diff options
| author | Hui Peng <benquike@gmail.com> | 2026-09-19 20:48:08 +0000 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2026-09-25 16:51:46 +0200 |
| commit | aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e (patch) | |
| tree | ab2c0b01f220db3998196cc71307f58a8a16fae9 | |
| parent | 76d8e697242e7e4e30dd08eff7c278728f9dd8e2 (diff) | |
| download | linux-aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e.tar.gz linux-aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e.zip | |
autofs: fix sbi->pipe file reference leak in autofs_kill_sb()
When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for
example, when find_get_pid() fails on an invalid pgrp mount option, or
when an fs_context is closed before mounting), deactivate_locked_super()
invokes autofs_kill_sb() -> autofs_catatonic_mode(sbi).
Because AUTOFS_SBI_CATATONIC is still set in sbi->flags,
autofs_catatonic_mode() returns early without calling fput(sbi->pipe),
permanently leaking the pipe struct file reference.
Explicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL
after autofs_catatonic_mode().
Fixes: ebc921ca9b92 ("autofs: copy autofs4 to autofs")
Signed-off-by: Hui Peng <benquike@gmail.com>
Link: https://patch.msgid.link/20260919204808.2812930-1-benquike@gmail.com
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
| -rw-r--r-- | fs/autofs/inode.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c index 6b15a3717ba7..066c16f2ea56 100644 --- a/fs/autofs/inode.c +++ b/fs/autofs/inode.c @@ -51,6 +51,10 @@ void autofs_kill_sb(struct super_block *sb) if (sbi) { /* Free wait queues, close pipe */ autofs_catatonic_mode(sbi); + if (sbi->pipe) { + fput(sbi->pipe); + sbi->pipe = NULL; + } put_pid(sbi->oz_pgrp); } |