From patchwork Tue Oct 27 13:55:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 312822 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FB47C83008 for ; Tue, 27 Oct 2020 14:52:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 60A622071A for ; Tue, 27 Oct 2020 14:52:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603810344; bh=TfWJq0F+eNJwR3zuDSJhyRJNiFATVZ7YZaKoLVaSsv4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=V/U1k9G8i98DRI26lnY3JlWdoVqxgvr6hzosY/cIgANS7wvJsu4wh7qdh21dTelW1 4LYNkOobD7KT58+reGCFvvPqRV9hcg6dWZxmWJblciMX+ebpqbc2yLtn+2WwYzkZk5 EK6A8hVIgy9ihNVC1B8hksMnyYEJP1yGSYtuBDXg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1764152AbgJ0Oq0 (ORCPT ); Tue, 27 Oct 2020 10:46:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:46306 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1764148AbgJ0OqZ (ORCPT ); Tue, 27 Oct 2020 10:46:25 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DE6C02222C; Tue, 27 Oct 2020 14:46:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603809984; bh=TfWJq0F+eNJwR3zuDSJhyRJNiFATVZ7YZaKoLVaSsv4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ewdnT8WeVRXq+fD/XQu5qY2njonhRIVTvZS2kkuK+AQR32Lu1/wQwz9qC417b5ReJ MF0V3BaGq5pW3orzotUgRP9RWmzvWkJrsY8brRUJ6C8fMQWNSDmvdd0cK6udEaOc0J F3DdyEu+ppRrLmCtXxKFXk/ktODNy5jiOmHzI1Bs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com, Jan Kara , Sasha Levin Subject: [PATCH 5.4 389/408] reiserfs: Fix memory leak in reiserfs_parse_options() Date: Tue, 27 Oct 2020 14:55:27 +0100 Message-Id: <20201027135513.023148695@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027135455.027547757@linuxfoundation.org> References: <20201027135455.027547757@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Kara [ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ] When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed. Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/reiserfs/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index a6bce5b1fb1dc..1b9c7a387dc71 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -1258,6 +1258,10 @@ static int reiserfs_parse_options(struct super_block *s, "turned on."); return 0; } + if (qf_names[qtype] != + REISERFS_SB(s)->s_qf_names[qtype]) + kfree(qf_names[qtype]); + qf_names[qtype] = NULL; if (*arg) { /* Some filename specified? */ if (REISERFS_SB(s)->s_qf_names[qtype] && strcmp(REISERFS_SB(s)->s_qf_names[qtype], @@ -1287,10 +1291,6 @@ static int reiserfs_parse_options(struct super_block *s, else *mount_options |= 1 << REISERFS_GRPQUOTA; } else { - if (qf_names[qtype] != - REISERFS_SB(s)->s_qf_names[qtype]) - kfree(qf_names[qtype]); - qf_names[qtype] = NULL; if (qtype == USRQUOTA) *mount_options &= ~(1 << REISERFS_USRQUOTA); else