diff options
| author | Shirish Pargaonkar <shirishpargaonkar@gmail.com> | 2011-02-03 14:31:18 -0600 |
|---|---|---|
| committer | Steve French <sfrench@us.ibm.com> | 2011-02-04 20:18:06 +0000 |
| commit | 64474bdd07f673cc48509ea0375274422c8f73bf (patch) | |
| tree | 406db93b0bae474281a13d83f8e621bafcca6af4 | |
| parent | 76429c148b939f5a6863c0a024eb8960ae91469a (diff) | |
cifs: Possible slab memory corruption while updating extended stats (repost)
Updating extended statistics here can cause slab memory corruption
if a callback function frees slab memory (mid_entry).
Signed-off-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
| -rw-r--r-- | fs/cifs/connect.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 945b2202275..1f32a2893b5 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -633,11 +633,11 @@ incomplete_rcv: mid_entry->largeBuf = isLargeBuf; multi_t2_fnd: mid_entry->midState = MID_RESPONSE_RECEIVED; - list_del_init(&mid_entry->qhead); - mid_entry->callback(mid_entry); #ifdef CONFIG_CIFS_STATS2 mid_entry->when_received = jiffies; #endif + list_del_init(&mid_entry->qhead); + mid_entry->callback(mid_entry); break; } mid_entry = NULL; |