Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7f1fabf3 authored by Jan Kara's avatar Jan Kara Committed by Greg Kroah-Hartman
Browse files

reiserfs: Fix memory leak in reiserfs_parse_options() 



[ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ]

When a usrjquota or grpjquota mount option is used multiple times, we
will leak memory allocated for the file name. Make sure the last setting
is used and all the previous ones are properly freed.

Reported-by: default avatar <syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 796f0d39

fs/reiserfs/super.c

+4 −4
Original line number Diff line number Diff line
@@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s, 
						 "turned on.");

				return 0;

			}

			if (qf_names[qtype] !=

			    REISERFS_SB(s)->s_qf_names[qtype])

				kfree(qf_names[qtype]);

			qf_names[qtype] = NULL;

			if (*arg) {	/* Some filename specified? */

				if (REISERFS_SB(s)->s_qf_names[qtype]

				    && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
@@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s, 
				else

					*mount_options |= 1 << REISERFS_GRPQUOTA;

			} else {

				if (qf_names[qtype] !=

				    REISERFS_SB(s)->s_qf_names[qtype])

					kfree(qf_names[qtype]);

				qf_names[qtype] = NULL;

				if (qtype == USRQUOTA)

					*mount_options &= ~(1 << REISERFS_USRQUOTA);

				else