From: Vasily Averin <vvs@sw.ru>
Date: Fri, 16 Mar 2007 21:38:24 +0000 (-0800)
Subject: [PATCH] smbfs: double free memory corruption
X-Git-Tag: v2.6.21-rc5~90
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1174cf730179d8f029b9e93cb9a4d5bfb08d1202;p=linux-2.6

[PATCH] smbfs: double free memory corruption

smbfs allocates rq_trans2buffer to handle server's multi transaction2 response
messages.  As struct smb_request may be reused, rq_trans2buffer is freed
before each new request.  However if last servers's response is not multi but
single trans2 message then new rq_trans2buffer is not allocated but last
smb_rput still tries to free it again.

To prevent this issue rq_trans2buffer pointer should be set to NULL after
kfree.

Signed-off-by: Vasily Averin <vvs@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index 42261dbdf6..723f7c6676 100644
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -181,6 +181,7 @@ static int smb_setup_request(struct smb_request *req)
 	req->rq_errno = 0;
 	req->rq_fragment = 0;
 	kfree(req->rq_trans2buffer);
+	req->rq_trans2buffer = NULL;
 
 	return 0;
 }