Jeff Layton c7d622e356 cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals ...

commit a2934c7b363ddcc001964f2444649f909e583bef upstream.

The scenario is this:

The kernel gets EREMOTE and starts chasing a DFS referral at mount time.
The tcon reference is put, which puts the session reference too, but
neither pointer is zeroed out.

The mount gets retried (goto try_mount_again) with new mount info.
Session setup fails fails and rc ends up being non-zero. The code then
falls through to the end and tries to put the previously freed tcon
pointer again.  Oops at: cifs_put_smb_ses+0x14/0xd0

Fix this by moving the initialization of the rc variable and the tcon,
pSesInfo and srvTcp pointers below the try_mount_again label. Also, add
a FreeXid() before the goto to prevent xid "leaks".

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reported-by: Gustavo Carvalho Homem <gustavo@angulosolido.pt>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

2010-01-06 14:26:20 -08:00

..

9p

9p: remove unnecessary v9fses->options which duplicates the mount string

2009-08-17 16:42:28 -05:00

adfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

affs

affs: add ->sync_fs

2009-06-11 21:36:14 -04:00

afs

AFS: Stop readlink() on AFS crashing due to NULL 'file' ptr

2009-08-27 12:22:08 -07:00

autofs

switch follow_down()

2009-06-11 21:36:01 -04:00

autofs4

autofs4 - fix missed case when changing to use struct path

2009-08-31 17:44:05 -10:00

befs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

2009-06-17 08:46:57 -07:00

bfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

btrfs

btrfs: fix inode rbtree corruption

2009-08-21 10:09:44 +02:00

cachefiles

enforce ->sync_fs is only called for rw superblock

2009-06-11 21:36:06 -04:00

cifs

cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals

2010-01-06 14:26:20 -08:00

coda

splice: implement default splice_read method

2009-05-11 14:13:10 +02:00

configfs

configfs: Rework configfs_depend_item() locking and make lockdep happy

2009-04-30 10:48:26 -07:00

cramfs

…

debugfs

debugfs: fix create mutex racy fops and private data

2009-12-18 13:43:20 -08:00

devpts

devpts_get_tty() should validate inode

2009-12-18 13:43:21 -08:00

dlm

dlm: free socket in error exit path

2009-07-14 12:28:43 -05:00

ecryptfs

ima: ecryptfs fix imbalance message

2009-10-12 12:40:13 -07:00

efs

get rid of BKL in fs/efs

2009-06-17 00:36:36 -04:00

exofs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

exportfs

…

ext2

ext2: fix unbalanced kmap()/kunmap()

2009-09-05 13:41:08 -07:00

ext3

ext3: Fix data / filesystem corruption when write fails to copy data

2009-12-18 13:44:18 -08:00

ext4

ext4: Fix potential fiemap deadlock (mmap_sem vs. i_data_sem)

2009-12-14 08:08:12 -08:00

fat

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

freevxfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

fscache

FS-Cache: Fixup renamed filenames in comments in internal.h

2009-05-27 10:20:13 -07:00

fuse

fuse: reject O_DIRECT flag also in fuse_create

2009-12-08 10:21:37 -08:00

gfs2

GFS2: Fix permissions on "recover" file

2009-08-14 14:04:46 +01:00

hfs

hfs: fix a potential buffer overflow

2009-12-18 13:43:22 -08:00

hfsplus

hfsplus: refuse to mount volumes larger than 2TB

2009-11-09 16:22:15 -08:00

hostfs

hostfs: set maximum filesize in superblock for proper LFS support

2009-06-30 18:56:03 -07:00

hpfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

hppfs

…

hugetlbfs

mm: fix hugetlb bug due to user_shm_unlock call

2009-08-24 12:53:01 -07:00

isofs

isofs: fix Joliet regression

2009-07-10 19:18:59 -07:00

jbd

jbd: fix race between write_metadata_buffer and get_write_access

2009-07-21 11:54:42 +02:00

jbd2

jbd2: don't wipe the journal on a failed journal checksum

2009-12-18 13:43:23 -08:00

jffs2

jffs2: Fix long-standing bug with symlink garbage collection.

2009-12-18 13:44:21 -08:00

jfs

jfs: Fix early release of acl in jfs_get_acl

2009-07-23 11:08:36 -05:00

lockd

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

minix

Making fs/minix/minix.h double including safe

2009-06-22 11:34:42 -07:00

ncpfs

NLS: update handling of Unicode

2009-06-15 21:44:43 -07:00

nfs

NFSv4: Fix a cache validation bug which causes getcwd() to return ENOENT

2009-12-08 10:21:36 -08:00

nfs_common

…

nfsd

nfsd4: fix null dereference creating nfsv4 callback client

2009-10-05 09:32:12 -07:00

nilfs2

nilfs2: fix kernel oops in error case of nilfs_ioctl_move_blocks

2009-12-08 10:20:50 -08:00

nls

NLS: update handling of Unicode

2009-06-15 21:44:43 -07:00

notify

fsnotify: do not set group for a mark before it is on the i_list

2009-11-09 16:22:46 -08:00

ntfs

ntfs: use is_power_of_2() function for clarity.

2009-06-16 19:47:48 -07:00

ocfs2

Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2

2009-09-05 13:38:37 -07:00

omfs

switch omfs to simple_fsync()

2009-06-11 21:36:13 -04:00

openpromfs

…

partitions

partitions: fix broken uevent_suppress conversion

2009-07-12 13:02:09 -07:00

proc

pidns: fix a leak in /proc dentries and inodes with pid namespaces.

2009-12-08 10:21:21 -08:00

qnx4

fs/qnx4: sanitize includes

2009-06-11 21:36:12 -04:00

quota

quota: Silence lockdep on quota_on

2009-07-30 17:31:23 +02:00

ramfs

fs/ramfs/file-nommu.c needs include/linux/sched.h

2009-07-29 19:10:36 -07:00

reiserfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

romfs

ROMFS: romfs_dev_read() error ignored

2009-05-09 10:49:41 -04:00

smbfs

push BKL down into ->put_super

2009-06-11 21:36:07 -04:00

squashfs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

sysfs

sysfs: Allow sysfs_notify_dirent to be called from interrupt context.

2009-10-22 15:11:59 -07:00

sysv

get rid of BKL in fs/sysv

2009-06-17 00:36:37 -04:00

ubifs

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

udf

udf: Fix loading of VAT inode when drive wrongly reports number of recorded blocks

2009-07-30 17:28:26 +02:00

ufs

ufs: sector_t cannot be negative

2009-06-18 13:03:46 -07:00

xfs

xfs: actually enable the swapext compat handler

2009-09-01 17:00:46 -05:00

aio.c

eventfd: revised interface and cleanups

2009-06-30 18:55:58 -07:00

anon_inodes.c

fs: Provide empty .set_page_dirty() aop for anon inodes

2009-06-18 14:46:10 +02:00

attr.c

…

bad_inode.c

…

binfmt_aout.c

…

binfmt_elf_fdpic.c

elf_core_dump: use rcu_read_lock() to access ->real_parent

2009-06-18 13:03:52 -07:00

binfmt_elf.c

binfmt_elf: fix PT_INTERP bss handling

2009-09-24 08:43:51 -07:00

binfmt_em86.c

…

binfmt_flat.c

flat: fix uninitialized ptr with shared libs

2009-08-07 10:39:57 -07:00

binfmt_misc.c

…

binfmt_script.c

…

binfmt_som.c

…

bio-integrity.c

block: Create bip slabs with embedded integrity vectors

2009-07-01 10:56:25 +02:00

bio.c

block: fix sg SG_DXFER_TO_FROM_DEV regression

2009-07-10 20:31:53 +02:00

block_dev.c

block: use after free bug in __blkdev_get

2009-12-08 10:22:27 -08:00

buffer.c

Re-introduce page mapping check in mark_buffer_dirty()

2009-08-21 17:40:08 -07:00

char_dev.c

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

compat_binfmt_elf.c

…

compat_ioctl.c

fs: add missing compat_ptr handling for FS_IOC_RESVSP ioctl

2009-12-08 10:21:19 -08:00

compat.c

exec: do not sleep in TASK_TRACED under ->cred_guard_mutex

2009-09-05 11:30:42 -07:00

dcache.c

dcache: extrace and use d_unlinked()

2009-06-11 21:36:06 -04:00

dcookies.c

…

direct-io.c

block: Do away with the notion of hardsect_size

2009-05-22 23:22:54 +02:00

drop_caches.c

mm: remove __invalidate_mapping_pages variant

2009-06-16 19:47:43 -07:00

eventfd.c

eventfd: revised interface and cleanups

2009-06-30 18:55:58 -07:00

eventpoll.c

epoll: fix nested calls support

2009-06-18 13:03:41 -07:00

exec.c

exec: do not sleep in TASK_TRACED under ->cred_guard_mutex

2009-09-05 11:30:42 -07:00

fcntl.c

headers: smp_lock.h redux

2009-07-12 12:22:34 -07:00

fifo.c

…

file_table.c

fs: move mark_files_ro into file_table.c

2009-06-11 21:36:02 -04:00

file.c

…

filesystems.c

fs: Mark get_filesystem_list() as __init function.

2009-04-20 23:02:52 -04:00

fs_struct.c

…

fs-writeback.c

cleanup __writeback_single_inode

2009-06-24 08:15:26 -04:00

generic_acl.c

…

inode.c

fs: make sure data stored into inode is properly seen before unlocking new inode

2009-10-05 09:31:39 -07:00

internal.h

Trim a bit of crap from fs.h

2009-06-11 21:36:07 -04:00

ioctl.c

fs: Add new pre-allocation ioctls to vfs for compatibility with legacy xfs ioctls

2009-06-24 08:15:27 -04:00

ioprio.c

…

Kconfig

fs/Kconfig: move nilfs2 out

2009-07-14 12:34:17 +09:00

Kconfig.binfmt

…

libfs.c

vfs: make get_sb_pseudo set s_maxbytes to value that can be cast to signed

2009-08-18 16:31:12 -07:00

locks.c

lockd: call locks_release_private to cleanup per-filesystem state

2009-04-24 16:36:03 -04:00

Makefile

nilfs2: update makefile and Kconfig

2009-04-07 08:31:16 -07:00

mbcache.c

…

mpage.c

ext4: Properly initialize the buffer_head state

2009-05-13 15:13:42 -04:00

namei.c

IMA: open new file for read

2009-10-12 12:40:22 -07:00

namespace.c

vfs: mnt_want_write_file(): fix special file handling

2009-08-07 10:39:56 -07:00

nfsctl.c

…

no-block.c

…

open.c

fs: Add new pre-allocation ioctls to vfs for compatibility with legacy xfs ioctls

2009-06-24 08:15:27 -04:00

pipe.c

fs: pipe.c null pointer dereference

2009-11-09 16:21:45 -08:00

pnode.c

…

pnode.h

…

posix_acl.c

…

read_write.c

splice: implement default splice_read method

2009-05-11 14:13:10 +02:00

read_write.h

…

readdir.c

…

select.c

poll/select: initialize triggered field of struct poll_wqueues

2009-08-15 18:40:11 -07:00

seq_file.c

seq_file: add function to write binary data

2009-06-18 13:03:57 -07:00

signalfd.c

…

splice.c

splice: fix kmaps in default_file_splice_write()

2009-05-19 11:37:46 +02:00

stack.c

…

stat.c

kill vfs_stat_fd / vfs_lstat_fd

2009-04-20 23:02:52 -04:00

super.c

... and the same for vfsmount id/mount group id

2009-06-24 08:15:26 -04:00

sync.c

sys_sync(): fix 16% performance regression in ffsb create_4k test

2009-07-06 13:57:03 -07:00

timerfd.c

…

utimes.c

…

xattr_acl.c

…

xattr.c

fs: introduce mnt_clone_write

2009-06-11 21:36:02 -04:00