fat: fix memory allocation failure handling of match_strdup()
commit 35033ab988c396ad7bce3b6d24060c16a9066db8 upstream. In parse_options(), if match_strdup() failed, parse_options() leaves opts->iocharset in unexpected state (i.e. still pointing the freed string). And this can be the cause of double free. To fix, this initialize opts->iocharset always when freeing. Change-Id: Ic7e843b1b4f66cefa10e9563d8a382c29e436099 Link: http://lkml.kernel.org/r/8736wp9dzc.fsf@mail.parknet.co.jp Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp> Reported-by: syzbot+90b8e10515ae88228a92@syzkaller.appspotmail.com Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
This commit is contained in:
parent
4d2a8d77f7
commit
47c76efa3f
|
@ -548,13 +548,21 @@ static void fat_set_state(struct super_block *sb,
|
||||||
brelse(bh);
|
brelse(bh);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
static void fat_reset_iocharset(struct fat_mount_options *opts)
|
||||||
|
{
|
||||||
|
if (opts->iocharset != fat_default_iocharset) {
|
||||||
|
/* Note: opts->iocharset can be NULL here */
|
||||||
|
kfree(opts->iocharset);
|
||||||
|
opts->iocharset = fat_default_iocharset;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
static void delayed_free(struct rcu_head *p)
|
static void delayed_free(struct rcu_head *p)
|
||||||
{
|
{
|
||||||
struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
|
struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
|
||||||
unload_nls(sbi->nls_disk);
|
unload_nls(sbi->nls_disk);
|
||||||
unload_nls(sbi->nls_io);
|
unload_nls(sbi->nls_io);
|
||||||
if (sbi->options.iocharset != fat_default_iocharset)
|
fat_reset_iocharset(&sbi->options);
|
||||||
kfree(sbi->options.iocharset);
|
|
||||||
kfree(sbi);
|
kfree(sbi);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -972,7 +980,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
|
||||||
opts->fs_fmask = opts->fs_dmask = current_umask();
|
opts->fs_fmask = opts->fs_dmask = current_umask();
|
||||||
opts->allow_utime = -1;
|
opts->allow_utime = -1;
|
||||||
opts->codepage = fat_default_codepage;
|
opts->codepage = fat_default_codepage;
|
||||||
opts->iocharset = fat_default_iocharset;
|
fat_reset_iocharset(opts);
|
||||||
if (is_vfat) {
|
if (is_vfat) {
|
||||||
opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
|
opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
|
||||||
opts->rodir = 0;
|
opts->rodir = 0;
|
||||||
|
@ -1119,8 +1127,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
|
||||||
|
|
||||||
/* vfat specific */
|
/* vfat specific */
|
||||||
case Opt_charset:
|
case Opt_charset:
|
||||||
if (opts->iocharset != fat_default_iocharset)
|
fat_reset_iocharset(opts);
|
||||||
kfree(opts->iocharset);
|
|
||||||
iocharset = match_strdup(&args[0]);
|
iocharset = match_strdup(&args[0]);
|
||||||
if (!iocharset)
|
if (!iocharset)
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
|
@ -1595,8 +1602,7 @@ out_fail:
|
||||||
iput(fat_inode);
|
iput(fat_inode);
|
||||||
unload_nls(sbi->nls_io);
|
unload_nls(sbi->nls_io);
|
||||||
unload_nls(sbi->nls_disk);
|
unload_nls(sbi->nls_disk);
|
||||||
if (sbi->options.iocharset != fat_default_iocharset)
|
fat_reset_iocharset(&sbi->options);
|
||||||
kfree(sbi->options.iocharset);
|
|
||||||
sb->s_fs_info = NULL;
|
sb->s_fs_info = NULL;
|
||||||
kfree(sbi);
|
kfree(sbi);
|
||||||
return error;
|
return error;
|
||||||
|
|
Loading…
Reference in New Issue