Unionfs: don't dereference null pointers if dir="" was given

Signed-off-by: Erez Zadok <ezk@cs.sunysb.edu>

diff --git a/fs/unionfs/main.c b/fs/unionfs/main.c
index 903dcd7d774ab4aeda3c239bd8229700862f5014..352861a9efa937cf6d81b6eb2fd038bf739a61f1 100644 (file)
--- a/fs/unionfs/main.c
+++ b/fs/unionfs/main.c
@@ -291,7 +291,7 @@ static int parse_dirs_option(struct super_block *sb, struct unionfs_dentry_info
        if (options[0] == '\0') {
                printk(KERN_ERR "unionfs: no branches specified\n");
                err = -EINVAL;
-               goto out;
+               goto out_return;
        }
 
        /*
@@ -307,14 +307,17 @@ static int parse_dirs_option(struct super_block *sb, struct unionfs_dentry_info
                kcalloc(branches, sizeof(struct unionfs_data), GFP_KERNEL);
        if (unlikely(!UNIONFS_SB(sb)->data)) {
                err = -ENOMEM;
-               goto out;
+               goto out_return;
        }
 
        lower_root_info->lower_paths =
                kcalloc(branches, sizeof(struct path), GFP_KERNEL);
        if (unlikely(!lower_root_info->lower_paths)) {
                err = -ENOMEM;
-               goto out;
+               /* free the underlying pointer array */
+               kfree(UNIONFS_SB(sb)->data);
+               UNIONFS_SB(sb)->data = NULL;
+               goto out_return;
        }
 
        /* now parsing a string such as "b1:b2=rw:b3=ro:b4" */
@@ -435,6 +438,7 @@ out:
                lower_root_info->lower_paths = NULL;
                UNIONFS_SB(sb)->data = NULL;
        }
+out_return:
        return err;
 }