mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
cifs: fix double free error on share and prefix
Currently if the call dfs_cache_get_tgt_share fails we cannot fully guarantee that share and prefix are set to NULL and the next iteration of the loop can end up potentially double freeing these pointers. Since the semantics of dfs_cache_get_tgt_share are ambiguous for failure cases with the setting of share and prefix (currently now and the possibly the future), it seems prudent to set the pointers to NULL when the objects are free'd to avoid any double frees. Addresses-Coverity: ("Double free") Fixes: 96296c946a2a ("cifs: handle RESP_GET_DFS_REFERRAL.PathConsumed in reconnect") Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Steve French <stfrench@microsoft.com> Reviewed-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
This commit is contained in:
parent
7548e1da8d
commit
c6a80e1ff4
1 changed files with 2 additions and 0 deletions
|
@ -5574,6 +5574,8 @@ int cifs_tree_connect(const unsigned int xid, struct cifs_tcon *tcon, const stru
|
|||
|
||||
kfree(share);
|
||||
kfree(prefix);
|
||||
share = NULL;
|
||||
prefix = NULL;
|
||||
|
||||
rc = dfs_cache_get_tgt_share(tcon->dfs_path + 1, it, &share, &prefix);
|
||||
if (rc) {
|
||||
|
|
Loading…
Reference in a new issue