[patch] cifs: NULL dereference on allocation failure

Jeff Layton jlayton at redhat.com
Tue Jan 24 05:43:49 MST 2012


On Tue, 24 Jan 2012 07:41:04 -0500
Jeff Layton <jlayton at samba.org> wrote:

> On Tue, 24 Jan 2012 11:39:22 +0300
> Dan Carpenter <dan.carpenter at oracle.com> wrote:
> 
> > We should just return directly here, the goto causes a NULL dereference.
> > 
> > Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
> > 
> > diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
> > index 986709a..026d646 100644
> > --- a/fs/cifs/connect.c
> > +++ b/fs/cifs/connect.c
> > @@ -3857,10 +3857,8 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, uid_t fsuid)
> >  	struct smb_vol *vol_info;
> >  
> >  	vol_info = kzalloc(sizeof(*vol_info), GFP_KERNEL);
> > -	if (vol_info == NULL) {
> > -		tcon = ERR_PTR(-ENOMEM);
> > -		goto out;
> > -	}
> > +	if (vol_info == NULL)
> > +		return ERR_PTR(-ENOMEM);
> >  
> >  	vol_info->local_nls = cifs_sb->local_nls;
> >  	vol_info->linux_uid = fsuid;
> 
> Huh? How so? Here's what "out:" looks like in my tree:
> 
> ---------------[snip]----------------
> out:
>         kfree(vol_info);
> 
>         return tcon;
> ---------------[snip]----------------
> 
> vol_info is NULL, so the kfree is safe. This patch shouldn't break
> anything, but I don't think it's strictly necessary.
> 

Sorry, I was looking at the wrong branch. The patch is correct and
necessary. With the most recent changes, here's what "out:" looks like:

---------------[snip]----------------
out:
        kfree(vol_info->username);
        kfree(vol_info->password);
        kfree(vol_info);
---------------[snip]----------------

Reviewed-by: Jeff Layton <jlayton at redhat.com>


More information about the samba-technical mailing list