mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Breno Leitao <leitao@debian.org>
To: Alexander Viro <viro@zeniv.linux.org.uk>,
	 Christian Brauner <brauner@kernel.org>, Jan Kara <jack@suse.cz>,
	 Shuah Khan <shuah@kernel.org>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
	 catalin.marinas@arm.com, linux-kselftest@vger.kernel.org,
	 kernel-team@meta.com, Breno Leitao <leitao@debian.org>
Subject: [PATCH] init: do_mounts: free the ramfs info of the boot rootfs
Date: Fri, 16 Oct 2026 07:27:58 -0700	[thread overview]
Message-ID: <20261016-rootfs-kill-sb-v1-1-7631af3ba35f@debian.org> (raw)

Kmemleak is reporting the following leak in ramfs_init_fs_context:

  unreferenced object 0xffff000080302480 (size 8):
    comm "swapper/0", pid 0, jiffies 4294667306
    hex dump (first 8 bytes):
      ed 01 00 00 00 00 00 00                          ........
    backtrace (crc bea23b04):
      __kmalloc_cache_noprof+0x28c/0x5a0
      ramfs_init_fs_context+0x5c/0xf8
      rootfs_init_fs_context+0x30/0x40
      alloc_fs_context+0x4c0/0x6a8
      fs_context_for_mount+0x28/0x40
      vfs_kern_mount+0x40/0x220
      init_mount_tree+0x80/0x440
      mnt_init+0x138/0x170
      vfs_caches_init+0x2c/0x48
      start_kernel+0x350/0x3f8

When init pivot_root()s away from a ramfs-backed boot rootfs and
unmounts it, the rootfs superblock is killed with kill_anon_super() and
the struct ramfs_fs_info allocated by ramfs_init_fs_context() is never
freed.

Kill a ramfs-backed rootfs with ramfs_kill_sb(). A tmpfs-backed one keeps
kill_anon_super(), as shmem frees its info in ->put_super.

Fixes: 576ee5dfd459 ("fs: add immutable rootfs")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
 init/do_mounts.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/init/do_mounts.c b/init/do_mounts.c
index 95e0b3a0f711bd..b088021b1546d8 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -503,10 +503,18 @@ static int rootfs_init_fs_context(struct fs_context *fc)
 	return ramfs_init_fs_context(fc);
 }
 
+static void rootfs_kill_sb(struct super_block *sb)
+{
+	if (IS_ENABLED(CONFIG_TMPFS) && is_tmpfs)
+		kill_anon_super(sb);
+	else
+		ramfs_kill_sb(sb);
+}
+
 struct file_system_type rootfs_fs_type = {
 	.name		= "rootfs",
 	.init_fs_context = rootfs_init_fs_context,
-	.kill_sb	= kill_anon_super,
+	.kill_sb	= rootfs_kill_sb,
 };
 
 void __init init_rootfs(void)

---
base-commit: d419d682257d813f6cb7a28e42b35d0edf4ad038
change-id: 20261016-rootfs-kill-sb-4f1b597dab24

Best regards,
--  
Breno Leitao <leitao@debian.org>


                 reply	other threads:[~2026-10-16 14:28 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261016-rootfs-kill-sb-v1-1-7631af3ba35f@debian.org \
    --to=leitao@debian.org \
    --cc=brauner@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=jack@suse.cz \
    --cc=kernel-team@meta.com \
    --cc=linux-fsdevel@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=shuah@kernel.org \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®