From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f52.google.com (mail-wm1-f52.google.com [209.85.128.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 398883590AA for ; Tue, 18 Nov 2025 15:22:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763479343; cv=none; b=E5MRROF6JDakuH7YX7BTU+jvJ9oD0guU0YODszrjxXlEbQtd+tfJBVztmNBVAIhI/eOSOJ13DGG8pF4lo2w90p2m9k816166e51MsHpOPivyR7LFQfGUeJMedBrnrqyvdNd4lbGIef+4VYtk1FW44EJY358IoeJgH90M5tbB5Og= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763479343; c=relaxed/simple; bh=pIX1ASwg7OhBsi3EZ3XfrBnxCe6n/AJc03zsxsrHwP8=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=lUwCRcb7xSbV6KUK0h/V/T8Wvag88/+0D5C9Sn/4+mcvdt6zho9iKRRBQlGkGyxrymh45pt4jVFEAjhUgB7FbxjSfnEMfzQ6rukNIklyVBMPtoRH5F76OyRYnQrpP+o83RuRLDRY0hBkDL/J98aB1q5fq2VVx/l0uRjTqW7/JMA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=PM+HfwLi; arc=none smtp.client-ip=209.85.128.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="PM+HfwLi" Received: by mail-wm1-f52.google.com with SMTP id 5b1f17b1804b1-47798089d30so2392885e9.1 for ; Tue, 18 Nov 2025 07:22:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763479339; x=1764084139; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=00wCf0bwjC2Ib9qVy8nbg3pTPrjzk9HywzDkbpGaRDY=; b=PM+HfwLiPbU2+zR5eXYlkj9L4Oco2jVRXiJhj+WzE2/E6GXJnQpPiqVe42p0wtbAvy qIZ5GAKt5B3QUTMXon89q7eqIULta7YwRX2DVRY6Sh+9ZtEUSTFSj2/p90UasDho7giR rHnYIfj8KlK2Y1IIt6ve8K4cEfdXw17xkgBE1TgIaKMITb8D8PYn99Jym/7i1aBg6vOR zX+UcsAczajZM+V94AbPDjDwn4eWDCGUdCoXNQdev8wI3KOzxyMlZ5FzYWbxvDm/aMJl 0dipssG/7W3loY2zzI2PtGnm11LKlOBrnUKoFjOS46f/1b1UEFtt8q/tuUP+J670or9h DAEg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763479339; x=1764084139; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=00wCf0bwjC2Ib9qVy8nbg3pTPrjzk9HywzDkbpGaRDY=; b=QpOfIy8bkCAaqUp0W4IqZebFOS7Kd3dFuloXkKFiMu3vNXEV4smxB/ZYUicAiMxvch bR2WO1AA57VANyHdzRpScIYoXrAvwU1eZWbYX6NBSw9XLHzcGnavWKM9b1kwl+rzdz1t /gyGc02zp7U1YZDL3cCH1wlL3kyOFAWxh+Qnwt56aF4upEKjnWKBxlRx4yvsFMMLHLGO zcM+L7cLaFrQH1HYVlhuPFKXsJJMVW/tvJl+ie3/WYvuTHljAD0NXEBCvTdSvPDkxVCG Q227bBJf2g+2c+8RqCvIDt0Z1L247oob740BEfClf/rZLHSRynVTWGYgpJbuAZuYTL9V j7EQ== X-Forwarded-Encrypted: i=1; AJvYcCUbGe9whbD1llK3876AsgViBR6tIYx0EVZyKSNfqsP1nXfSayreyB8Q08nXLKG5pW8a+WEt0EXEq8NCAqY=@vger.kernel.org X-Gm-Message-State: AOJu0YwmOK4bI43eoBxxotxj358gkkt5r62oNLxjCdft2sdjBhrshP14 qVNja39PilP4Yq+y1ApFtSFmD+E9vaki+ti7xpzy1EMjb2DB6odekTnn X-Gm-Gg: ASbGncuZzcwrtSGyLA731bk/722atW/21SXKg587UjM8rDQ4FRfLqpaXXrGHVTzreqg 8d43Oq4u+h3Q0yfM1ktZ9yIGZZKFBlTr430j9m9/S5mwLPV897v7vji8AWWVaOG847iZc6N8bLs 2poz3IDVag/1VTZh9rdNybKqTBBiYcWlDFSghgL2Icm76x2v/FVB3R62b17dssUT1cwUHeD9abD 7/fuFYPv54ylpZpH48btInXrek+kYu/OPja+xIM2WO/PG+UgL2uKaz7yfaqPmQWzQxJZkqA6+a7 9YyyVsXILjQ1Pxm6nktghkSAM+synG7VYl+hwMBwEJqsyOpQxNW4oU9CKdzS+2zC3GL6t0oInKb Tv2m6v0DzrM/ztvKouTEXKyaV0OsB0RJtMUZPQGYmMxMyFZuyqkxIJ9AIazS8rsX/0w+SDDRsTI lRJXvKMIPXbSpG+HRvvpY= X-Google-Smtp-Source: AGHT+IE6FmLDcglT4gILuNBc5RTAP0dPVN+aT7yWU1j9JzA4iMRVSgkf9aSmY0C/KZIkLhmEkiHEHA== X-Received: by 2002:a05:600c:1c1f:b0:477:a478:3f94 with SMTP id 5b1f17b1804b1-477a9c3c5efmr19525875e9.5.1763479339217; Tue, 18 Nov 2025 07:22:19 -0800 (PST) Received: from [192.168.1.105] ([165.50.73.153]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4779920f2cdsm228071925e9.10.2025.11.18.07.22.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 18 Nov 2025 07:22:18 -0800 (PST) Message-ID: <6c482108-78b8-4e09-814a-67820a5c021e@gmail.com> Date: Tue, 18 Nov 2025 17:21:59 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] fs/super: fix memory leak of s_fs_info on setup_bdev_super failure To: Al Viro Cc: brauner@kernel.org, jack@suse.cz, syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com, frank.li@vivo.com, glaubitz@physik.fu-berlin.de, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, slava@dubeyko.com, syzkaller-bugs@googlegroups.com, skhan@linuxfoundation.org, david.hunter.linux@gmail.com, khalid@kernel.org, linux-kernel-mentees@lists.linuxfoundation.org References: <20251114165255.101361-1-mehdi.benhadjkhelifa@gmail.com> <20251118145957.GD2441659@ZenIV> Content-Language: en-US From: Mehdi Ben Hadj Khelifa In-Reply-To: <20251118145957.GD2441659@ZenIV> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 11/18/25 3:59 PM, Al Viro wrote: > On Fri, Nov 14, 2025 at 05:52:27PM +0100, Mehdi Ben Hadj Khelifa wrote: >> Failure in setup_bdev_super() triggers an error path where >> fc->s_fs_info ownership has already been transferred to the superblock via >> sget_fc() call in get_tree_bdev_flags() and calling put_fs_context() in >> do_new_mount() to free the s_fs_info for the specific filesystem gets >> passed in a NULL pointer. >> >> Pass back the ownership of the s_fs_info pointer to the filesystem context >> once the error path has been triggered to be cleaned up gracefully in >> put_fs_context(). >> >> Fixes: cb50b348c71f ("convenience helpers: vfs_get_super() and sget_fc()") >> Reported-by: syzbot+ad45f827c88778ff7df6@syzkaller.appspotmail.com >> Closes: https://syzkaller.appspot.com/bug?extid=ad45f827c88778ff7df6 >> Signed-off-by: Mehdi Ben Hadj Khelifa >> --- >> Note:This patch might need some more testing as I only did run selftests >> with no regression, check dmesg output for no regression, run reproducer >> with no bug. > > Almost certainly bogus; quite a few fill_super() callbacks seriously count > upon "->kill_sb() will take care care of cleanup if we return an error". So should I then free the allocated s_fs_info in the kill_block_super instead and check for the null pointer in put_fs_context to not execute kfree in subsequent call to hfs_free_fc()? Because the error generated in setup_bdev_super() when returned to do_new_mount() (after a lot of error propagation) it doesn't get handled: if (!err) err = do_new_mount_fc(fc, path, mnt_flags); put_fs_context(fc); return err; Also doesn't get handled anywhere in the call stack after IIUC: In path_mount: return do_new_mount(path, type_page, sb_flags, mnt_flags, dev_name, data_page); In do_mount: return path_mount(dev_name, &path, type_page, flags, data_page); So what is recommended in this case ? Best Regards, Mehdi Ben Hadj Khelifa