[PATCH] smbfs: Fix slab corruption in samba error path

[safe/jmp/linux-2.6] / fs / smbfs / request.c

diff --git a/fs/smbfs/request.c b/fs/smbfs/request.c
index c71c375..c71dd27 100644 (file)
--- a/fs/smbfs/request.c
+++ b/fs/smbfs/request.c
@@ -339,9 +339,11 @@ int smb_add_request(struct smb_request *req)
                /*
                 * On timeout or on interrupt we want to try and remove the
                 * request from the recvq/xmitq.
+                * First check if the request is still part of a queue. (May
+                * have been removed by some error condition)
                 */
                smb_lock_server(server);
-               if (!(req->rq_flags & SMB_REQ_RECEIVED)) {
+               if (!list_empty(&req->rq_queue)) {
                        list_del_init(&req->rq_queue);
                        smb_rput(req);
                }