tmpfs casefold option leaked Unicode maps, enabling local DoS

A reference-counting bug in tmpfs case-insensitive (casefold) support let unprivileged local users drive unbounded kernel memory use and deny service.

When the casefold option is parsed, tmpfs loads a Unicode map and keeps it on the filesystem context. Supplying the option more than once replaced that map without dropping the previous reference. A leftover reference was also retained when a context was freed without a successful mount. From a user namespace, an attacker could repeat the option and grow kernel memory without bound.

Kazuki Hanai fixed the leak by releasing any prior map before storing a new one, clearing the context pointer once ownership moves to the superblock, and unloading any remaining map when the context is freed. The change is aimed at stable kernels as well, since the flaw dates to the original tmpfs casefold work.

Andrew Morton acknowledged the patch on the linux-kernel list and advised copying the authors of the original casefold support.