summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAdrian Bunk <bunk@stusta.de>2006-03-15 17:37:32 +0100
committerLinus Torvalds <torvalds@g5.osdl.org>2006-03-15 09:37:34 -0800
commitf13b83580acef03a36c785dccc534ccdd7e43084 (patch)
tree1252d76d1e36602024c6dcf0c9afc5688e7bde85
parent74c002410548c7cb1744b45d17a5fa21da515b63 (diff)
downloadlinux-f13b83580acef03a36c785dccc534ccdd7e43084.tar.bz2
[PATCH] fs/namespace.c:dup_namespace(): fix a use after free
The Coverity checker spotted the following bug in dup_namespace(): <-- snip --> if (!new_ns->root) { up_write(&namespace_sem); kfree(new_ns); goto out; } ... out: return new_ns; <-- snip --> Callers expect a non-NULL result to not be freed. Signed-off-by: Adrian Bunk <bunk@stusta.de> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--fs/namespace.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/fs/namespace.c b/fs/namespace.c
index 058a44865beb..39c81a8d6316 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1338,7 +1338,7 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
new_ns = kmalloc(sizeof(struct namespace), GFP_KERNEL);
if (!new_ns)
- goto out;
+ return NULL;
atomic_set(&new_ns->count, 1);
INIT_LIST_HEAD(&new_ns->list);
@@ -1352,7 +1352,7 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
if (!new_ns->root) {
up_write(&namespace_sem);
kfree(new_ns);
- goto out;
+ return NULL;
}
spin_lock(&vfsmount_lock);
list_add_tail(&new_ns->list, &new_ns->root->mnt_list);
@@ -1393,7 +1393,6 @@ struct namespace *dup_namespace(struct task_struct *tsk, struct fs_struct *fs)
if (altrootmnt)
mntput(altrootmnt);
-out:
return new_ns;
}