Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf

David Timber
2026-05-04T20:17:56Z

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.f2fs-use-after-free.patch --]
[-- Type: text/x-patch, Size: 1476 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..5a38b74757ca 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4595,6 +4595,8 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
return;
if (!test_bit(error, (unsigned long *)sbi->errors))
return;
+
+ f2fs_notice(sbi, "s_error_work scheduled in f2fs_handle_error() by sbi at %p", sbi);
schedule_work(&sbi->s_error_work);
}

@@ -4621,6 +4623,7 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
* in order to avoid potential deadlock when running into
* f2fs_record_stop_reason() synchronously.
*/
+ f2fs_notice(sbi, "s_error_work scheduled in f2fs_handle_critical_error() by sbi at %p", sbi);
schedule_work(&sbi->s_error_work);
}

@@ -4666,6 +4669,10 @@ static void f2fs_record_error_work(struct work_struct *work)
struct f2fs_sb_info *sbi = container_of(work,
struct f2fs_sb_info, s_error_work);

+ f2fs_notice(sbi, "f2fs_record_error_work()");
+ if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE)))
+ panic("!!! sbi at %p used after freeing !!!", sbi);
+
f2fs_record_stop_reason(sbi);
}

@@ -5454,6 +5461,7 @@ static void kill_f2fs_super(struct super_block *sb)
kill_block_super(sb);
/* Release block devices last, after fscrypt_destroy_keyring(). */
if (sbi) {
+ f2fs_notice(sbi, "freeing sbi at %px in kill_f2fs_super()", sbi);
destroy_device_list(sbi);
kfree(sbi);
sb->s_fs_info = NULL;