From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sasha Levin Subject: [PATCH AUTOSEL 4.14 47/52] reiserfs: Fix memory leak in reiserfs_parse_options() Date: Sun, 18 Oct 2020 15:25:24 -0400 Message-ID: <20201018192530.4055730-47-sashal@kernel.org> References: <20201018192530.4055730-1-sashal@kernel.org> Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Return-path: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603049187; bh=Aa89ekcP0bkHteM/86ph1fGH+lQDJMLPv5zVTXiphj8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T09PiAMZLrwJaYdWejsfTHX0SLXXVZ8UNebQZSu0r1/JrwbsscjYhJlW7hXyUZHat UT/N6BV7ip0slKPT2xn4veCqYpT+vD6//f4c5M4MAlgqM/PFI8ePxkLaA4UdEI/Rst i3v9vaqf8h7VZcoLn92wposAaONTeFVHbtWgJG6Y= In-Reply-To: <20201018192530.4055730-1-sashal@kernel.org> List-ID: Content-Type: text/plain; charset="us-ascii" To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jan Kara , syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com, Sasha Levin , reiserfs-devel@vger.kernel.org From: Jan Kara [ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ] When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed. Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/reiserfs/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index 9caf3948417c0..fbae5f4eea09c 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s, "turned on."); return 0; } + if (qf_names[qtype] != + REISERFS_SB(s)->s_qf_names[qtype]) + kfree(qf_names[qtype]); + qf_names[qtype] = NULL; if (*arg) { /* Some filename specified? */ if (REISERFS_SB(s)->s_qf_names[qtype] && strcmp(REISERFS_SB(s)->s_qf_names[qtype], @@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s, else *mount_options |= 1 << REISERFS_GRPQUOTA; } else { - if (qf_names[qtype] != - REISERFS_SB(s)->s_qf_names[qtype]) - kfree(qf_names[qtype]); - qf_names[qtype] = NULL; if (qtype == USRQUOTA) *mount_options &= ~(1 << REISERFS_USRQUOTA); else -- 2.25.1