If percpu_counter_init() fails in crypt_ctr() (e.g. when the underlying percpu allocation fails under memory pressure or fault injection), the error path jumps to "bad", which calls crypt_dtr(). crypt_dtr() then evaluates WARN_ON(percpu_counter_sum(&cc->n_allocated_pages) != 0) and calls percpu_counter_destroy() on a counter that was never initialized, because __percpu_counter_init_many() returns -ENOMEM before calling raw_spin_lock_init() on fbc->lock.
With lockdep enabled this triggers "INFO: trying to register non-static key" in __percpu_counter_sum(), as reported by syzbot. The console additionally shows "crypt: Unknown error (-ENOMEM)" because this failure path sets no ti->error. Move percpu_counter_init() to right after the allocation of cc, before ti->private is set and before any "goto bad" can happen. On failure, set ti->error and free cc directly, so that crypt_dtr() is only ever called with an initialized counter. Reported-by: [email protected] Closes: https://syzbot.org/bug?extid=4b232570d625662eaab4 Fixes: 5059353df86e ("dm crypt: limit the number of allocated pages") Cc: [email protected] Signed-off-by: Zhao Feng <[email protected]> --- Not runtime-tested (the syzbot report has no reproducer; the failure requires percpu_counter_init() to fail). The affected crypt_ctr() code is identical in current upstream master, so the patch applies there as-is. The Fixes hash was verified against the upstream commit that introduced both the init call in crypt_ctr() and the teardown in crypt_dtr(). drivers/md/dm-crypt.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 1ff16b8264..3e69dcc366 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -3249,6 +3249,14 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) ti->error = "Cannot allocate encryption context"; return -ENOMEM; } + + ret = percpu_counter_init(&cc->n_allocated_pages, 0, GFP_KERNEL); + if (ret < 0) { + ti->error = "Cannot initialize page counter"; + kfree_sensitive(cc); + return ret; + } + cc->key_size = key_size; cc->sector_size = (1 << SECTOR_SHIFT); cc->sector_shift = 0; @@ -3260,10 +3268,6 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) crypt_calculate_pages_per_client(); spin_unlock(&dm_crypt_clients_lock); - ret = percpu_counter_init(&cc->n_allocated_pages, 0, GFP_KERNEL); - if (ret < 0) - goto bad; - /* Optional parameters need to be read before cipher constructor */ if (argc > 5) { ret = crypt_ctr_optional(ti, argc - 5, &argv[5]); -- 2.39.2
