Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 663ae2cc authored by Ilya Dryomov's avatar Ilya Dryomov
Browse files

rbd: get/put img_request in rbd_img_request_submit() 



By the time we get to checking for_each_obj_request_safe(img_request)
terminating condition, all obj_requests may be complete and img_request
ref, that rbd_img_request_submit() takes away from its caller, may be
put.  Moving the next_obj_request cursor is then a use-after-free on
img_request.

It's totally benign, as the value that's read is never used, but
I think it's still worth fixing.

Cc: Alex Elder <elder@linaro.org>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 2dcd0af5

drivers/block/rbd.c

+7 −4
Original line number Diff line number Diff line
@@ -2973,17 +2973,20 @@ static int rbd_img_request_submit(struct rbd_img_request *img_request) 
{

	struct rbd_obj_request *obj_request;

	struct rbd_obj_request *next_obj_request;

	int ret = 0;



	dout("%s: img %p\n", __func__, img_request);

	for_each_obj_request_safe(img_request, obj_request, next_obj_request) {

		int ret;



	rbd_img_request_get(img_request);

	for_each_obj_request_safe(img_request, obj_request, next_obj_request) {

		ret = rbd_img_obj_request_submit(obj_request);

		if (ret)

			return ret;

			goto out_put_ireq;

	}



	return 0;

out_put_ireq:

	rbd_img_request_put(img_request);

	return ret;

}



static void rbd_img_parent_read_callback(struct rbd_img_request *img_request)