summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVasily Averin <vvs@sw.ru>2007-03-16 22:38:24 +0100
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-03-17 03:25:05 +0100
commit1174cf730179d8f029b9e93cb9a4d5bfb08d1202 (patch)
tree0d02da2b8a543ff014f44e87c78fd9e837861113
parent[PATCH] bool fbdevs must depend on FB = y (diff)
downloadlinux-1174cf730179d8f029b9e93cb9a4d5bfb08d1202.tar.xz
linux-1174cf730179d8f029b9e93cb9a4d5bfb08d1202.zip
[PATCH] smbfs: double free memory corruption
smbfs allocates rq_trans2buffer to handle server's multi transaction2 response messages. As struct smb_request may be reused, rq_trans2buffer is freed before each new request. However if last servers's response is not multi but single trans2 message then new rq_trans2buffer is not allocated but last smb_rput still tries to free it again. To prevent this issue rq_trans2buffer pointer should be set to NULL after kfree. Signed-off-by: Vasily Averin <vvs@sw.ru> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--fs/smbfs/request.c1
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index 42261dbdf60f..723f7c667661 100644
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -181,6 +181,7 @@ static int smb_setup_request(struct smb_request *req)
req->rq_errno = 0;
req->rq_fragment = 0;
kfree(req->rq_trans2buffer);
+ req->rq_trans2buffer = NULL;
return 0;
}