[Devel] [PATCH v6.1 VZ10 2/2] ve/fs/devmnt: free the right pointer in ve_devmnt_check()

[Vladimir Riabchun]

On 17.07.2026 14:17, Pavel Tikhomirov wrote:
> ve_devmnt_check() duplicates the option string and tokenises the copy
> with strsep(), which advances the passed pointer. It then frees that
> advanced pointer instead of the start of the allocation: on success it
> is NULL (leaking the kstrdup() buffer), and on the -EPERM exit it points
> into the middle of the buffer (freeing an invalid pointer).
> 
> Keep the allocation base in its own variable and free that.
> 
> Fixes: 263467c864c5 ("ve/fs/devmnt: process mount options")
> Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>

Reviewed-by: Vladimir Riabchun <vladimir.riabchun at virtuozzo.com>

> 
> Feature: ve: ve generic structures
> ---
>   fs/namespace.c | 18 +++++++++---------
>   1 file changed, 9 insertions(+), 9 deletions(-)
> 
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 3a457588e96d9..4aa09dcf09609 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -3139,8 +3139,8 @@ static char *strstr_separated(char *haystack, char *needle, char sep)
>   
>   static int ve_devmnt_check(char *options, char *allowed)
>   {
> -	char *p;
> -	char *tmp_options;
> +	char *buff, *opts, *p;
> +	int err = 0;
>   
>   	if (!options || !*options)
>   		return 0;
> @@ -3149,22 +3149,22 @@ static int ve_devmnt_check(char *options, char *allowed)
>   		return -EPERM;
>   
>   	/* strsep() changes provided string: puts '\0' instead of separators */
> -	tmp_options = kstrdup(options, GFP_KERNEL);
> -	if (!tmp_options)
> +	buff = opts = kstrdup(options, GFP_KERNEL);
> +	if (!buff)
>   		return -ENOMEM;
>   
> -	while ((p = strsep(&tmp_options, ",")) != NULL) {
> +	while ((p = strsep(&opts, ",")) != NULL) {
>   		if (!*p)
>   			continue;
>   
>   		if (!strstr_separated(allowed, p, ',')) {
> -			kfree(tmp_options);
> -			return -EPERM;
> +			err = -EPERM;
> +			break;
>   		}
>   	}
>   
> -	kfree(tmp_options);
> -	return 0;
> +	kfree(buff);
> +	return err;
>   }
>   
>   static int ve_devmnt_insert(char *options, char *hidden)

-- 
--
Best regards, Riabchun Vladimir
Linux Kernel Developer, Virtuozzo