ceph-client

Pull Ceph fix from Sage Weil:
 "This addresses a refcounting bug that leads to a use-after-free"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  rbd: don't put snap_context twice in rbd_queue_workfn()

parents fb39cbda 70b16db8

drivers/block/rbd.c

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -3442,6 +3442,7 @@ static void rbd_queue_workfn(struct work_struct *work)
	goto err_rq;		goto err_rq;
	}		}
	img_request->rq = rq;		img_request->rq = rq;
			snapc = NULL; /* img_request consumes a ref */

	if (op_type == OBJ_OP_DISCARD)		if (op_type == OBJ_OP_DISCARD)
	result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,		result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,