Re: [PATCH 1/2] f2fs: fix use-after-free of quota file names on failed remount

[Chao Yu]

On 10/30/26 15:24, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
>
> f2fs_show_options() prints the journalled quota file names without any
> lock that excludes remount, and a failed remount frees the current names
> before restoring the old ones.  Reading /proc/mounts at that moment is a
> use-after-free.
>
> Read the names under rcu_read_lock() and free them only after a grace
> period.
>
> Fixes: 4b2414d04e99 ("f2fs: support journalled quota")
> Reported-by: syzbot+e818dd42ada3b583bed1@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=e818dd42ada3b583bed1
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>

Reviewed-by: Chao Yu <chao@xxxxxxxxxx>

Thanks,