btrfs: On error always free subvol_name in btrfs_mount (532b618b) · Commits · 戴 / test

The subvol_name is allocated in btrfs_parse_subvol_options and is consumed and freed in mount_subvol. Add a free to the error paths that don't call mount_subvol so that it is guaranteed that subvol_name is freed when an error happens. Fixes: ("btrfs: cleanup btrfs_mount() using btrfs_mount_root()") Cc: stable@vger.kernel.org # v4.19+ Reviewed-by:

Nikolay Borisov <nborisov@suse.com> Signed-off-by:

"Eric W. Biederman" <ebiederm@xmission.com> Reviewed-by:

David Sterba <dsterba@suse.com> Signed-off-by:

David Sterba <dsterba@suse.com>

fs/btrfs/super.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1677,6 +1677,7 @@ static struct dentry btrfs_mount(struct file_system_type fs_type, int flags,
	flags \| SB_RDONLY, device_name, data);		flags \| SB_RDONLY, device_name, data);
	if (IS_ERR(mnt_root)) {		if (IS_ERR(mnt_root)) {
	root = ERR_CAST(mnt_root);		root = ERR_CAST(mnt_root);
			kfree(subvol_name);
	goto out;		goto out;
	}		}

	@@ -1686,12 +1687,14 @@ static struct dentry btrfs_mount(struct file_system_type fs_type, int flags,
	if (error < 0) {		if (error < 0) {
	root = ERR_PTR(error);		root = ERR_PTR(error);
	mntput(mnt_root);		mntput(mnt_root);
			kfree(subvol_name);
	goto out;		goto out;
	}		}
	}		}
	}		}
	if (IS_ERR(mnt_root)) {		if (IS_ERR(mnt_root)) {
	root = ERR_CAST(mnt_root);		root = ERR_CAST(mnt_root);
			kfree(subvol_name);
	goto out;		goto out;
	}		}

Admin message