[PATCH 1/5] powerpc/spufs: fix memory leak of spufs_fs_context in spufs_free_fc()

[Junrui Luo via B4 Relay]

From: Junrui Luo <moonafterrain@xxxxxxxxxxx>

spufs_init_fs_context() allocates both a struct spufs_fs_context stored
in fc->fs_private and a struct spufs_sb_info stored in fc->s_fs_info.
The ->free callback spufs_free_fc() only releases fc->s_fs_info.
put_fs_context() never touches fc->fs_private, since releasing it is
what ->free() exists for, and vfs_clean_context() calls ->free() and
then clears both pointers itself.

Every spufs fs_context that is constructed and torn down therefore leaks
the struct spufs_fs_context allocation. The leak is reachable without
privileges: fsopen() runs ->init_fs_context() before sget_fc() enforces
spufs's lack of FS_USERNS_MOUNT.

Free fc->fs_private alongside fc->s_fs_info.

Fixes: d2e0981c3b9a ("vfs: Convert spufs to use the new mount API")
Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
Assisted-by: Claude:claude-opus-5
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>
---
 arch/powerpc/platforms/cell/spufs/inode.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 2b54afb31529..51c432864f02 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -713,6 +713,7 @@ static int spufs_get_tree(struct fs_context *fc)
 
 static void spufs_free_fc(struct fs_context *fc)
 {
+	kfree(fc->fs_private);
 	kfree(fc->s_fs_info);
 }
 

-- 
2.51.2