evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

cifs: double free on mount failure

Browse source 
if we get to out_super with ->s_root already set (e.g. with
cifs_get_root() failure), we'll end up with cifs_put_super()
called and ->mountdata freed twice.  We'll also get cifs_sb
freed twice and cifs_sb->local_nls dropped twice.  The problem
is, we can get to out_super both with and without ->s_root,
which makes ->put_super() a bad place for such work.

Switch to ->kill_sb(), have all that work done there after
kill_anon_super().  Unlike ->put_super(), ->kill_sb() is
called by deactivate_locked_super() whether we have ->s_root
or not.

Acked-by: Pavel Shilovsky <piastryyy@gmail.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2011-06-17 08:34:57 -04:00
parent dd85446619
commit 6d6861757d
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
fs/cifs/cifsfs.c
View file

@ -184,11 +184,13 @@ cifs_put_super(struct super_block *sb)
rc = cifs_umount(sb, cifs_sb); rc = cifs_umount(sb, cifs_sb);
if (rc) if (rc)
cERROR(1, "cifs_umount failed with return code %d", rc); cERROR(1, "cifs_umount failed with return code %d", rc);
if (cifs_sb->mountdata) { }
kfree(cifs_sb->mountdata);
cifs_sb->mountdata = NULL;
}
static void cifs_kill_sb(struct super_block *sb)
{
struct cifs_sb_info *cifs_sb = CIFS_SB(sb);
kill_anon_super(sb);
kfree(cifs_sb->mountdata);
unload_nls(cifs_sb->local_nls); unload_nls(cifs_sb->local_nls);
kfree(cifs_sb); kfree(cifs_sb);
} }
@ -729,8 +731,8 @@ out_shared:
goto out; goto out;
out_super: out_super:
kfree(cifs_sb->mountdata);
deactivate_locked_super(sb); deactivate_locked_super(sb);
goto out;
out_cifs_sb: out_cifs_sb:
unload_nls(cifs_sb->local_nls); unload_nls(cifs_sb->local_nls);
@ -827,7 +829,7 @@ struct file_system_type cifs_fs_type = {
.owner = THIS_MODULE, .owner = THIS_MODULE,
.name = "cifs", .name = "cifs",
.mount = cifs_do_mount, .mount = cifs_do_mount,
.kill_sb = kill_anon_super, .kill_sb = cifs_kill_sb,
/* .fs_flags */ /* .fs_flags */
}; };
const struct inode_operations cifs_dir_inode_ops = { const struct inode_operations cifs_dir_inode_ops = {