Vasily Averin 1174cf7301 [PATCH] smbfs: double free memory corruption ...

smbfs allocates rq_trans2buffer to handle server's multi transaction2 response
messages.  As struct smb_request may be reused, rq_trans2buffer is freed
before each new request.  However if last servers's response is not multi but
single trans2 message then new rq_trans2buffer is not allocated but last
smb_rput still tries to free it again.

To prevent this issue rq_trans2buffer pointer should be set to NULL after
kfree.

Signed-off-by: Vasily Averin <vvs@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2007-03-16 19:25:05 -07:00

..

9p

9p: implement optional loose read cache

2007-02-18 10:16:10 -06:00

adfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

affs

[PATCH] affs: implement ->drop_inode

2007-02-20 17:10:15 -08:00

afs

[PATCH] remove many unneeded #includes of sched.h

2007-02-14 08:09:54 -08:00

autofs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

autofs4

[PATCH] autofs4: check for directory re-create in lookup

2007-02-20 17:10:15 -08:00

befs

[PATCH] mark struct inode_operations const 1

2007-02-12 09:48:46 -08:00

bfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

cifs

[PATCH] cifs endianness annotations

2007-03-14 15:27:50 -07:00

coda

[PATCH] sysctl: remove insert_at_head from register_sysctl

2007-02-14 08:09:59 -08:00

configfs

configfs: add missing mutex_unlock()

2007-03-14 14:37:21 -07:00

cramfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

debugfs

debugfs: Remove misleading comments.

2007-02-16 15:19:17 -08:00

devpts

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

dlm

[DLM] fs/dlm/user.c should #include "user.h"

2007-03-07 13:58:21 -05:00

ecryptfs

[PATCH] eCryptfs: fix possible NULL ptr deref in ecryptfs_d_release()

2007-03-16 19:25:05 -07:00

efs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

exportfs

[PATCH] VFS: Make filldir_t and struct kstat deal in 64-bit inode numbers

2006-10-03 08:03:40 -07:00

ext2

[PATCH] ext[234]: update documentation

2007-02-20 17:10:14 -08:00

ext3

[PATCH] ext[34]: EA block reference count racing fix

2007-03-01 14:53:38 -08:00

ext4

[PATCH] ext[34]: EA block reference count racing fix

2007-03-01 14:53:38 -08:00

fat

[PATCH] FAT: DIO-write fallback to normal buffered

2007-02-20 17:10:14 -08:00

freevxfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

fuse

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

gfs2

[GFS2] Fix bz 229873, alternate test: assertion "!ip->i_inode.i_mapping->nrpages" failed

2007-03-07 14:03:53 -05:00

hfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

hfsplus

[PATCH] remove many unneeded #includes of sched.h

2007-02-14 08:09:54 -08:00

hostfs

[PATCH] uml: hostfs: make hostfs= option work as a jail, as intended.

2007-03-08 07:38:21 -08:00

hpfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

hppfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

hugetlbfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

isofs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

jbd

[PATCH] jbd: wait for already submitted t_sync_datalist buffer to complete

2006-12-22 08:55:51 -08:00

jbd2

[PATCH] jbd2: wait for already submitted t_sync_datalist buffer to complete

2006-12-07 08:39:42 -08:00

jffs2

[JFFS2] print a message when marking bad block

2007-03-09 12:29:39 +00:00

jfs

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6

2007-02-26 11:44:51 -08:00

lockd

Replace remaining references to "driverfs" with "sysfs".

2007-02-17 19:13:42 +01:00

minix

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

msdos

[PATCH] mark struct inode_operations const 2

2007-02-12 09:48:46 -08:00

ncpfs

ncpfs: make sure server connection survives a kill

2007-03-06 13:26:27 +01:00

nfs

[PATCH] sysctl: remove insert_at_head from register_sysctl

2007-02-14 08:09:59 -08:00

nfs_common

[PATCH] nfs_common endianness annotations

2006-10-20 10:26:41 -07:00

nfsd

[PATCH] include of asm/pgtable.h in nfsfh is bogus

2007-03-14 15:27:49 -07:00

nls

[PATCH] fs: make nls_cp936.c handle some U00XY characters and U20AC correctly

2006-12-07 08:39:46 -08:00

ntfs

[PATCH] sysctl: remove the proc_dir_entry member for the sysctl tables

2007-02-14 08:10:00 -08:00

ocfs2

ocfs2_dlm: Add missing locks in dlm_empty_lockres

2007-03-14 14:37:35 -07:00

openpromfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

partitions

[PATCH] check_partition(): fix error check

2007-03-08 07:38:22 -08:00

proc

[PATCH] sanitize security_getprocattr() API

2007-03-14 15:27:48 -07:00

qnx4

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

ramfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

reiserfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

romfs

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

smbfs

[PATCH] smbfs: double free memory corruption

2007-03-16 19:25:05 -07:00

sysfs

[PATCH] sysfs: reinstate exclusion between method calls and attribute unregistration

2007-03-15 15:29:26 -07:00

sysv

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

udf

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

ufs

[PATCH] ufs2: tindirect truncate fix

2007-03-16 19:25:03 -07:00

vfat

[PATCH] mark struct inode_operations const 3

2007-02-12 09:48:46 -08:00

xfs

[PATCH] xfs warning fix

2007-02-20 17:10:13 -08:00

aio.c

[PATCH] Transform kmem_cache_alloc()+memset(0) -> kmem_cache_zalloc().

2007-02-11 10:51:27 -08:00

attr.c

…

bad_inode.c

[PATCH] mark struct inode_operations const 1

2007-02-12 09:48:46 -08:00

binfmt_aout.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

binfmt_elf_fdpic.c

[PATCH] Remove final references to deprecated "MAP_ANON" page protection flag

2007-02-11 10:51:17 -08:00

binfmt_elf.c

[PATCH] x86: Don't require the vDSO for handling a.out signals

2007-02-13 13:26:26 +01:00

binfmt_em86.c

…

binfmt_flat.c

[PATCH] uclinux: correctly remap bin_fmtflat exe allocated mem regions

2007-02-09 10:45:33 -08:00

binfmt_misc.c

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

binfmt_script.c

…

binfmt_som.c

[PARISC] Fix fs/binfmt_som.c

2006-10-04 06:51:26 -06:00

bio.c

[PATCH] optimize o_direct on block devices

2006-12-13 09:05:50 -08:00

block_dev.c

[PATCH] lockdep: annotate BLKPG_DEL_PARTITION

2007-02-20 17:10:16 -08:00

buffer.c

[PATCH] fs: nobh_truncate_page() fix

2007-03-06 09:30:25 -08:00

char_dev.c

[PATCH] rework reserved major handling

2007-02-20 17:10:13 -08:00

compat_ioctl.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

compat.c

[PATCH] Add epoll compat_ code to fs/compat.c

2007-03-08 07:38:22 -08:00

dcache.c

Revert "[PATCH] Fix d_path for lazy unmounts"

2007-02-13 12:08:18 -08:00

dcookies.c

[PATCH] slab: remove kmem_cache_t

2006-12-07 08:39:25 -08:00

direct-io.c

[PATCH] dio: lock refcount operations

2006-12-10 09:57:21 -08:00

dnotify.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

dquot.c

[PATCH] sysctl: remove insert_at_head from register_sysctl

2007-02-14 08:09:59 -08:00

drop_caches.c

[PATCH] remove invalidate_inode_pages()

2007-02-11 10:51:31 -08:00

eventpoll.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

exec.c

[PATCH] Transform kmem_cache_alloc()+memset(0) -> kmem_cache_zalloc().

2007-02-11 10:51:27 -08:00

fcntl.c

[PATCH] fdtable: Make fdarray and fdsets equal in size

2006-12-10 09:57:22 -08:00

fifo.c

[PATCH] pipe.c/fifo.c code cleanups

2006-04-11 13:53:33 +02:00

file_table.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

file.c

[PATCH] fdtable: Provide free_fdtable() wrapper

2006-12-22 08:55:50 -08:00

filesystems.c

[PATCH] remove many unneeded #includes of sched.h

2007-02-14 08:09:54 -08:00

fs-writeback.c

Write back inode data pages even when the inode itself is locked

2007-01-26 12:53:20 -08:00

generic_acl.c

[PATCH] Generic infrastructure for acls

2006-09-29 09:18:24 -07:00

inode.c

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

inotify_user.c

[PATCH] inotify: read return val fix

2007-02-12 09:48:28 -08:00

inotify.c

[PATCH] severing fs.h, radix-tree.h -> sched.h

2006-12-04 02:00:24 -05:00

internal.h

[PATCH] CONFIG_BLOCK internal.h cleanups

2006-09-30 20:52:32 +02:00

ioctl.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

ioprio.c

[PATCH] pid: replace do/while_each_task_pid with do/while_each_pid_task

2007-02-12 09:48:32 -08:00

Kconfig

Remove JFFS (version 1), as scheduled.

2007-02-17 16:10:59 -05:00

Kconfig.binfmt

…

libfs.c

[PATCH] shmem and simple const super_operations

2007-03-05 07:57:51 -08:00

locks.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

Makefile

Remove JFFS (version 1), as scheduled.

2007-02-17 16:10:59 -05:00

mbcache.c

[PATCH] slab: remove kmem_cache_t

2006-12-07 08:39:25 -08:00

mpage.c

[PATCH] BLOCK: Dissociate generic_writepages() from mpage stuff [try #6]

2006-09-30 20:52:26 +02:00

namei.c

[PATCH] __page_symlink retry loop error code fix

2007-02-16 08:13:56 -08:00

namespace.c

[PATCH] Transform kmem_cache_alloc()+memset(0) -> kmem_cache_zalloc().

2007-02-11 10:51:27 -08:00

nfsctl.c

Remove obsolete #include <linux/config.h>

2006-06-30 19:25:36 +02:00

no-block.c

[PATCH] BLOCK: Make it possible to disable the block layer [try #6]

2006-09-30 20:52:31 +02:00

open.c

[PATCH] fdtable: Make fdarray and fdsets equal in size

2006-12-10 09:57:22 -08:00

pipe.c

[PATCH] AUDIT_FD_PAIR

2007-02-17 21:30:15 -05:00

pnode.c

[PATCH] rename struct namespace to struct mnt_namespace

2006-12-08 08:28:51 -08:00

pnode.h

[PATCH] rename struct namespace to struct mnt_namespace

2006-12-08 08:28:51 -08:00

posix_acl.c

[PATCH] kmemdup: some users

2006-10-01 00:39:19 -07:00

quota_v1.c

…

quota_v2.c

[PATCH] sem2mutex: quota

2006-03-23 07:38:11 -08:00

quota.c

[PATCH] BLOCK: Make it possible to disable the block layer [try #6]

2006-09-30 20:52:31 +02:00

read_write.c

[PATCH] FS: speed up rw_verify_area()

2007-02-12 09:48:29 -08:00

read_write.h

[PATCH] Remove readv/writev methods and use aio_read/aio_write instead

2006-10-01 00:39:28 -07:00

readdir.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

select.c

[PATCH] fdtable: Make fdarray and fdsets equal in size

2006-12-10 09:57:22 -08:00

seq_file.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

splice.c

[PATCH] constify pipe_buf_operations

2006-12-13 09:05:47 -08:00

stack.c

[PATCH] fs/stack.c: Copy i_nlink after all other attributes are copied

2007-02-19 14:21:50 -08:00

stat.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

super.c

[PATCH] Mark struct super_operations const

2007-02-12 09:48:47 -08:00

sync.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00

utimes.c

[PATCH] severing fs.h, radix-tree.h -> sched.h

2006-12-04 02:00:24 -05:00

xattr_acl.c

[PATCH] remove many unneeded #includes of sched.h

2007-02-14 08:09:54 -08:00

xattr.c

[PATCH] VFS: change struct file to use struct path

2006-12-08 08:28:41 -08:00