cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals
commitc7d622e356d6a21b788bd34cef607e01ae28c197
authorJeff Layton <jlayton@redhat.com>
Thu, 3 Dec 2009 13:09:41 +0000 (3 08:09 -0500)
committerGreg Kroah-Hartman <gregkh@suse.de>
Wed, 6 Jan 2010 22:26:20 +0000 (6 14:26 -0800)
treeb5f7441bfda31ddb1406ad1451fab1f11f18e024
parent637cd43cefe67a93f58a5147762ad66a556d0483
cifs: NULL out tcon, pSesInfo, and srvTcp pointers when chasing DFS referrals

commit a2934c7b363ddcc001964f2444649f909e583bef upstream.

The scenario is this:

The kernel gets EREMOTE and starts chasing a DFS referral at mount time.
The tcon reference is put, which puts the session reference too, but
neither pointer is zeroed out.

The mount gets retried (goto try_mount_again) with new mount info.
Session setup fails fails and rc ends up being non-zero. The code then
falls through to the end and tries to put the previously freed tcon
pointer again.  Oops at: cifs_put_smb_ses+0x14/0xd0

Fix this by moving the initialization of the rc variable and the tcon,
pSesInfo and srvTcp pointers below the try_mount_again label. Also, add
a FreeXid() before the goto to prevent xid "leaks".

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reported-by: Gustavo Carvalho Homem <gustavo@angulosolido.pt>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
fs/cifs/connect.c