Jeff Layton cd7bc18e09 cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals ...

commit a2934c7b36 upstream.

The scenario is this:

The kernel gets EREMOTE and starts chasing a DFS referral at mount time.
The tcon reference is put, which puts the session reference too, but
neither pointer is zeroed out.

The mount gets retried (goto try_mount_again) with new mount info.
Session setup fails fails and rc ends up being non-zero. The code then
falls through to the end and tries to put the previously freed tcon
pointer again.  Oops at: cifs_put_smb_ses+0x14/0xd0

Fix this by moving the initialization of the rc variable and the tcon,
pSesInfo and srvTcp pointers below the try_mount_again label. Also, add
a FreeXid() before the goto to prevent xid "leaks".

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reported-by: Gustavo Carvalho Homem <gustavo@angulosolido.pt>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2010-01-06 15:03:53 -08:00

..

9p

9p: fix build breakage introduced by FS-Cache

2009-12-01 07:35:11 -08:00

adfs

adfs: remove redundant test on unsigned

2009-09-24 07:21:05 -07:00

affs

affs: add ->sync_fs

2009-06-11 21:36:14 -04:00

afs

FS-Cache: Handle pages pending storage that get evicted under OOM conditions

2009-11-19 18:11:35 +00:00

autofs

trivial: remove unnecessary semicolons

2009-09-21 15:14:58 +02:00

autofs4

autofs4 - fix missed case when changing to use struct path

2009-08-31 17:44:05 -10:00

befs

fs: Make unload_nls() NULL pointer safe

2009-09-24 07:47:42 -04:00

bfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

btrfs

Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable

2009-11-11 13:38:59 -08:00

cachefiles

CacheFiles: Update IMA counters when using dentry_open

2009-12-01 07:35:11 -08:00

cifs

cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals

2010-01-06 15:03:53 -08:00

coda

headers: remove sched.h from poll.h

2009-10-04 15:05:10 -07:00

configfs

writeback: add name to backing_dev_info

2009-09-11 09:20:26 +02:00

cramfs

…

debugfs

debugfs: fix create mutex racy fops and private data

2009-12-18 14:04:16 -08:00

devpts

devpts_get_tty() should validate inode

2009-12-18 14:04:15 -08:00

dlm

dlm: fix socket fd translation

2009-09-30 12:19:44 -05:00

ecryptfs

ima: ecryptfs fix imbalance message

2009-10-08 11:31:38 -05:00

efs

get rid of BKL in fs/efs

2009-06-17 00:36:36 -04:00

exofs

exofs: remove BKL from super operations

2009-09-24 07:47:38 -04:00

exportfs

…

ext2

Merge branch 'hwpoison' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6

2009-09-24 07:53:22 -07:00

ext3

ext3: Fix data / filesystem corruption when write fails to copy data

2009-12-18 14:05:39 -08:00

ext4

ext4: Fix potential fiemap deadlock (mmap_sem vs. i_data_sem)

2009-12-14 09:45:28 -08:00

fat

Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6

2009-09-30 09:31:14 -07:00

freevxfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

fscache

FS-Cache: Provide nop fscache_stat_d() if CONFIG_FSCACHE_STATS=n

2009-11-20 21:50:44 +00:00

fuse

fuse: reject O_DIRECT flag also in fuse_create

2009-11-27 16:37:13 +01:00

gfs2

SLOW_WORK: Fix GFS2 to #include <linux/module.h> before using THIS_MODULE

2009-11-20 21:50:40 +00:00

hfs

hfs: fix a potential buffer overflow

2009-12-18 14:04:08 -08:00

hfsplus

hfsplus: refuse to mount volumes larger than 2TB

2009-10-29 07:39:27 -07:00

hostfs

hostfs: set maximum filesize in superblock for proper LFS support

2009-06-30 18:56:03 -07:00

hpfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

hppfs

…

hugetlbfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2009-09-24 08:32:11 -07:00

isofs

fs: Make unload_nls() NULL pointer safe

2009-09-24 07:47:42 -04:00

jbd

fs/jbd: Export log_start_commit to fix ext3 build.

2009-11-12 10:24:12 +01:00

jbd2

jbd2: don't wipe the journal on a failed journal checksum

2009-12-18 14:03:56 -08:00

jffs2

jffs2: Fix long-standing bug with symlink garbage collection.

2009-12-18 14:05:52 -08:00

jfs

fs: Make unload_nls() NULL pointer safe

2009-09-24 07:47:42 -04:00

lockd

headers: utsname.h redux

2009-09-23 18:13:10 -07:00

minix

V3 minixfs: add missing directory type checking

2009-09-23 07:39:57 -07:00

ncpfs

const: mark struct vm_struct_operations

2009-09-27 11:39:25 -07:00

nfs

NFS: Fix nfs_migrate_page()

2009-12-18 14:04:09 -08:00

nfs_common

…

nfsd

Fix memory corruption caused by nfsd readdir+

2009-11-14 12:55:55 -08:00

nilfs2

nilfs2: deleted inconsistent comment in nilfs_load_inode_block()

2009-11-15 17:17:46 +09:00

nls

Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6

2009-09-30 09:31:14 -07:00

notify

dnotify: ignore FS_EVENT_ON_CHILD

2009-10-20 18:02:33 -04:00

ntfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2009-09-24 08:32:11 -07:00

ocfs2

ocfs2: Trivial cleanup of jbd compatibility layer removal

2009-11-13 15:45:05 -08:00

omfs

const: constify remaining file_operations

2009-10-01 16:11:11 -07:00

openpromfs

…

partitions

block: Seperate read and write statistics of in_flight requests v2

2009-10-06 20:16:55 +02:00

proc

procfs: fix /proc/<pid>/stat stack pointer for kernel threads

2009-11-17 17:40:33 -08:00

qnx4

qnx4: remove write support

2009-09-23 07:39:30 -07:00

quota

const: make struct super_block::s_qcop const

2009-09-22 07:17:24 -07:00

ramfs

truncate: use new helpers

2009-09-24 08:41:47 -04:00

reiserfs

const: make struct super_block::s_qcop const

2009-09-22 07:17:24 -07:00

romfs

ROMFS: fix length used with romfs_dev_strnlen() function

2009-10-11 11:33:56 -07:00

smbfs

fs: Make unload_nls() NULL pointer safe

2009-09-24 07:47:42 -04:00

squashfs

const: mark remaining super_operations const

2009-09-22 07:17:24 -07:00

sysfs

sysfs: Don't leak secdata when a sysfs_dirent is freed.

2009-11-05 08:19:18 +11:00

sysv

get rid of BKL in fs/sysv

2009-06-17 00:36:37 -04:00

ubifs

const: mark struct vm_struct_operations

2009-09-27 11:39:25 -07:00

udf

udf: Fix possible corruption when close races with write

2009-09-14 19:13:01 +02:00

ufs

ufs: sector_t cannot be negative

2009-06-18 13:03:46 -07:00

xfs

xfs: copy li_lsn before dropping AIL lock

2009-11-17 10:26:49 -06:00

aio.c

aio.c: move EXPORT* macros to line after function

2009-09-23 07:39:29 -07:00

anon_inodes.c

headers: remove sched.h from poll.h

2009-10-04 15:05:10 -07:00

attr.c

truncate: new helpers

2009-09-24 08:41:47 -04:00

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

fdpic: ignore the loader's PT_GNU_STACK when calculating the stack size

2009-09-24 07:21:02 -07:00

binfmt_elf.c

elf: clean up fill_note_info()

2009-09-24 07:21:01 -07:00

binfmt_em86.c

…

binfmt_flat.c

flat: use IS_ERR_VALUE() helper macro

2009-09-24 07:21:03 -07:00

binfmt_misc.c

…

binfmt_script.c

…

binfmt_som.c

…

bio-integrity.c

block: Create bip slabs with embedded integrity vectors

2009-07-01 10:56:25 +02:00

bio.c

Fix bio_alloc() and bio_kmalloc() documentation

2009-11-02 11:41:13 +01:00

block_dev.c

block: use after free bug in __blkdev_get

2009-10-26 15:27:11 +01:00

buffer.c

Merge branch 'writeback' of git://git.kernel.dk/linux-2.6-block

2009-09-25 09:27:30 -07:00

char_dev.c

fs/char_dev.c: remove useless loop

2009-09-24 07:21:03 -07:00

compat_binfmt_elf.c

…

compat_ioctl.c

fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl

2009-11-12 07:25:57 -08:00

compat.c

x86, fs: Fix x86 procfs stack information for threads on 64-bit

2009-11-04 13:25:03 +01:00

dcache.c

sched: Pull up the might_sleep() check into cond_resched()

2009-07-18 15:51:44 +02:00

dcookies.c

…

direct-io.c

block: Do away with the notion of hardsect_size

2009-05-22 23:22:54 +02:00

drop_caches.c

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24 07:21:04 -07:00

eventfd.c

anonfd: split interface into file creation and install

2009-09-23 07:39:29 -07:00

eventpoll.c

epoll: fix nested calls support

2009-06-18 13:03:41 -07:00

exec.c

exec: setup_arg_pages() fails to return errors

2009-11-12 07:25:58 -08:00

fcntl.c

fcntl: rename F_OWNER_GID to F_OWNER_PGRP

2009-11-17 17:40:33 -08:00

fifo.c

…

file_table.c

sysctl: remove "struct file *" argument of ->proc_handler

2009-09-24 07:21:04 -07:00

file.c

headers: remove sched.h from interrupt.h

2009-10-11 11:20:58 -07:00

filesystems.c

fs: Mark get_filesystem_list() as __init function.

2009-04-20 23:02:52 -04:00

fs_struct.c

…

fs-writeback.c

writeback: pass in super_block to bdi_start_writeback()

2009-09-26 00:10:40 +02:00

generic_acl.c

…

inode.c

vfs: optimize touch_time() too

2009-09-24 07:47:27 -04:00

internal.h

fs: fix overflow in sys_mount() for in-kernel calls

2009-09-24 08:40:15 -04:00

ioctl.c

__generic_block_fiemap(): fix for files bigger than 4GB

2009-11-12 07:26:01 -08:00

ioprio.c

…

Kconfig

powerpc: Cleanup Kconfig selection of hugetlbfs support

2009-10-30 15:03:54 +11:00

Kconfig.binfmt

…

libfs.c

libfs: return error code on failed attr set

2009-09-24 07:47:30 -04:00

locks.c

const: make lock_manager_operations const

2009-09-22 07:17:25 -07:00

Makefile

nilfs2: update makefile and Kconfig

2009-04-07 08:31:16 -07:00

mbcache.c

…

mpage.c

ext4: Properly initialize the buffer_head state

2009-05-13 15:13:42 -04:00

namei.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

2009-09-11 08:55:49 -07:00

namespace.c

fs: fix overflow in sys_mount() for in-kernel calls

2009-09-24 08:40:15 -04:00

nfsctl.c

…

no-block.c

…

open.c

fs: change sys_truncate length parameter type

2009-09-23 09:21:05 -07:00

pipe.c

fs: pipe.c null pointer dereference

2009-10-22 08:11:44 +09:00

pnode.c

…

pnode.h

…

posix_acl.c

…

read_write.c

vfs: remove redundant position check in do_sendfile

2009-09-24 07:47:34 -04:00

read_write.h

…

readdir.c

…

select.c

headers: remove sched.h from poll.h

2009-10-04 15:05:10 -07:00

seq_file.c

vfs: seq_file: add helpers for data filling

2009-09-24 07:47:35 -04:00

signalfd.c

…

splice.c

Merge branch 'for-2.6.32' of git://git.kernel.dk/linux-2.6-block

2009-09-14 17:55:15 -07:00

stack.c

…

stat.c

kill vfs_stat_fd / vfs_lstat_fd

2009-04-20 23:02:52 -04:00

super.c

freeze_bdev: grab active reference to frozen superblocks

2009-09-24 07:47:41 -04:00

sync.c

fs/buffer.c: clean up EXPORT* macros

2009-09-23 07:39:29 -07:00

timerfd.c

…

utimes.c

…

xattr_acl.c

…

xattr.c

VFS: Factor out part of vfs_setxattr so it can be called from the SELinux hook for inode_setsecctx.

2009-09-10 10:11:22 +10:00