From: Zhan Xusheng Remounting with an empty journalled quota option such as "usrjquota=" clears the name, but f2fs_apply_quota_options() overwrites the old string without freeing it, so every such remount leaks it. Free it after a grace period, as f2fs_show_options() may still be reading it. Fixes: ff11d8701b77 ("f2fs: fix to allow removing qf_name") Reported-by: syzbot+6c000dea1a93b4f5905c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c000dea1a93b4f5905c Cc: stable@vger.kernel.org Signed-off-by: Zhan Xusheng Reviewed-by: Chao Yu --- v2: Corrected the Fixes tag (Chao), added Chao's Reviewed-by. fs/f2fs/super.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 510df7998c18..d86ab25fbcc5 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -1646,7 +1646,7 @@ static void f2fs_apply_quota_options(struct fs_context *fc, struct f2fs_fs_context *ctx = fc->fs_private; struct f2fs_sb_info *sbi = F2FS_SB(sb); bool quota_feature = f2fs_sb_has_quota_ino(sbi); - char *qname; + char *qname, *old; int i; if (quota_feature) @@ -1662,7 +1662,10 @@ static void f2fs_apply_quota_options(struct fs_context *fc, GFP_KERNEL | __GFP_NOFAIL); set_opt(sbi, QUOTA); } - F2FS_OPTION(sbi).s_qf_names[i] = qname; + old = F2FS_OPTION(sbi).s_qf_names[i]; + /* Pairs with READ_ONCE() in f2fs_show_quota_options() */ + smp_store_release(&F2FS_OPTION(sbi).s_qf_names[i], qname); + kfree_rcu_mightsleep(old); } if (ctx->spec_mask & F2FS_SPEC_jqfmt) -- 2.43.0