From patchwork Tue Oct 27 13:50:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 306946 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0ACD7C4363A for ; Tue, 27 Oct 2020 18:08:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id BBA7321655 for ; Tue, 27 Oct 2020 18:08:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603822121; bh=Aa89ekcP0bkHteM/86ph1fGH+lQDJMLPv5zVTXiphj8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uFKV+06unNQhK7kv+nYl6BmoBXKdOAEuDuuI8gCJ7guhHhN3j2Fd3tGDKYS6mIzBq f2uk1FIUaDIhAcLg3bI7JGnoRFA1A56WYz5csCNHff/9FF/6Zxbb1Q22HPdC6KJHLw AP1qQ8/6mNq5xo4DNM+D/V2hEwBlbdtXCPY6Fnr0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1825091AbgJ0SIi (ORCPT ); Tue, 27 Oct 2020 14:08:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:38058 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757057AbgJ0OQD (ORCPT ); Tue, 27 Oct 2020 10:16:03 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4CB4B206F7; Tue, 27 Oct 2020 14:16:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1603808162; bh=Aa89ekcP0bkHteM/86ph1fGH+lQDJMLPv5zVTXiphj8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I6U9RnpxgqtqW1IB9mYHqP29r5QWTjnjste7bSfcmwq24tYJtgA+hsqXcqpiLLUs5 k6oMDF9FI/8PX46/yB8jTqjpHjr/3LQXiihEk59iMS8XL/o9v8cP75hpNCqLFpxkba FVzGrZDqVOXoS2GeiEgDiPUM+etrTIniwqF+Gpog= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com, Jan Kara , Sasha Levin Subject: [PATCH 4.14 180/191] reiserfs: Fix memory leak in reiserfs_parse_options() Date: Tue, 27 Oct 2020 14:50:35 +0100 Message-Id: <20201027134918.390809754@linuxfoundation.org> X-Mailer: git-send-email 2.29.1 In-Reply-To: <20201027134909.701581493@linuxfoundation.org> References: <20201027134909.701581493@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jan Kara [ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ] When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed. Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com Signed-off-by: Jan Kara Signed-off-by: Sasha Levin --- fs/reiserfs/super.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c index 9caf3948417c0..fbae5f4eea09c 100644 --- a/fs/reiserfs/super.c +++ b/fs/reiserfs/super.c @@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s, "turned on."); return 0; } + if (qf_names[qtype] != + REISERFS_SB(s)->s_qf_names[qtype]) + kfree(qf_names[qtype]); + qf_names[qtype] = NULL; if (*arg) { /* Some filename specified? */ if (REISERFS_SB(s)->s_qf_names[qtype] && strcmp(REISERFS_SB(s)->s_qf_names[qtype], @@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s, else *mount_options |= 1 << REISERFS_GRPQUOTA; } else { - if (qf_names[qtype] != - REISERFS_SB(s)->s_qf_names[qtype]) - kfree(qf_names[qtype]); - qf_names[qtype] = NULL; if (qtype == USRQUOTA) *mount_options &= ~(1 << REISERFS_USRQUOTA); else