]> www.infradead.org Git - users/jedix/linux-maple.git/commit
rbd: fix double free on rbd_dev->header_name
authorIlya Dryomov <idryomov@gmail.com>
Mon, 31 Aug 2015 12:21:39 +0000 (15:21 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 27 Oct 2015 00:51:58 +0000 (09:51 +0900)
commitdd703751ffe7818e43c85f4fea509c2868dce937
tree87dd31996610bc674c67db3e44805ab15e1bb8a0
parent015ec5d44756f18dc887fb9b55288cccb1a659ef
rbd: fix double free on rbd_dev->header_name

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/rbd.c