diff options
| author | Steve French <sfrench@us.ibm.com> | 2007-09-16 23:12:47 +0000 |
|---|---|---|
| committer | Steve French <sfrench@us.ibm.com> | 2007-09-16 23:12:47 +0000 |
| commit | 5a07cdf86c1485b570789fb660c8ada7c2635b23 (patch) | |
| tree | dff7e4481c0866b7feae969d14c03ee61eddc494 /fs | |
| parent | a23d30698190f05491a6096f027311f94d4d26d5 (diff) | |
| download | op-kernel-dev-5a07cdf86c1485b570789fb660c8ada7c2635b23.zip op-kernel-dev-5a07cdf86c1485b570789fb660c8ada7c2635b23.tar.gz | |
[CIFS] fix small memory leak in an error path in new posix mkdir
There is a small memory leak in fs/cifs/inode.c::cifs_mkdir().
Storage for 'pInfo' is allocated with kzalloc(), but if the call
to CIFSPOSIXCreate(...) happens to return 0 and pInfo->Type == -1,
then we'll jump to the 'mkdir_get_info' label without freeing the
storage allocated for 'pInfo'.
This patch adds a kfree() call to free the storage just before
jumping to the label, thus getting rid of the leak.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/cifs/inode.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c index e800c0e..9dffa93 100644 --- a/fs/cifs/inode.c +++ b/fs/cifs/inode.c @@ -930,8 +930,10 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode) d_drop(direntry); } else { int obj_type; - if (pInfo->Type == -1) /* no return info - go query */ + if (pInfo->Type == -1) /* no return info - go query */ { + kfree(pInfo); goto mkdir_get_info; + } /*BB check (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID ) to see if need to set uid/gid */ inc_nlink(inode); @@ -941,8 +943,10 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, int mode) direntry->d_op = &cifs_dentry_ops; newinode = new_inode(inode->i_sb); - if (newinode == NULL) + if (newinode == NULL) { + kfree(pInfo); goto mkdir_get_info; + } /* Is an i_ino of zero legal? */ /* Are there sanity checks we can use to ensure that the server is really filling in that field? */ |
