Commit e9d4709f authored by Jan Kara's avatar Jan Kara

reiserfs: Fix memory leak in reiserfs_parse_options()

When a usrjquota or grpjquota mount option is used multiple times, we
will leak memory allocated for the file name. Make sure the last setting
is used and all the previous ones are properly freed.

Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com
Signed-off-by: default avatarJan Kara <jack@suse.cz>
parent 256ccb9b
...@@ -1258,6 +1258,10 @@ static int reiserfs_parse_options(struct super_block *s, ...@@ -1258,6 +1258,10 @@ static int reiserfs_parse_options(struct super_block *s,
"turned on."); "turned on.");
return 0; return 0;
} }
if (qf_names[qtype] !=
REISERFS_SB(s)->s_qf_names[qtype])
kfree(qf_names[qtype]);
qf_names[qtype] = NULL;
if (*arg) { /* Some filename specified? */ if (*arg) { /* Some filename specified? */
if (REISERFS_SB(s)->s_qf_names[qtype] if (REISERFS_SB(s)->s_qf_names[qtype]
&& strcmp(REISERFS_SB(s)->s_qf_names[qtype], && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
...@@ -1287,10 +1291,6 @@ static int reiserfs_parse_options(struct super_block *s, ...@@ -1287,10 +1291,6 @@ static int reiserfs_parse_options(struct super_block *s,
else else
*mount_options |= 1 << REISERFS_GRPQUOTA; *mount_options |= 1 << REISERFS_GRPQUOTA;
} else { } else {
if (qf_names[qtype] !=
REISERFS_SB(s)->s_qf_names[qtype])
kfree(qf_names[qtype]);
qf_names[qtype] = NULL;
if (qtype == USRQUOTA) if (qtype == USRQUOTA)
*mount_options &= ~(1 << REISERFS_USRQUOTA); *mount_options &= ~(1 << REISERFS_USRQUOTA);
else else
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment