From 6dd93e9e5eb19e81a74b3df8426a945a08ad8a1f Mon Sep 17 00:00:00 2001
From: Eric Sandeen <sandeen@redhat.com>
Date: Wed, 31 Jul 2013 20:18:54 -0500
Subject: xfs: avoid double-free in xfs_attr_node_addname
Git-commit: 6dd93e9e5eb19e81a74b3df8426a945a08ad8a1f
Patch-mainline: v3.12-rc1

xfs_attr_node_addname()'s error handling tests whether it
should free "state" in the out: error handling label:

out:
        if (state)
                xfs_da_state_free(state);

but an earlier free doesn't set state to NULL afterwards; this
could lead to a double free.  Fix it by setting state to NULL
after it's freed.

This was found by Coverity.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mark Tinguely <tinguely@sgi.com>
Signed-off-by: Ben Myers <bpm@sgi.com>
Acked-by: Jeff Mahoney <jeffm@suse.com>
---
 fs/xfs/xfs_attr.c |    1 +
 1 file changed, 1 insertion(+)

--- a/fs/xfs/xfs_attr.c	2013-09-27 10:10:18.464060867 -0400
+++ b/fs/xfs/xfs_attr.c	2013-09-27 10:10:46.735642254 -0400
@@ -1271,6 +1271,7 @@ restart:
 			 * have been a b-tree.
 			 */
 			xfs_da_state_free(state);
+			state = NULL;
 			xfs_bmap_init(args->flist, args->firstblock);
 			error = xfs_attr_leaf_to_node(args);
 			if (!error) {
