Re: [PATCH] fs: fix s_fs_info leak when setup_bdev_super() fails

[Christian Brauner]

On Sat, Aug 22, 2026 at 10:39:18AM +0800, hanzhijian wrote:
> get_tree_bdev_flags() hands fc->s_fs_info to the newly allocated
> super block in sget_fc() and clears fc->s_fs_info.  If
> setup_bdev_super() then fails (the block device cannot be opened, is
> read-only, or is frozen), fill_super() is never called and sb->s_root
> stays NULL.  The cleanup path calls deactivate_locked_super(), whose
> generic_shutdown_super() skips the whole sb->s_root block -- including
> the put_super() callback that would otherwise release s_fs_info --
> leaking the allocation made by the filesystem's init_fs_context().
> 
> Hand s_fs_info back to the fs_context when setup_bdev_super() fails so
> that put_fs_context() releases it through the filesystem's free()
> callback.
> 
> Reported-by: syzbot+1c70732df5fd4f0e4fbb@xxxxxxxxxxxxxxxxxxxxxxxxx
> Link: https://syzkaller.appspot.com/bug?extid=1c70732df5fd4f0e4fbb
> Signed-off-by: hanzhijian <hanzhijian1991@xxxxxxxxx>
> ---

There's a fix for this in vfs.fixes. This is the wrong layer.