Commit 35033ab9 authored by OGAWA Hirofumi's avatar OGAWA Hirofumi Committed by Linus Torvalds

fat: fix memory allocation failure handling of match_strdup()

In parse_options(), if match_strdup() failed, parse_options() leaves
opts->iocharset in unexpected state (i.e.  still pointing the freed
string).  And this can be the cause of double free.

To fix, this initialize opts->iocharset always when freeing.

Link: http://lkml.kernel.org/r/8736wp9dzc.fsf@mail.parknet.co.jpSigned-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Reported-by: syzbot+90b8e10515ae88228a92@syzkaller.appspotmail.com
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 5a696494
...@@ -707,13 +707,21 @@ static void fat_set_state(struct super_block *sb, ...@@ -707,13 +707,21 @@ static void fat_set_state(struct super_block *sb,
brelse(bh); brelse(bh);
} }
static void fat_reset_iocharset(struct fat_mount_options *opts)
{
if (opts->iocharset != fat_default_iocharset) {
/* Note: opts->iocharset can be NULL here */
kfree(opts->iocharset);
opts->iocharset = fat_default_iocharset;
}
}
static void delayed_free(struct rcu_head *p) static void delayed_free(struct rcu_head *p)
{ {
struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu); struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu);
unload_nls(sbi->nls_disk); unload_nls(sbi->nls_disk);
unload_nls(sbi->nls_io); unload_nls(sbi->nls_io);
if (sbi->options.iocharset != fat_default_iocharset) fat_reset_iocharset(&sbi->options);
kfree(sbi->options.iocharset);
kfree(sbi); kfree(sbi);
} }
...@@ -1132,7 +1140,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat, ...@@ -1132,7 +1140,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
opts->fs_fmask = opts->fs_dmask = current_umask(); opts->fs_fmask = opts->fs_dmask = current_umask();
opts->allow_utime = -1; opts->allow_utime = -1;
opts->codepage = fat_default_codepage; opts->codepage = fat_default_codepage;
opts->iocharset = fat_default_iocharset; fat_reset_iocharset(opts);
if (is_vfat) { if (is_vfat) {
opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95; opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95;
opts->rodir = 0; opts->rodir = 0;
...@@ -1289,8 +1297,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat, ...@@ -1289,8 +1297,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat,
/* vfat specific */ /* vfat specific */
case Opt_charset: case Opt_charset:
if (opts->iocharset != fat_default_iocharset) fat_reset_iocharset(opts);
kfree(opts->iocharset);
iocharset = match_strdup(&args[0]); iocharset = match_strdup(&args[0]);
if (!iocharset) if (!iocharset)
return -ENOMEM; return -ENOMEM;
...@@ -1881,8 +1888,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat, ...@@ -1881,8 +1888,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
iput(fat_inode); iput(fat_inode);
unload_nls(sbi->nls_io); unload_nls(sbi->nls_io);
unload_nls(sbi->nls_disk); unload_nls(sbi->nls_disk);
if (sbi->options.iocharset != fat_default_iocharset) fat_reset_iocharset(&sbi->options);
kfree(sbi->options.iocharset);
sb->s_fs_info = NULL; sb->s_fs_info = NULL;
kfree(sbi); kfree(sbi);
return error; return error;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment