linux-kernel - Re: [PATCH v3 2/2] hfsplus: ensure sb->s_fs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6e47c8e1ad26527da4e8a2c287ee035c6f00d773.camel@ibm.com>
Date: Mon, 1 Dec 2025 23:06:32 +0000
From: Viacheslav Dubeyko <Slava.Dubeyko@....com>
To: "brauner@...nel.org" <brauner@...nel.org>,
        "glaubitz@...sik.fu-berlin.de"
	<glaubitz@...sik.fu-berlin.de>,
        "frank.li@...o.com" <frank.li@...o.com>,
        "slava@...eyko.com" <slava@...eyko.com>, "jack@...e.cz" <jack@...e.cz>,
        "mehdi.benhadjkhelifa@...il.com" <mehdi.benhadjkhelifa@...il.com>,
        "sandeen@...hat.com" <sandeen@...hat.com>
CC: "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "khalid@...nel.org"
	<khalid@...nel.org>,
        "linux-kernel-mentees@...ts.linuxfoundation.org"
	<linux-kernel-mentees@...ts.linuxfoundation.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "skhan@...uxfoundation.org" <skhan@...uxfoundation.org>,
        "david.hunter.linux@...il.com" <david.hunter.linux@...il.com>
Subject: Re:  [PATCH v3 2/2] hfsplus: ensure sb->s_fs_info is always cleaned
 up

On Mon, 2025-12-01 at 23:23 +0100, Mehdi Ben Hadj Khelifa wrote:
> When hfsplus was converted to the new mount api a bug was introduced by
> changing the allocation pattern of sb->s_fs_info. If setup_bdev_super()
> fails after a new superblock has been allocated by sget_fc(), but before
> hfsplus_fill_super() takes ownership of the filesystem-specific s_fs_info
> data it was leaked.
> 
> Fix this by freeing sb->s_fs_info in hfsplus_kill_super().
> 
> Cc: stable@...r.kernel.org
> Fixes: 432f7c78cb00 ("hfsplus: convert hfsplus to use the new mount api")
> Reported-by: Viacheslav Dubeyko <Slava.Dubeyko@....com> 
> Tested-by: Viacheslav Dubeyko <Slava.Dubeyko@....com>
> Signed-off-by: Christian Brauner <brauner@...nel.org>
> Signed-off-by: Mehdi Ben Hadj Khelifa <mehdi.benhadjkhelifa@...il.com>
> ---
>  fs/hfsplus/super.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
> index 16bc4abc67e0..8734520f6419 100644
> --- a/fs/hfsplus/super.c
> +++ b/fs/hfsplus/super.c
> @@ -328,8 +328,6 @@ static void hfsplus_put_super(struct super_block *sb)
>  	hfs_btree_close(sbi->ext_tree);
>  	kfree(sbi->s_vhdr_buf);
>  	kfree(sbi->s_backup_vhdr_buf);
> -	call_rcu(&sbi->rcu, delayed_free);
> -
>  	hfs_dbg("finished\n");
>  }
>  
> @@ -629,7 +627,6 @@ static int hfsplus_fill_super(struct super_block *sb, struct fs_context *fc)
>  out_unload_nls:
>  	unload_nls(sbi->nls);
>  	unload_nls(nls);
> -	kfree(sbi);
>  	return err;
>  }
>  
> @@ -688,10 +685,18 @@ static int hfsplus_init_fs_context(struct fs_context *fc)
>  	return 0;
>  }
>  
> +static void hfsplus_kill_super(struct super_block *sb)
> +{
> +	struct hfsplus_sb_info *sbi = HFSPLUS_SB(sb);
> +
> +	kill_block_super(sb);
> +	call_rcu(&sbi->rcu, delayed_free);
> +}
> +
>  static struct file_system_type hfsplus_fs_type = {
>  	.owner		= THIS_MODULE,
>  	.name		= "hfsplus",
> -	.kill_sb	= kill_block_super,
> +	.kill_sb	= hfsplus_kill_super,
>  	.fs_flags	= FS_REQUIRES_DEV,
>  	.init_fs_context = hfsplus_init_fs_context,
>  };

Looks good. Thanks a lot for the fix.

Reviewed-by: Viacheslav Dubeyko <slava@...eyko.com>

Thanks,
Slava.