Commit aa5e44b29ffe for kernel

commit aa5e44b29ffe4eaa08cc2237fd65bc2596bc023e
Author: Hui Peng <benquike@gmail.com>
Date:   Sat Sep 19 20:48:08 2026 +0000

    autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

    When autofs_fill_super() fails before clearing AUTOFS_SBI_CATATONIC (for
    example, when find_get_pid() fails on an invalid pgrp mount option, or
    when an fs_context is closed before mounting), deactivate_locked_super()
    invokes autofs_kill_sb() -> autofs_catatonic_mode(sbi).

    Because AUTOFS_SBI_CATATONIC is still set in sbi->flags,
    autofs_catatonic_mode() returns early without calling fput(sbi->pipe),
    permanently leaking the pipe struct file reference.

    Explicitly release sbi->pipe in autofs_kill_sb() if it is still non-NULL
    after autofs_catatonic_mode().

    Fixes: ebc921ca9b92 ("autofs: copy autofs4 to autofs")
    Signed-off-by: Hui Peng <benquike@gmail.com>
    Link: https://patch.msgid.link/20260919204808.2812930-1-benquike@gmail.com
    Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/autofs/inode.c b/fs/autofs/inode.c
index 6b15a3717ba7..066c16f2ea56 100644
--- a/fs/autofs/inode.c
+++ b/fs/autofs/inode.c
@@ -51,6 +51,10 @@ void autofs_kill_sb(struct super_block *sb)
 	if (sbi) {
 		/* Free wait queues, close pipe */
 		autofs_catatonic_mode(sbi);
+		if (sbi->pipe) {
+			fput(sbi->pipe);
+			sbi->pipe = NULL;
+		}
 		put_pid(sbi->oz_pgrp);
 	}