• Jeff Layton's avatar
    cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals · a2934c7b
    Jeff Layton authored
    The scenario is this:
    
    The kernel gets EREMOTE and starts chasing a DFS referral at mount time.
    The tcon reference is put, which puts the session reference too, but
    neither pointer is zeroed out.
    
    The mount gets retried (goto try_mount_again) with new mount info.
    Session setup fails fails and rc ends up being non-zero. The code then
    falls through to the end and tries to put the previously freed tcon
    pointer again.  Oops at: cifs_put_smb_ses+0x14/0xd0
    
    Fix this by moving the initialization of the rc variable and the tcon,
    pSesInfo and srvTcp pointers below the try_mount_again label. Also, add
    a FreeXid() before the goto to prevent xid "leaks".
    Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
    Reported-by: default avatarGustavo Carvalho Homem <gustavo@angulosolido.pt>
    CC: stable <stable@kernel.org>
    Signed-off-by: default avatarSteve French <sfrench@us.ibm.com>
    a2934c7b
connect.c 82.4 KB