Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 35d62d37 authored by Daniel Rosenberg's avatar Daniel Rosenberg
Browse files

ANDROID: mnt: Fix freeing of mount data 



Fix double free on error paths

Signed-off-by: default avatarDaniel Rosenberg <drosen@google.com>
Change-Id: I1c25a175e87e5dd5cafcdcf9d78bf4c0dc3f88ef
Bug: 65386954
Fixes: c9b3c815 ("mnt: Add filesystem private data to mount points")
parent f43b4370

fs/namespace.c

+1 −3
Original line number Diff line number Diff line
@@ -216,6 +216,7 @@ static struct mount *alloc_vfsmnt(const char *name) 
		mnt->mnt_count = 1;

		mnt->mnt_writers = 0;

#endif

		mnt->mnt.data = NULL;



		INIT_HLIST_NODE(&mnt->mnt_hash);

		INIT_LIST_HEAD(&mnt->mnt_child);
@@ -902,7 +903,6 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void 
	if (!mnt)

		return ERR_PTR(-ENOMEM);



	mnt->mnt.data = NULL;

	if (type->alloc_mnt_data) {

		mnt->mnt.data = type->alloc_mnt_data();

		if (!mnt->mnt.data) {
@@ -916,7 +916,6 @@ vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void 


	root = mount_fs(type, flags, name, &mnt->mnt, data);

	if (IS_ERR(root)) {

		kfree(mnt->mnt.data);

		mnt_free_id(mnt);

		free_vfsmnt(mnt);

		return ERR_CAST(root);
@@ -1019,7 +1018,6 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, 
	return mnt;



 out_free:

	kfree(mnt->mnt.data);

	mnt_free_id(mnt);

	free_vfsmnt(mnt);

	return ERR_PTR(err);