a7y18lte-ubports/android_kernel_samsung_universal7885
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

devpts: fix double-free on mount failure

Browse Source 
devpts_kill_sb() is called even if devpts_fill_super() fails;
we should not do that kfree() in the latter, especially not
with ->s_fs_info left pointing to freed object.  Double kfree()
is a Bad Thing(tm)...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2012-01-08 19:40:27 -05:00
parent 87da5b3264
commit 3850aba748
1 changed files with 1 additions and 3 deletions

4
fs/devpts/inode.c
View File

@ -301,7 +301,7 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
inode = new_inode(s); inode = new_inode(s);
if (!inode) if (!inode)
goto free_fsi; goto fail;
inode->i_ino = 1; inode->i_ino = 1;
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR; inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
@ -316,8 +316,6 @@ devpts_fill_super(struct super_block *s, void *data, int silent)
printk(KERN_ERR "devpts: get root dentry failed\n"); printk(KERN_ERR "devpts: get root dentry failed\n");
iput(inode); iput(inode);
free_fsi:
kfree(s->s_fs_info);
fail: fail:
return -ENOMEM; return -ENOMEM;
} }