Vasily Averin 1174cf7301 [PATCH] smbfs: double free memory corruption ... smbfs allocates rq_trans2buffer to handle server's multi transaction2 response messages. As struct smb_request may be reused, rq_trans2buffer is freed before each new request. However if last servers's response is not multi but single trans2 message then new rq_trans2buffer is not allocated but last smb_rput still tries to free it again. To prevent this issue rq_trans2buffer pointer should be set to NULL after kfree. Signed-off-by: Vasily Averin <vvs@sw.ru> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2007-03-16 19:25:05 -07:00
..
cache.c	[PATCH] struct path: convert smbfs	2006-12-08 08:28:49 -08:00
dir.c	[PATCH] mark struct inode_operations const 3	2007-02-12 09:48:46 -08:00
file.c	[PATCH] mark struct inode_operations const 3	2007-02-12 09:48:46 -08:00
getopt.c
getopt.h
inode.c	[PATCH] Mark struct super_operations const	2007-02-12 09:48:47 -08:00
ioctl.c
Makefile
proc.c	[PATCH] smbfs: Make conn_pid a struct pid	2006-12-13 09:05:53 -08:00
proto.h	[PATCH] mark struct inode_operations const 3	2007-02-12 09:48:46 -08:00
request.c	[PATCH] smbfs: double free memory corruption	2007-03-16 19:25:05 -07:00
request.h
smb_debug.h
smbiod.c	[PATCH] smbfs: Make conn_pid a struct pid	2006-12-13 09:05:53 -08:00
sock.c	[PATCH] struct path: convert smbfs	2006-12-08 08:28:49 -08:00
symlink.c	[PATCH] remove many unneeded #includes of sched.h	2007-02-14 08:09:54 -08:00