| From | Greg Kroah-Hartman <> | Subject | [PATCH 3.14 100/228] fs/affs/super.c: bugfix / double free | Date | Wed, 4 Jun 2014 16:22:09 -0700 |
| |
3.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabian Frederick <fabf@skynet.be>
commit d353efd02357a74753cd45f367a2d3d357fd6904 upstream.
Commit 842a859db26b ("affs: use ->kill_sb() to simplify ->put_super() and failure exits of ->mount()") adds .kill_sb which frees sbi but doesn't remove sbi free in case of parse_options error causing double free+random crash.
Signed-off-by: Fabian Frederick <fabf@skynet.be> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- fs/affs/super.c | 2 -- 1 file changed, 2 deletions(-)
--- a/fs/affs/super.c +++ b/fs/affs/super.c @@ -336,8 +336,6 @@ static int affs_fill_super(struct super_ &blocksize,&sbi->s_prefix, sbi->s_volume, &mount_flags)) { printk(KERN_ERR "AFFS: Error parsing options\n"); - kfree(sbi->s_prefix); - kfree(sbi); return -EINVAL; } /* N.B. after this point s_prefix must be released */
|