public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf
@ 2026-05-03  6:00 David Timber
  2026-05-03  7:17 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
  0 siblings, 1 reply; 6+ messages in thread
From: David Timber @ 2026-05-03  6:00 UTC (permalink / raw)
  To: syzbot
  Cc: linux-f2fs-devel, linux-fsdevel, linux-kernel, linux-mm,
	syzkaller-bugs

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.patch --]
[-- Type: text/x-patch, Size: 545 bytes --]

diff --git a/fs/exfat/super.c b/fs/exfat/super.c
index 95d87e2d7717..df10d9a79a29 100644
--- a/fs/exfat/super.c
+++ b/fs/exfat/super.c
@@ -656,6 +656,7 @@ static int __exfat_fill_super(struct super_block *sb,
 free_alloc_bitmap:
 	exfat_free_bitmap(sbi);
 free_bh:
+	exfat_free_upcase_table(sbi);
 	brelse(sbi->boot_bh);
 	return ret;
 }
@@ -752,6 +753,7 @@ static int exfat_get_tree(struct fs_context *fc)
 
 static void exfat_free_sbi(struct exfat_sb_info *sbi)
 {
+	exfat_free_upcase_table(sbi);
 	exfat_free_iocharset(sbi);
 	kfree(sbi);
 }

[-- Attachment #3: syz-cae7809e9dc1459e4e63.f2fs-crippled.patch --]
[-- Type: text/x-patch, Size: 468 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..fd2499fe156b 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -5388,7 +5388,10 @@ static int f2fs_fill_super(struct super_block *sb, struct fs_context *fc)
 
 static int f2fs_get_tree(struct fs_context *fc)
 {
-	return get_tree_bdev(fc, f2fs_fill_super);
+	if (true)
+		return -ENOMEM;
+	else
+		return get_tree_bdev(fc, f2fs_fill_super);
 }
 
 static int f2fs_reconfigure(struct fs_context *fc)

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf
@ 2026-05-03  6:05 David Timber
  2026-05-03  7:27 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
  0 siblings, 1 reply; 6+ messages in thread
From: David Timber @ 2026-05-03  6:05 UTC (permalink / raw)
  To: syzbot
  Cc: linux-f2fs-devel, linux-fsdevel, linux-kernel, linux-mm,
	syzkaller-bugs

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.f2fs-crippled.patch --]
[-- Type: text/x-patch, Size: 468 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..fd2499fe156b 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -5388,7 +5388,10 @@ static int f2fs_fill_super(struct super_block *sb, struct fs_context *fc)
 
 static int f2fs_get_tree(struct fs_context *fc)
 {
-	return get_tree_bdev(fc, f2fs_fill_super);
+	if (true)
+		return -ENOMEM;
+	else
+		return get_tree_bdev(fc, f2fs_fill_super);
 }
 
 static int f2fs_reconfigure(struct fs_context *fc)

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf
@ 2026-05-04 20:17 David Timber
  2026-05-04 20:51 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
  0 siblings, 1 reply; 6+ messages in thread
From: David Timber @ 2026-05-04 20:17 UTC (permalink / raw)
  To: syzbot
  Cc: linux-f2fs-devel, linux-fsdevel, linux-kernel, linux-mm,
	syzkaller-bugs

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.f2fs-use-after-free.patch --]
[-- Type: text/x-patch, Size: 1476 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..5a38b74757ca 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4595,6 +4595,8 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
 		return;
 	if (!test_bit(error, (unsigned long *)sbi->errors))
 		return;
+
+	f2fs_notice(sbi, "s_error_work scheduled in f2fs_handle_error() by sbi at %p", sbi);
 	schedule_work(&sbi->s_error_work);
 }
 
@@ -4621,6 +4623,7 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
 		 * in order to avoid potential deadlock when running into
 		 * f2fs_record_stop_reason() synchronously.
 		 */
+		f2fs_notice(sbi, "s_error_work scheduled in f2fs_handle_critical_error() by sbi at %p", sbi);
 		schedule_work(&sbi->s_error_work);
 	}
 
@@ -4666,6 +4669,10 @@ static void f2fs_record_error_work(struct work_struct *work)
 	struct f2fs_sb_info *sbi = container_of(work,
 					struct f2fs_sb_info, s_error_work);
 
+	f2fs_notice(sbi, "f2fs_record_error_work()");
+	if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE)))
+		panic("!!! sbi at %p used after freeing !!!", sbi);
+
 	f2fs_record_stop_reason(sbi);
 }
 
@@ -5454,6 +5461,7 @@ static void kill_f2fs_super(struct super_block *sb)
 	kill_block_super(sb);
 	/* Release block devices last, after fscrypt_destroy_keyring(). */
 	if (sbi) {
+		f2fs_notice(sbi, "freeing sbi at %px in kill_f2fs_super()", sbi);
 		destroy_device_list(sbi);
 		kfree(sbi);
 		sb->s_fs_info = NULL;

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf
@ 2026-05-04 20:26 David Timber
  2026-05-04 21:12 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
  0 siblings, 1 reply; 6+ messages in thread
From: David Timber @ 2026-05-04 20:26 UTC (permalink / raw)
  To: syzbot
  Cc: linux-f2fs-devel, linux-fsdevel, linux-kernel, linux-mm,
	syzkaller-bugs

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.f2fs-dont-use-after-free.patch --]
[-- Type: text/x-patch, Size: 914 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..7aba99e1f93f 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4595,6 +4595,12 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
 		return;
 	if (!test_bit(error, (unsigned long *)sbi->errors))
 		return;
+
+	if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE))) {
+		f2fs_warn(sbi, "f2fs_handle_error() called upon sb_put");
+		return;
+	}
+
 	schedule_work(&sbi->s_error_work);
 }
 
@@ -4621,7 +4627,10 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
 		 * in order to avoid potential deadlock when running into
 		 * f2fs_record_stop_reason() synchronously.
 		 */
-		schedule_work(&sbi->s_error_work);
+		if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE)))
+			f2fs_warn(sbi, "f2fs_handle_critical_error() called upon sb_put");
+		else
+			schedule_work(&sbi->s_error_work);
 	}
 
 	/*

^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-05-04 21:12 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
     [not found] <ffd7be2b-8da4-45bd-b8a3-881855815bc6@dev.snart.me>
2026-05-02 12:02 ` [syzbot] [mm?] [exfat?] [f2fs?] memory leak in __kfree_rcu_sheaf syzbot
2026-05-03  6:00 [syzbot] [mm?] [f2fs?] [exfat?] " David Timber
2026-05-03  7:17 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
  -- strict thread matches above, loose matches on Subject: below --
2026-05-03  6:05 [syzbot] [mm?] [f2fs?] [exfat?] " David Timber
2026-05-03  7:27 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
2026-05-03  7:41   ` David Timber
2026-05-04 20:17 [syzbot] [mm?] [f2fs?] [exfat?] " David Timber
2026-05-04 20:51 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot
2026-05-04 20:26 [syzbot] [mm?] [f2fs?] [exfat?] " David Timber
2026-05-04 21:12 ` [syzbot] [mm?] [exfat?] [f2fs?] " syzbot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox