Re: [PATCH 2/2] f2fs: free the quota file name that remount drops

[Jaegeuk Kim]

On 11/02, Chao Yu wrote:
> On 10/30/26 15:24, Zhan Xusheng wrote:
> > From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
> > 
> > Remounting with an empty journalled quota option such as "usrjquota="
> > clears the name, but f2fs_apply_quota_options() overwrites the old
> > string without freeing it, so every such remount leaks it.
> > 
> > Free it after a grace period, as f2fs_show_options() may still be
> > reading it.
> > 
> > Fixes: d18535132523 ("f2fs: separate the options parsing and options checking")
> 
> BTW, shouldn't it be:
> 
> Fixes: ff11d8701b77 ("f2fs: fix to allow removing qf_name")

It seems this one is correct. Applied.

> 
> Thanks,
> 
> > Reported-by: syzbot+6c000dea1a93b4f5905c@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=6c000dea1a93b4f5905c
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>
> > ---
> > Tested in QEMU with KASAN and kmemleak, remounting with "usrjquota="
> > and "usrjquota=f2fs" in a loop while reading /proc/mounts: nothing is
> > reported.  A plain kfree() here trips KASAN in f2fs_show_options().
> > 
> >   fs/f2fs/super.c | 7 +++++--
> >   1 file changed, 5 insertions(+), 2 deletions(-)
> > 
> > diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
> > index 510df7998c18..d86ab25fbcc5 100644
> > --- a/fs/f2fs/super.c
> > +++ b/fs/f2fs/super.c
> > @@ -1646,7 +1646,7 @@ static void f2fs_apply_quota_options(struct fs_context *fc,
> >   	struct f2fs_fs_context *ctx = fc->fs_private;
> >   	struct f2fs_sb_info *sbi = F2FS_SB(sb);
> >   	bool quota_feature = f2fs_sb_has_quota_ino(sbi);
> > -	char *qname;
> > +	char *qname, *old;
> >   	int i;
> >   	if (quota_feature)
> > @@ -1662,7 +1662,10 @@ static void f2fs_apply_quota_options(struct fs_context *fc,
> >   					GFP_KERNEL | __GFP_NOFAIL);
> >   			set_opt(sbi, QUOTA);
> >   		}
> > -		F2FS_OPTION(sbi).s_qf_names[i] = qname;
> > +		old = F2FS_OPTION(sbi).s_qf_names[i];
> > +		/* Pairs with READ_ONCE() in f2fs_show_quota_options() */
> > +		smp_store_release(&F2FS_OPTION(sbi).s_qf_names[i], qname);
> > +		kfree_rcu_mightsleep(old);
> >   	}
> >   	if (ctx->spec_mask & F2FS_SPEC_jqfmt)
>