Thread (6 messages) flat view 6 messages, 1 author, 9d ago
COOLING9d

[PATCH 1/5] powerpc/spufs: fix memory leak of spufs_fs_context in spufs_free_fc()

From: Junrui Luo via B4 Relay <devnull+moonafterrain.outlook.com@kernel.org>
Date: 2026-08-12 05:48:24
Also in: b4-sent, lkml, stable
Subsystem: cell broadband engine architecture, linux for powerpc (32-bit and 64-bit), spu file system, the rest · Maintainers: Madhavan Srinivasan, Linus Torvalds

From: Junrui Luo <redacted>

spufs_init_fs_context() allocates both a struct spufs_fs_context stored
in fc->fs_private and a struct spufs_sb_info stored in fc->s_fs_info.
The ->free callback spufs_free_fc() only releases fc->s_fs_info.
put_fs_context() never touches fc->fs_private, since releasing it is
what ->free() exists for, and vfs_clean_context() calls ->free() and
then clears both pointers itself.

Every spufs fs_context that is constructed and torn down therefore leaks
the struct spufs_fs_context allocation. The leak is reachable without
privileges: fsopen() runs ->init_fs_context() before sget_fc() enforces
spufs's lack of FS_USERNS_MOUNT.

Free fc->fs_private alongside fc->s_fs_info.

Fixes: d2e0981c3b9a ("vfs: Convert spufs to use the new mount API")
Reported-by: Yuhao Jiang <redacted>
Assisted-by: Claude:claude-opus-5
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <redacted>
---
 arch/powerpc/platforms/cell/spufs/inode.c | 1 +
 1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/platforms/cell/spufs/inode.c b/arch/powerpc/platforms/cell/spufs/inode.c
index 2b54afb31529..51c432864f02 100644
--- a/arch/powerpc/platforms/cell/spufs/inode.c
+++ b/arch/powerpc/platforms/cell/spufs/inode.c
@@ -713,6 +713,7 @@ static int spufs_get_tree(struct fs_context *fc)
 
 static void spufs_free_fc(struct fs_context *fc)
 {
+	kfree(fc->fs_private);
 	kfree(fc->s_fs_info);
 }
 
-- 
2.51.2


Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help