From patchwork Tue Oct 27 13:50:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 290150 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42785C55178 for ; Tue, 27 Oct 2020 14:07:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 00E392072D for ; Tue, 27 Oct 2020 14:07:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603807676; bh=qQkpsY95igRkNtXkV+01ckVVt9mzZ3IvlB7j+mGHTu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=aLQaQ/M/ZR3lWESzshWz8bjyhtgQ0+dgFm95reg3DSh5y630Q3oa94ReKQZKnbxuS 4iiRmGS31WuLTdE3GtZxQ/gY4sj0tkXHd35H8NH6YmeosYpTLthUuXnfxXYzQOtW0c VohFnuWtmu30OcWvBnP9RWrbxfZvw9qdpD73RKTw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754974AbgJ0OHy (ORCPT ); Tue, 27 Oct 2020 10:07:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:56798 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754970AbgJ0OHw (ORCPT ); Tue, 27 Oct 2020 10:07:52 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3C8EC2072D; Tue, 27 Oct 2020 14:07:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603807671; bh=qQkpsY95igRkNtXkV+01ckVVt9mzZ3IvlB7j+mGHTu0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PYcl1By8rP/obQDX7gO+HGZExctEVb3y4WUi4CyV3diRh8HgHdSbRHNRMms3CBz5c lxN7sFURxyfWcXgkqZ7+UycQq7IXdGNtdzPYuajKVeKd57hAIrB58kbJs8K/+iiMkH 3oUOA3+U9CWwYHFP8aCJbbhVQ+3qTNvzrY3haOy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com, Jan Kara , Sasha Levin Subject: [PATCH 4.9 131/139] reiserfs: Fix memory leak in reiserfs_parse_options() Date: Tue, 27 Oct 2020 14:50:25 +0100 Message-Id: <20201027134908.373144979@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027134902.130312227@linuxfoundation.org> References: <20201027134902.130312227@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Kara [ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ] When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed. Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/reiserfs/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index 677608a89b08d..c533d8715a6ca 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -1234,6 +1234,10 @@ static int reiserfs_parse_options(struct super_block *s, "turned on."); return 0; } + if (qf_names[qtype] != + REISERFS_SB(s)->s_qf_names[qtype]) + kfree(qf_names[qtype]); + qf_names[qtype] = NULL; if (*arg) { /* Some filename specified? */ if (REISERFS_SB(s)->s_qf_names[qtype] && strcmp(REISERFS_SB(s)->s_qf_names[qtype], @@ -1263,10 +1267,6 @@ static int reiserfs_parse_options(struct super_block *s, else *mount_options |= 1 << REISERFS_GRPQUOTA; } else { - if (qf_names[qtype] != - REISERFS_SB(s)->s_qf_names[qtype]) - kfree(qf_names[qtype]); - qf_names[qtype] = NULL; if (qtype == USRQUOTA) *mount_options &= ~(1 << REISERFS_USRQUOTA); else