summaryrefslogtreecommitdiff
path: root/fs/reiserfs
diff options
context:
space:
mode:
authorJan Kara <jack@suse.cz>2020-03-04 16:01:44 +0300
committerJan Kara <jack@suse.cz>2020-08-28 18:11:53 +0300
commite9d4709fcc26353df12070566970f080e651f0c9 (patch)
tree9c185b418e25b9dbb1118bba75d13fc9c78b5016 /fs/reiserfs
parent256ccb9baeaba2b1a4ed5324c02b8d723497ca5a (diff)
downloadlinux-e9d4709fcc26353df12070566970f080e651f0c9.tar.xz
reiserfs: Fix memory leak in reiserfs_parse_options()
When a usrjquota or grpjquota mount option is used multiple times, we will leak memory allocated for the file name. Make sure the last setting is used and all the previous ones are properly freed. Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com Signed-off-by: Jan Kara <jack@suse.cz>
Diffstat (limited to 'fs/reiserfs')
-rw-r--r--fs/reiserfs/super.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index a6bce5b1fb1d..1b9c7a387dc7 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1258,6 +1258,10 @@ static int reiserfs_parse_options(struct super_block *s,
"turned on.");
return 0;
}
+ if (qf_names[qtype] !=
+ REISERFS_SB(s)->s_qf_names[qtype])
+ kfree(qf_names[qtype]);
+ qf_names[qtype] = NULL;
if (*arg) { /* Some filename specified? */
if (REISERFS_SB(s)->s_qf_names[qtype]
&& strcmp(REISERFS_SB(s)->s_qf_names[qtype],
@@ -1287,10 +1291,6 @@ static int reiserfs_parse_options(struct super_block *s,
else
*mount_options |= 1 << REISERFS_GRPQUOTA;
} else {
- if (qf_names[qtype] !=
- REISERFS_SB(s)->s_qf_names[qtype])
- kfree(qf_names[qtype]);
- qf_names[qtype] = NULL;
if (qtype == USRQUOTA)
*mount_options &= ~(1 << REISERFS_USRQUOTA);
else