Re: [PATCH] fs: fix ramfs_fs_info leak when rootfs is unmounted

[Zenghui Yu]

On 10/9/26 1:55 PM, Karl Mehltretter wrote:
> When rootfs is a ramfs, for example with root= on the command line, its
> superblock carries a struct ramfs_fs_info from ramfs_init_fs_context().
> ramfs_kill_sb() frees it, but rootfs_fs_type uses kill_anon_super().
> 
> Before commit 576ee5dfd459 ("fs: add immutable rootfs") rootfs could not
> be unmounted. Since then prepare_namespace() pivots into the real root
> and unmounts rootfs. When the superblock is destroyed, the structure is
> leaked. kmemleak on an SH7785LCR board:
> 
>   unreferenced object 0x8100a720 (size 32):
>     comm "swapper/0", pid 0, jiffies 4294892299
>     backtrace (crc c8bfd23b):
>       ...
>       ramfs_init_fs_context+0x16/0x48
>       rootfs_init_fs_context+0x16/0x2c
>       alloc_fs_context+0x98/0x114
>       fs_context_for_mount+0x16/0x24
>       ...
> 
> Call ramfs_kill_sb() when rootfs is a ramfs. tmpfs frees its own data
> in put_super and keeps kill_anon_super().
> 
> Fixes: 576ee5dfd459 ("fs: add immutable rootfs")
> Reported-by: John Paul Adrian Glaubitz <glaubitz@xxxxxxxxxxxxxxxxxxx>
> Assisted-by: LLM
> Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>

Tested-by: Zenghui Yu (Huawei) <zenghui.yu@xxxxxxxxx>

Thanks,
Zenghui