the device by writing 0 to `./config/nullb/nullb1/power` via the nullb configfs interface, and later powers it on by writing 1 to the same file. When the power-off command is executed, the zones created by the previous task are not freed before new zones are created upon powering on again; this results in the memory leak described in [1]. Add an operation to free zones within nullb_device_power_store(). [1] BUG: memory leak unreferenced object 0xffff888126990000 (size 56000): backtrace (crc 5c9573f8): null_init_zoned_dev+0x108/0x520 drivers/block/null_blk/zoned.c:94 null_add_dev+0x8a6/0xae0 drivers/block/null_blk/main.c:1993 nullb_device_power_store+0xf9/0x1f0 drivers/block/null_blk/main.c:501 flush_write_buffer fs/configfs/file.c:207 [inline] configfs_write_iter+0x10d/0x1a0 fs/configfs/file.c:229 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x3ac/0x720 fs/read_write.c:687 Fixes: cedcafad8277 ("nullb: add interface to power on disk") Reported-by: syzbot+f57d67a92532a98a562d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f57d67a92532a98a562d Tested-by: syzbot+f57d67a92532a98a562d@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis --- drivers/block/null_blk/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index f8c0fd57e041..fb001d002d17 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -511,6 +511,7 @@ static ssize_t nullb_device_power_store(struct config_item *item, if (test_and_clear_bit(NULLB_DEV_FL_UP, &dev->flags)) { dev->power = newp; null_del_dev(dev->nullb); + null_free_zoned_dev(dev); } clear_bit(NULLB_DEV_FL_CONFIGURED, &dev->flags); } -- 2.43.0