Forum | Documentation | Website | Blog

Skip to content
Snippets Groups Projects
Commit c7d622e3 authored by Jeff Layton's avatar Jeff Layton Committed by Greg Kroah-Hartman
Browse files

cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals

commit a2934c7b

 upstream.

The scenario is this:

The kernel gets EREMOTE and starts chasing a DFS referral at mount time.
The tcon reference is put, which puts the session reference too, but
neither pointer is zeroed out.

The mount gets retried (goto try_mount_again) with new mount info.
Session setup fails fails and rc ends up being non-zero. The code then
falls through to the end and tries to put the previously freed tcon
pointer again.  Oops at: cifs_put_smb_ses+0x14/0xd0

Fix this by moving the initialization of the rc variable and the tcon,
pSesInfo and srvTcp pointers below the try_mount_again label. Also, add
a FreeXid() before the goto to prevent xid "leaks".

Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Reported-by: default avatarGustavo Carvalho Homem <gustavo@angulosolido.pt>
Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 637cd43c
No related merge requests found
......@@ -2267,12 +2267,12 @@ int
cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
char *mount_data_global, const char *devname)
{
int rc = 0;
int rc;
int xid;
struct smb_vol *volume_info;
struct cifsSesInfo *pSesInfo = NULL;
struct cifsTconInfo *tcon = NULL;
struct TCP_Server_Info *srvTcp = NULL;
struct cifsSesInfo *pSesInfo;
struct cifsTconInfo *tcon;
struct TCP_Server_Info *srvTcp;
char *full_path;
char *mount_data = mount_data_global;
#ifdef CONFIG_CIFS_DFS_UPCALL
......@@ -2281,6 +2281,10 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
int referral_walks_count = 0;
try_mount_again:
#endif
rc = 0;
tcon = NULL;
pSesInfo = NULL;
srvTcp = NULL;
full_path = NULL;
xid = GetXid();
......@@ -2577,6 +2581,7 @@ cifs_mount(struct super_block *sb, struct cifs_sb_info *cifs_sb,
cleanup_volume_info(&volume_info);
referral_walks_count++;
FreeXid(xid);
goto try_mount_again;
}
#else /* No DFS support, return error on mount */
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment