From nobody Fri Sep 25 02:44:10 2026 Received: from cstnet.cn (smtp25.cstnet.cn [159.226.251.25]) (using TLSv1.2 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 16E934A1E1B; Thu, 17 Sep 2026 10:25:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=159.226.251.25 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789640761; cv=none; b=siyr9EkQrQIP/lAKC/M0hNE9+wUuXT3d6AYp4BOVtv/OdZYWfL9t+38AsDE9Whbx1xwilx8MtuDf1V6AESRSlAIQI1wT3LtMnPeMrfrSF4MShmc0nyrYuSuU+EBg9fMVkylQvC/jvn8i5CN9uHb5cZNmbtfN8jhZ97gUfrzwi9U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789640761; c=relaxed/simple; bh=DBXwKSZjtJ9XAYtE10/o42q1fe6TJyD64Pgfuzv8zqo=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=GLCh8wu8D2dqRFnQAwUycuDxn757g6ub68frBEX1673yBMIyAmoGThQLW8XBKzMGcNRyL57ZO0+1eibE48E/K1nTD3NjU9/5Q42g5lNsY6IP5QXDCqPZE0sNF5lABAWf2TY/sx6s01iwpUntc4of98JeD3TvcbPm9wts/XoC8fM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn; spf=pass smtp.mailfrom=iscas.ac.cn; arc=none smtp.client-ip=159.226.251.25 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=iscas.ac.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=iscas.ac.cn Received: from dfae2b116770.home.arpa (unknown [36.110.52.2]) by APP-05 (Coremail) with SMTP id zQCowADH+EIuwKtqYpN+CA--.41534S2; Thu, 17 Sep 2026 18:25:51 +0800 (CST) From: Wentao Liang To: dhowells@redhat.com Cc: linux-kernel@vger.kernel.org, linux-mtd@lists.infradead.org, miquel.raynal@bootlin.com, richard@nod.at, vigneshr@ti.com, viro@zeniv.linux.org.uk, Wentao Liang , stable@vger.kernel.org Subject: [PATCH] mtd: mtdsuper: Fix MTD device reference leak in mtd_get_sb() Date: Thu, 17 Sep 2026 10:25:50 +0000 Message-Id: <20260917102550.2146806-1-vulab@iscas.ac.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zQCowADH+EIuwKtqYpN+CA--.41534S2 X-Coremail-Antispam: 1UD129KBjvdXoW7GF1rJw4xurWxZFyfAr4fZrb_yoWkZrc_GF Z2vanaq3y8tFyv93Wakrs7ArWxKFsrur40vw4xK3Z3tFZ0qFyxWws8ur98Wrn3ur45A3Z8 C3yUCr1jyw47ujkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbS8YjsxI4VWkCwAYFVCjjxCrM7CY07I20VC2zVCF04k26cxKx2IY s7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4 kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_Xr0_Ar1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_ Cr0_Gr1UM28EF7xvwVC2z280aVAFwI0_GcCE3s1l84ACjcxK6I8E87Iv6xkF7I0E14v26r xl6s0DM2AIxVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj 6xIIjxv20xvE14v26r126r1DMcIj6I8E87Iv67AKxVW8Jr0_Cr1UMcvjeVCFs4IE7xkEbV WUJVW8JwACjcxG0xvY0x0EwIxGrwACjI8F5VAI37AI020EjII2zVCS5cI20VAGYxC7MxkF 7I0En4kS14v26r1q6r43MxAIw28IcxkI7VAKI48JMxAIw28IcVCjz48v1sIEY20_Gr43Wr 1UJr1l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8G jcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43MIIYrxkI7VAKI48JMIIF0xvE2I x0cI8IcVAFwI0_JFI_Gr1lIxAIcVC0I7IYx2IY6xkF7I0E14v26F4j6r4UJwCI42IY6xAI w20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Gr1j6F4UJwCI42IY6I8E87Iv6x kF7I0E14v26rxl6s0DYxBIdaVFxhVjvjDU0xZFpf9x07j1zuXUUUUU= X-CM-SenderInfo: pyxotu46lvutnvoduhdfq/1tbiCRINA2qrq01PhwAAs6 Content-Type: text/plain; charset="utf-8" mtd_get_sb() is called with a reference to the MTD device already taken by the caller. When sget_dev() fails, the function returns the error without dropping that reference, so the device is never released and its refcount never reaches zero. Every mount attempt on an MTD device whose superblock cannot be set up leaks a reference. Restore the put_mtd_device() that the fs_context conversion dropped on this path. Fixes: 0f071004109d ("mtd: Provide fs_context-aware mount_mtd() replacement= ") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/mtd/mtdsuper.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c index b7e3763c47f0..22ddeaa7d522 100644 --- a/drivers/mtd/mtdsuper.c +++ b/drivers/mtd/mtdsuper.c @@ -31,8 +31,10 @@ static int mtd_get_sb(struct fs_context *fc, int ret; =20 sb =3D sget_dev(fc, MKDEV(MTD_BLOCK_MAJOR, mtd->index)); - if (IS_ERR(sb)) + if (IS_ERR(sb)) { + put_mtd_device(mtd); return PTR_ERR(sb); + } =20 if (sb->s_root) { /* new mountpoint for an already mounted superblock */ --=20 2.34.1