From: Breno Leitao <leitao@debian.org>
To: Alexander Viro <viro@zeniv.linux.org.uk>,
Christian Brauner <brauner@kernel.org>, Jan Kara <jack@suse.cz>,
Shuah Khan <shuah@kernel.org>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
catalin.marinas@arm.com, linux-kselftest@vger.kernel.org,
kernel-team@meta.com, Breno Leitao <leitao@debian.org>
Subject: [PATCH] init: do_mounts: free the ramfs info of the boot rootfs
Date: Fri, 16 Oct 2026 07:27:58 -0700 [thread overview]
Message-ID: <20261016-rootfs-kill-sb-v1-1-7631af3ba35f@debian.org> (raw)
Kmemleak is reporting the following leak in ramfs_init_fs_context:
unreferenced object 0xffff000080302480 (size 8):
comm "swapper/0", pid 0, jiffies 4294667306
hex dump (first 8 bytes):
ed 01 00 00 00 00 00 00 ........
backtrace (crc bea23b04):
__kmalloc_cache_noprof+0x28c/0x5a0
ramfs_init_fs_context+0x5c/0xf8
rootfs_init_fs_context+0x30/0x40
alloc_fs_context+0x4c0/0x6a8
fs_context_for_mount+0x28/0x40
vfs_kern_mount+0x40/0x220
init_mount_tree+0x80/0x440
mnt_init+0x138/0x170
vfs_caches_init+0x2c/0x48
start_kernel+0x350/0x3f8
When init pivot_root()s away from a ramfs-backed boot rootfs and
unmounts it, the rootfs superblock is killed with kill_anon_super() and
the struct ramfs_fs_info allocated by ramfs_init_fs_context() is never
freed.
Kill a ramfs-backed rootfs with ramfs_kill_sb(). A tmpfs-backed one keeps
kill_anon_super(), as shmem frees its info in ->put_super.
Fixes: 576ee5dfd459 ("fs: add immutable rootfs")
Signed-off-by: Breno Leitao <leitao@debian.org>
---
init/do_mounts.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/init/do_mounts.c b/init/do_mounts.c
index 95e0b3a0f711bd..b088021b1546d8 100644
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -503,10 +503,18 @@ static int rootfs_init_fs_context(struct fs_context *fc)
return ramfs_init_fs_context(fc);
}
+static void rootfs_kill_sb(struct super_block *sb)
+{
+ if (IS_ENABLED(CONFIG_TMPFS) && is_tmpfs)
+ kill_anon_super(sb);
+ else
+ ramfs_kill_sb(sb);
+}
+
struct file_system_type rootfs_fs_type = {
.name = "rootfs",
.init_fs_context = rootfs_init_fs_context,
- .kill_sb = kill_anon_super,
+ .kill_sb = rootfs_kill_sb,
};
void __init init_rootfs(void)
---
base-commit: d419d682257d813f6cb7a28e42b35d0edf4ad038
change-id: 20261016-rootfs-kill-sb-4f1b597dab24
Best regards,
--
Breno Leitao <leitao@debian.org>
reply other threads:[~2026-10-16 14:28 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261016-rootfs-kill-sb-v1-1-7631af3ba35f@debian.org \
--to=leitao@debian.org \
--cc=brauner@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=jack@suse.cz \
--cc=kernel-team@meta.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-kselftest@vger.kernel.org \
--cc=shuah@kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®