From: Michał Mirosław <mirq-linux@rere.qmqm.pl>

If parse_priority_group() fails after returning at least once without error,
free_multipath() in the error path attempts to dereference an uninitialised
pointer, m->ti.

The fix is to initialize m->ti early - just after alloc()ing it.

Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>

Index: linux-2.6.17/drivers/md/dm-mpath.c
===================================================================
--- linux-2.6.17.orig/drivers/md/dm-mpath.c	2006-08-10 19:06:11.000000000 +0100
+++ linux-2.6.17/drivers/md/dm-mpath.c	2006-08-10 19:07:01.000000000 +0100
@@ -710,6 +710,8 @@ static int multipath_ctr(struct dm_targe
 		return -EINVAL;
 	}
 
+	m->ti = ti;
+
 	r = parse_features(&as, m, ti);
 	if (r)
 		goto bad;
@@ -751,7 +753,6 @@ static int multipath_ctr(struct dm_targe
 	}
 
 	ti->private = m;
-	m->ti = ti;
 
 	return 0;