Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8367224b authored by Jeff Layton's avatar Jeff Layton Committed by Steve French
Browse files

cifs: fix double-free of "string" in cifs_parse_mount_options 



Dan reported the following regression in commit d387a5c5:

    + fs/cifs/connect.c:1903 cifs_parse_mount_options() error: double free of 'string'

That patch has some of the new option parsing code free "string" without
setting the variable to NULL afterward. Since "string" is automatically
freed in an error condition, fix the code to just rely on that instead
of freeing it explicitly.

Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarSteve French <smfrench@gmail.com>
parent 18000985

fs/cifs/connect.c

+2 −7
Original line number Diff line number Diff line
@@ -1624,14 +1624,11 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, 
		case Opt_unc:

			string = vol->UNC;

			vol->UNC = match_strdup(args);

			if (vol->UNC == NULL) {

				kfree(string);

			if (vol->UNC == NULL)

				goto out_nomem;

			}



			convert_delimiter(vol->UNC, '\\');

			if (vol->UNC[0] != '\\' || vol->UNC[1] != '\\') {

				kfree(string);

				printk(KERN_ERR "CIFS: UNC Path does not "

						"begin with // or \\\\\n");

				goto cifs_parse_mount_err;
@@ -1687,10 +1684,8 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, 


			string = vol->prepath;

			vol->prepath = match_strdup(args);

			if (vol->prepath == NULL) {

				kfree(string);

			if (vol->prepath == NULL)

				goto out_nomem;

			}

			/* Compare old prefixpath= option to new one */

			if (!string || strcmp(string, vol->prepath))

				printk(KERN_WARNING "CIFS: the value of the "