Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1254873

[PATCH 4.2 50/54] rbd: fix double free on rbd_dev->header_name

Show all headers | View raw

4.2-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Ilya Dryomov <idryomov@gmail.com>

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/block/rbd.c |    1 -
 1 file changed, 1 deletion(-)

--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -5201,7 +5201,6 @@ static int rbd_dev_probe_parent(struct r
 out_err:
 	if (parent) {
 		rbd_dev_unparent(rbd_dev);
-		kfree(rbd_dev->header_name);
 		rbd_dev_destroy(parent);
 	} else {
 		rbd_put_client(rbdc);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.2 00/54] 4.2.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:30 +0200
  [PATCH 4.2 54/54] svcrdma: handle rdma read with a non-zero initial page offset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:30 +0200
  [PATCH 4.2 29/54] ARM: ux500: simplify secondary CPU boot Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:30 +0200
  [PATCH 4.2 25/54] memcg: convert threshold to bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:30 +0200
    Re: [PATCH 4.2 25/54] memcg: convert threshold to bytes Ben Hutchings <ben@decadent.org.uk> - 2015-10-24 07:50 +0200
      Re: [PATCH 4.2 25/54] memcg: convert threshold to bytes Michal Hocko <mhocko@kernel.org> - 2015-10-25 17:40 +0100
        Re: [PATCH 4.2 25/54] memcg: convert threshold to bytes Michal Hocko <mhocko@kernel.org> - 2015-10-27 11:40 +0100
  [PATCH 4.2 50/54] rbd: fix double free on rbd_dev->header_name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:30 +0200
  [PATCH 4.2 28/54] arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:30 +0200
  [PATCH 4.2 51/54] timekeeping: Increment clock_was_set_seq in timekeeping_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:40 +0200
  [PATCH 4.2 49/54] dm thin: fix missing pool reference count decrement in pool_ctr error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-23 20:40 +0200
  Re: [PATCH 4.2 00/54] 4.2.5-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-10-24 00:00 +0200
    Re: [PATCH 4.2 00/54] 4.2.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-24 01:30 +0200
  Re: [PATCH 4.2 00/54] 4.2.5-stable review Guenter Roeck <linux@roeck-us.net> - 2015-10-24 04:10 +0200
    Re: [PATCH 4.2 00/54] 4.2.5-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-10-24 15:30 +0200

csiph-web