On Mon, 2025-12-01 at 23:23 +0100, Mehdi Ben Hadj Khelifa wrote:
When hfsplus was converted to the new mount api a bug was introduced by changing the allocation pattern of sb->s_fs_info. If setup_bdev_super() fails after a new superblock has been allocated by sget_fc(), but before hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info data it was leaked.
Fix this by freeing sb->s_fs_info in hfsplus_kill_super().
Cc: stable@vger.kernel.org Fixes: 432f7c78cb00 ("hfsplus: convert hfsplus to use the new mount api") Reported-by: Viacheslav Dubeyko Slava.Dubeyko@ibm.com Tested-by: Viacheslav Dubeyko Slava.Dubeyko@ibm.com Signed-off-by: Christian Brauner brauner@kernel.org Signed-off-by: Mehdi Ben Hadj Khelifa mehdi.benhadjkhelifa@gmail.com
fs/hfsplus/super.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c index 16bc4abc67e0..8734520f6419 100644 --- a/fs/hfsplus/super.c +++ b/fs/hfsplus/super.c @@ -328,8 +328,6 @@ static void hfsplus_put_super(struct super_block *sb) hfs_btree_close(sbi->ext_tree); kfree(sbi->s_vhdr_buf); kfree(sbi->s_backup_vhdr_buf);
- call_rcu(&sbi->rcu, delayed_free);
- hfs_dbg("finished\n");
} @@ -629,7 +627,6 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc) out_unload_nls: unload_nls(sbi->nls); unload_nls(nls);
- kfree(sbi); return err;
} @@ -688,10 +685,18 @@ static int hfsplus_init_fs_context(struct fs_context *fc) return 0; } +static void hfsplus_kill_super(struct super_block *sb) +{
- struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
- kill_block_super(sb);
- call_rcu(&sbi->rcu, delayed_free);
+}
static struct file_system_type hfsplus_fs_type = { .owner = THIS_MODULE, .name = "hfsplus",
- .kill_sb = kill_block_super,
- .kill_sb = hfsplus_kill_super, .fs_flags = FS_REQUIRES_DEV, .init_fs_context = hfsplus_init_fs_context,
};
Looks good. Thanks a lot for the fix.
Reviewed-by: Viacheslav Dubeyko slava@dubeyko.com
Thanks, Slava.