From: "Chen, Kenneth W" The hugetlbfs_fill_super() doesn't free up memory allocated for sbinfo on the way out in case of parsing error (and a few others). This leads to memory leak If root tries to mount a hugetlbfs with invalid mount option. Here is a patch that fix the problem. 25-akpm/fs/hugetlbfs/inode.c | 16 +++++++++------- 1 files changed, 9 insertions(+), 7 deletions(-) diff -puN fs/hugetlbfs/inode.c~hugetlbfs_fill_super-leak-fix fs/hugetlbfs/inode.c --- 25/fs/hugetlbfs/inode.c~hugetlbfs_fill_super-leak-fix Fri Sep 26 17:41:37 2003 +++ 25-akpm/fs/hugetlbfs/inode.c Fri Sep 26 17:41:37 2003 @@ -648,11 +648,6 @@ hugetlbfs_fill_super(struct super_block struct hugetlbfs_config config; struct hugetlbfs_sb_info *sbinfo; - sbinfo = kmalloc(sizeof(struct hugetlbfs_sb_info), GFP_KERNEL); - if (!sbinfo) - return -ENOMEM; - sb->s_fs_info = sbinfo; - config.nr_blocks = -1; /* No limit on size by default */ config.nr_inodes = -1; /* No limit on number of inodes by default */ config.uid = current->fsuid; @@ -663,6 +658,10 @@ hugetlbfs_fill_super(struct super_block if (ret) return ret; + sbinfo = kmalloc(sizeof(struct hugetlbfs_sb_info), GFP_KERNEL); + if (!sbinfo) + return -ENOMEM; + sb->s_fs_info = sbinfo; spin_lock_init(&sbinfo->stat_lock); sbinfo->max_blocks = config.nr_blocks; sbinfo->free_blocks = config.nr_blocks; @@ -675,15 +674,18 @@ hugetlbfs_fill_super(struct super_block inode = hugetlbfs_get_inode(sb, config.uid, config.gid, S_IFDIR | config.mode, 0); if (!inode) - return -ENOMEM; + goto out_free; root = d_alloc_root(inode); if (!root) { iput(inode); - return -ENOMEM; + goto out_free; } sb->s_root = root; return 0; +out_free: + kfree(sbinfo); + return -ENOMEM; } int hugetlb_get_quota(struct address_space *mapping) _