Re: [syzbot] [mm?] [f2fs?] [exfat?] memory leak in __kfree_rcu_sheaf

David Timber
2026-05-04T20:26:06Z

[-- Attachment #1: Type: text/plain, Size: 9 bytes --]

#syz test

[-- Attachment #2: syz-cae7809e9dc1459e4e63.f2fs-dont-use-after-free.patch --]
[-- Type: text/x-patch, Size: 914 bytes --]

diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index c4c225e09dc4..7aba99e1f93f 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4595,6 +4595,12 @@ void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error)
return;
if (!test_bit(error, (unsigned long *)sbi->errors))
return;
+
+ if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE))) {
+ f2fs_warn(sbi, "f2fs_handle_error() called upon sb_put");
+ return;
+ }
+
schedule_work(&sbi->s_error_work);
}

@@ -4621,7 +4627,10 @@ void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason)
* in order to avoid potential deadlock when running into
* f2fs_record_stop_reason() synchronously.
*/
- schedule_work(&sbi->s_error_work);
+ if (unlikely(is_sbi_flag_set(sbi, SBI_IS_CLOSE)))
+ f2fs_warn(sbi, "f2fs_handle_critical_error() called upon sb_put");
+ else
+ schedule_work(&sbi->s_error_work);
}

/*