From patchwork Tue Oct 27 13:55:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 307027 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EC4B9C64E75 for ; Tue, 27 Oct 2020 17:46:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A6FB82242E for ; Tue, 27 Oct 2020 17:46:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603820807; bh=7MCsq4VxHI473cgLQRa9zJgLTpwwUdH2X4EJgEHYAtE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NDX/vE5OKkc/rxnMh/wf9rJak/g7/ucsu1g7Zh7Hg9w9v9+MpgZkU9op0h0oQx2Pm G0tcRg9odJ+cM3wlhwnnTg7uMtumGq371jpn5miIaKBXRkWx+ewDhcM3LtRmTp+kEd wAki43JVrgYxD6ziVNPz+XoYT+VhKxVDksogBLEc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1759097AbgJ0O1o (ORCPT ); Tue, 27 Oct 2020 10:27:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:53972 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759089AbgJ0O1m (ORCPT ); Tue, 27 Oct 2020 10:27:42 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E2552206DC; Tue, 27 Oct 2020 14:27:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603808862; bh=7MCsq4VxHI473cgLQRa9zJgLTpwwUdH2X4EJgEHYAtE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hULXTp31PhXcJzmQCkuENlGu7Q6e7kbTT6yF7SwrJ2rH+DAoBllx6arYxZOt25Ew8 XWzpA59ycWWPFkdz1ruPzlL+qSyDLihMyLFxBsxmybUdLmP9y38wJbpnYkE+QE45j9 AnVsQFYWzd4oDe//HZm+8yP+uoRvql6BOKHTRVfU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com, Jan Kara , Sasha Levin Subject: [PATCH 4.19 253/264] reiserfs: Fix memory leak in reiserfs_parse_options() Date: Tue, 27 Oct 2020 14:55:11 +0100 Message-Id: <20201027135442.529732220@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135430.632029009@linuxfoundation.org> References: <20201027135430.632029009@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Kara [ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ] When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed. Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/reiserfs/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index de5eda33c92a0..ec5716dd58c23 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s, "turned on."); return 0; } + if (qf_names[qtype] != + REISERFS_SB(s)->s_qf_names[qtype]) + kfree(qf_names[qtype]); + qf_names[qtype] = NULL; if (*arg) { /* Some filename specified? */ if (REISERFS_SB(s)->s_qf_names[qtype] && strcmp(REISERFS_SB(s)->s_qf_names[qtype], @@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s, else *mount_options |= 1 << REISERFS_GRPQUOTA; } else { - if (qf_names[qtype] != - REISERFS_SB(s)->s_qf_names[qtype]) - kfree(qf_names[qtype]); - qf_names[qtype] = NULL; if (qtype == USRQUOTA) *mount_options &= ~(1 << REISERFS_USRQUOTA); else