github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

fs: fix ramfs_fs_info leak when rootfs is unmounted

Browse Source 
When rootfs is a ramfs, for example with root= on the command line, its
superblock carries a struct ramfs_fs_info from ramfs_init_fs_context().
ramfs_kill_sb() frees it, but rootfs_fs_type uses kill_anon_super().

Before commit 576ee5dfd4 ("fs: add immutable rootfs") rootfs could not
be unmounted. Since then prepare_namespace() pivots into the real root
and unmounts rootfs. When the superblock is destroyed, the structure is
leaked. kmemleak on an SH7785LCR board:

  unreferenced object 0x8100a720 (size 32):
    comm "swapper/0", pid 0, jiffies 4294892299
    backtrace (crc c8bfd23b):
      ...
      ramfs_init_fs_context+0x16/0x48
      rootfs_init_fs_context+0x16/0x2c
      alloc_fs_context+0x98/0x114
      fs_context_for_mount+0x16/0x24
      ...

Call ramfs_kill_sb() when rootfs is a ramfs. tmpfs frees its own data
in put_super and keeps kill_anon_super().

Fixes: 576ee5dfd4 ("fs: add immutable rootfs")
Reported-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://patch.msgid.link/20261009055546.85279-1-kmehltretter@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Karl Mehltretter 2026-10-09 07:55:46 +02:00 committed by Christian Brauner
parent 49184daab0
commit c60f9fe198
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
init/do_mounts.c
View File

@ -503,10 +503,18 @@ static int rootfs_init_fs_context(struct fs_context *fc)
return ramfs_init_fs_context(fc);
}
static void rootfs_kill_sb(struct super_block *sb)
{
if (IS_ENABLED(CONFIG_TMPFS) && is_tmpfs)
kill_anon_super(sb);
else
ramfs_kill_sb(sb);
}
struct file_system_type rootfs_fs_type = {
.name = "rootfs",
.init_fs_context = rootfs_init_fs_context,
.kill_sb = kill_anon_super,
.kill_sb = rootfs_kill_sb,
};
void __init init_rootfs(void)