diff options
| author | Steve French <sfrench@us.ibm.com> | 2011-08-18 06:41:55 +0200 |
|---|---|---|
| committer | Steve French <sfrench@us.ibm.com> | 2011-08-18 18:53:02 +0200 |
| commit | 13589c437daf4c8e429b3236c0b923de1c9420d8 (patch) | |
| tree | de72b74d9214b3ee04a6dcc7df934c29b3eed305 /fs | |
| parent | cifs: demote cERROR in build_path_from_dentry to cFYI (diff) | |
| download | linux-13589c437daf4c8e429b3236c0b923de1c9420d8.tar.xz linux-13589c437daf4c8e429b3236c0b923de1c9420d8.zip | |
[CIFS] possible memory corruption on mount
CIFS cleanup_volume_info_contents() looks like having a memory
corruption problem.
When UNCip is set to "&vol->UNC[2]" in cifs_parse_mount_options(), it
should not be kfree()-ed in cleanup_volume_info_contents().
Introduced in commit b946845a9dc523c759cae2b6a0f6827486c3221a
Signed-off-by: J.R. Okajima <hooanon05@yahoo.co.jp>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
CC: Stable <stable@kernel.org>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/cifs/connect.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 80c2e3add3a2..633c246b6775 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2878,7 +2878,8 @@ cleanup_volume_info_contents(struct smb_vol *volume_info) kfree(volume_info->username); kzfree(volume_info->password); kfree(volume_info->UNC); - kfree(volume_info->UNCip); + if (volume_info->UNCip != volume_info->UNC + 2) + kfree(volume_info->UNCip); kfree(volume_info->domainname); kfree(volume_info->iocharset); kfree(volume_info->prepath); |