Re: [PATCH 2/2] f2fs: free the quota file name that remount drops

[Chao Yu <chao@kernel.org>]

On 10/30/26 15:24, Zhan Xusheng wrote:
> From: Zhan Xusheng <zhanxusheng@xiaomi.com>
> 
> Remounting with an empty journalled quota option such as "usrjquota="
> clears the name, but f2fs_apply_quota_options() overwrites the old
> string without freeing it, so every such remount leaks it.
> 
> Free it after a grace period, as f2fs_show_options() may still be
> reading it.
> 
> Fixes: d18535132523 ("f2fs: separate the options parsing and options checking")

BTW, shouldn't it be:

Fixes: ff11d8701b77 ("f2fs: fix to allow removing qf_name")

Thanks,

> Reported-by: syzbot+6c000dea1a93b4f5905c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=6c000dea1a93b4f5905c
> Cc: stable@vger.kernel.org
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
> Tested in QEMU with KASAN and kmemleak, remounting with "usrjquota="
> and "usrjquota=f2fs" in a loop while reading /proc/mounts: nothing is
> reported.  A plain kfree() here trips KASAN in f2fs_show_options().
> 
>   fs/f2fs/super.c | 7 +++++--
>   1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
> index 510df7998c18..d86ab25fbcc5 100644
> --- a/fs/f2fs/super.c
> +++ b/fs/f2fs/super.c
> @@ -1646,7 +1646,7 @@ static void f2fs_apply_quota_options(struct fs_context *fc,
>   	struct f2fs_fs_context *ctx = fc->fs_private;
>   	struct f2fs_sb_info *sbi = F2FS_SB(sb);
>   	bool quota_feature = f2fs_sb_has_quota_ino(sbi);
> -	char *qname;
> +	char *qname, *old;
>   	int i;
>   
>   	if (quota_feature)
> @@ -1662,7 +1662,10 @@ static void f2fs_apply_quota_options(struct fs_context *fc,
>   					GFP_KERNEL | __GFP_NOFAIL);
>   			set_opt(sbi, QUOTA);
>   		}
> -		F2FS_OPTION(sbi).s_qf_names[i] = qname;
> +		old = F2FS_OPTION(sbi).s_qf_names[i];
> +		/* Pairs with READ_ONCE() in f2fs_show_quota_options() */
> +		smp_store_release(&F2FS_OPTION(sbi).s_qf_names[i], qname);
> +		kfree_rcu_mightsleep(old);
>   	}
>   
>   	if (ctx->spec_mask & F2FS_SPEC_jqfmt)