diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2016-09-15 18:05:16 +0200 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2016-10-03 16:13:49 +0200 |
| commit | 04dc923c9e4c43df7d2d94f290189785d3172326 (patch) | |
| tree | 1ff276268fd5d3029281e2fa0b31fe2d5d9df053 /include/xen/page.h | |
| parent | 7c84883adf6dc614fc9e01304aa1813a55c43ad2 (diff) | |
| download | linux-stable-04dc923c9e4c43df7d2d94f290189785d3172326.tar.gz linux-stable-04dc923c9e4c43df7d2d94f290189785d3172326.tar.bz2 linux-stable-04dc923c9e4c43df7d2d94f290189785d3172326.zip | |
rbd: img_data requests don't own their page array
Move the check into rbd_obj_request_destroy() to avoid use-after-free
on errors in rbd_img_request_fill(..., OBJ_REQUEST_PAGES, ...), where
pages, owned by the caller, gets freed in rbd_img_request_fill().
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Reviewed-by: David Disseldorp <ddiss@suse.de>
Diffstat (limited to 'include/xen/page.h')
0 files changed, 0 insertions, 0 deletions