[CVE-2024-25740] mm/slab: Allow cache creation to proceed even if sysfs registration fails

[TrietHoang-DL]

mm/slab: Allow cache creation to proceed even if sysfs registration fails

[ Upstream commit 2420baa ]

When kobject_init_and_add() fails during cache creation, kobj->name can be leaked because SLUB does not call kobject_put(), which should be invoked per the kobject API documentation. This has a bit of historical context, though; SLUB does not call kobject_put() to avoid double-free for struct kmem_cache because 1) simply calling it would free all resources related to the cache, and 2) struct kmem_cache descriptor is always freed by cache_cache()'s error handling path, causing struct kmem_cache to be freed twice.

This issue can be reproduced by creating new slab caches while applying failslab for kernfs_node_cache. This makes kobject_add_varg() succeed, but causes kobject_add_internal() to fail in kobject_init_and_add() during cache creation.

Historically, this issue has attracted developers' attention several times. Each time a fix addressed either the leak or the double-free, it caused the other issue. Let's summarize a bit of history here:

The leak has existed since the early days of SLUB.

Commit 54b6a73 ("slub: fix leak of 'name' in sysfs_slab_add")
introduced a double-free bug while fixing the leak.

Commit 80da026 ("mm/slub: fix slab double-free in case of duplicate
sysfs filename") re-introduced the leak while fixing the double-free
error.

Commit dde3c6b ("mm/slub: fix a memory leak in sysfs_slab_add()")
fixed the memory leak, but it was later reverted by commit 757fed1
("Revert "mm/slub: fix a memory leak in sysfs_slab_add()"") to avoid
the double-free error.

This is where we are now: we've chosen a memory leak over a double-free.

To resolve this memory leak, skip creating sysfs files if it fails and continue with cache creation regardless (as suggested by Christoph). This resolves the memory leak because both the cache and the kobject remain alive on kobject_init_and_add() failure.

If SLUB tries to create an alias for a cache without sysfs files, its symbolic link will not be generated.

Since a slab cache might not have associated sysfs files, call kobject_del() only if such files exist.