Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf

[David Timber <dxdt@dev.snart.me>]

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.f2fs-use-after-free.patch --]
[-- Type: text/x-patch, Size: 1476 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..5a38b74757ca 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4595,6 +4595,8 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
 		return;
 	if (!test_bit(error, (unsigned long *)sbi->errors))
 		return;
+
+	f2fs_notice(sbi, "s_error_work scheduled in f2fs_handle_error() by sbi at %p", sbi);
 	schedule_work(&sbi->s_error_work);
 }
 
@@ -4621,6 +4623,7 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
 		 * in order to avoid potential deadlock when running into
 		 * f2fs_record_stop_reason() synchronously.
 		 */
+		f2fs_notice(sbi, "s_error_work scheduled in f2fs_handle_critical_error() by sbi at %p", sbi);
 		schedule_work(&sbi->s_error_work);
 	}
 
@@ -4666,6 +4669,10 @@ static void f2fs_record_error_work(struct work_struct *work)
 	struct f2fs_sb_info *sbi = container_of(work,
 					struct f2fs_sb_info, s_error_work);
 
+	f2fs_notice(sbi, "f2fs_record_error_work()");
+	if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE)))
+		panic("!!! sbi at %p used after freeing !!!", sbi);
+
 	f2fs_record_stop_reason(sbi);
 }
 
@@ -5454,6 +5461,7 @@ static void kill_f2fs_super(struct super_block *sb)
 	kill_block_super(sb);
 	/* Release block devices last, after fscrypt_destroy_keyring(). */
 	if (sbi) {
+		f2fs_notice(sbi, "freeing sbi at %px in kill_f2fs_super()", sbi);
 		destroy_device_list(sbi);
 		kfree(sbi);
 		sb->s_fs_info = NULL;