| Message ID | 87lg32p7y3.fsf@xmission.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fs/btrfs: On error always free subvol_name in btrfs_mount | expand |
On 30.01.19 г. 15:54 ч., Eric W. Biederman wrote: > > The subvol_name is allocated in btrfs_parse_subvol_options and is > consumed and freed in mount_subvol. Add a free to the error paths that > don't call mount_subvol so that it is guaranteed that subvol_name is > freed when an error happens. Good catch, Reviewed-by: Nikolay Borisov <nborisov@suse.com> > > Fixes: 312c89fbca06 ("btrfs: cleanup btrfs_mount() using btrfs_mount_root()") > Cc: stable@vger.kernel.org > Cc: Chris Mason <clm@fb.com> > Cc: Josef Bacik <josef@toxicpanda.com> > Cc: David Sterba <dsterba@suse.com> > Cc: linux-btrfs@vger.kernel.org > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> > --- > fs/btrfs/super.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c > index c5586ffd1426..0a3f122dd61f 100644 > --- a/fs/btrfs/super.c > +++ b/fs/btrfs/super.c > @@ -1621,6 +1621,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags, > flags | SB_RDONLY, device_name, data); > if (IS_ERR(mnt_root)) { > root = ERR_CAST(mnt_root); > + kfree(subvol_name); > goto out; > } > > @@ -1630,12 +1631,14 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags, > if (error < 0) { > root = ERR_PTR(error); > mntput(mnt_root); > + kfree(subvol_name); > goto out; > } > } > } > if (IS_ERR(mnt_root)) { > root = ERR_CAST(mnt_root); > + kfree(subvol_name); > goto out; > } > >
On Wed, Jan 30, 2019 at 07:54:12AM -0600, Eric W. Biederman wrote: > > The subvol_name is allocated in btrfs_parse_subvol_options and is > consumed and freed in mount_subvol. Add a free to the error paths that > don't call mount_subvol so that it is guaranteed that subvol_name is > freed when an error happens. > > Fixes: 312c89fbca06 ("btrfs: cleanup btrfs_mount() using btrfs_mount_root()") > Cc: stable@vger.kernel.org > Cc: Chris Mason <clm@fb.com> > Cc: Josef Bacik <josef@toxicpanda.com> > Cc: David Sterba <dsterba@suse.com> > Cc: linux-btrfs@vger.kernel.org > Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> Reviewed-by: David Sterba <dsterba@suse.com> Added to 5.0-rc queue, thanks.
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c index c5586ffd1426..0a3f122dd61f 100644 --- a/fs/btrfs/super.c +++ b/fs/btrfs/super.c @@ -1621,6 +1621,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags, flags | SB_RDONLY, device_name, data); if (IS_ERR(mnt_root)) { root = ERR_CAST(mnt_root); + kfree(subvol_name); goto out; } @@ -1630,12 +1631,14 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags, if (error < 0) { root = ERR_PTR(error); mntput(mnt_root); + kfree(subvol_name); goto out; } } } if (IS_ERR(mnt_root)) { root = ERR_CAST(mnt_root); + kfree(subvol_name); goto out; }
The subvol_name is allocated in btrfs_parse_subvol_options and is consumed and freed in mount_subvol. Add a free to the error paths that don't call mount_subvol so that it is guaranteed that subvol_name is freed when an error happens. Fixes: 312c89fbca06 ("btrfs: cleanup btrfs_mount() using btrfs_mount_root()") Cc: stable@vger.kernel.org Cc: Chris Mason <clm@fb.com> Cc: Josef Bacik <josef@toxicpanda.com> Cc: David Sterba <dsterba@suse.com> Cc: linux-btrfs@vger.kernel.org Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com> --- fs/btrfs/super.c | 3 +++ 1 file changed, 3 insertions(+)