| commit | 04dc923c9e4c43df7d2d94f290189785d3172326 | [log] [tgz] |
|---|---|---|
| author | Ilya Dryomov <idryomov@gmail.com> | Thu Sep 15 18:05:16 2016 +0200 |
| committer | Ilya Dryomov <idryomov@gmail.com> | Mon Oct 03 16:13:49 2016 +0200 |
| tree | 1ff276268fd5d3029281e2fa0b31fe2d5d9df053 | |
| parent | 7c84883adf6dc614fc9e01304aa1813a55c43ad2 [diff] |
rbd: img_data requests don't own their page array Move the check into rbd_obj_request_destroy() to avoid use-after-free on errors in rbd_img_request_fill(..., OBJ_REQUEST_PAGES, ...), where pages, owned by the caller, gets freed in rbd_img_request_fill(). Signed-off-by: Ilya Dryomov <idryomov@gmail.com> Reviewed-by: Alex Elder <elder@linaro.org> Reviewed-by: David Disseldorp <ddiss@suse.de>