reiserfs: Fix memory leak in reiserfs_parse_options()

[ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ]

When a usrjquota or grpjquota mount option is used multiple times, we
will leak memory allocated for the file name. Make sure the last setting
is used and all the previous ones are properly freed.

Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index 677608a89b08d381ce8995ff209a015b0dd27c3a..c533d8715a6ca32b29a64b6a4fa4a8cd6cf914f1 100644 (file)
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1234,6 +1234,10 @@ static int reiserfs_parse_options(struct super_block *s,
                                                 "turned on.");
                                return 0;
                        }
+                       if (qf_names[qtype] !=
+                           REISERFS_SB(s)->s_qf_names[qtype])
+                               kfree(qf_names[qtype]);
+                       qf_names[qtype] = NULL;
                        if (*arg) {     /* Some filename specified? */
                                if (REISERFS_SB(s)->s_qf_names[qtype]
                                    && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
@@ -1263,10 +1267,6 @@ static int reiserfs_parse_options(struct super_block *s,
                                else
                                        *mount_options |= 1 << REISERFS_GRPQUOTA;
                        } else {
-                               if (qf_names[qtype] !=
-                                   REISERFS_SB(s)->s_qf_names[qtype])
-                                       kfree(qf_names[qtype]);
-                               qf_names[qtype] = NULL;
                                if (qtype == USRQUOTA)
                                        *mount_options &= ~(1 << REISERFS_USRQUOTA);
                                else