cifs: fix double-free of "string" in cifs_parse_mount_options (8367224b) · Commits · 戴 / test

Dan reported the following regression in commit : + fs/cifs/connect.c:1903 cifs_parse_mount_options() error: double free of 'string' That patch has some of the new option parsing code free "string" without setting the variable to NULL afterward. Since "string" is automatically freed in an error condition, fix the code to just rely on that instead of freeing it explicitly. Reported-by:

Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:

Jeff Layton <jlayton@redhat.com> Signed-off-by:

Steve French <smfrench@gmail.com>

fs/cifs/connect.c

+2 −7

Original line number	Diff line number	Diff line
		@@ -1624,14 +1624,11 @@ cifs_parse_mount_options(const char mountdata, const char devname,
		case Opt_unc:
		string = vol->UNC;
		vol->UNC = match_strdup(args);
		if (vol->UNC == NULL) {
		kfree(string);
		if (vol->UNC == NULL)
		goto out_nomem;
		}

		convert_delimiter(vol->UNC, '\\');
		if (vol->UNC[0] != '\\' \|\| vol->UNC[1] != '\\') {
		kfree(string);
		printk(KERN_ERR "CIFS: UNC Path does not "
		"begin with // or \\\\\n");
		goto cifs_parse_mount_err;
		@@ -1687,10 +1684,8 @@ cifs_parse_mount_options(const char mountdata, const char devname,

		string = vol->prepath;
		vol->prepath = match_strdup(args);
		if (vol->prepath == NULL) {
		kfree(string);
		if (vol->prepath == NULL)
		goto out_nomem;
		}
		/* Compare old prefixpath= option to new one */
		if (!string \|\| strcmp(string, vol->prepath))
		printk(KERN_WARNING "CIFS: the value of the "

Admin message