• Lars Ellenberg's avatar
    drbd: fix possible access after free · f65363cf
    Lars Ellenberg authored
    If we release the page pointed to by md_io_tmpp, we need to zero out the
    pointer, too, as that may be used later to decide whether we need to
    allocate a new page again.
    
    Impact: a previously freed page may be used and clobbered.  Depending on
    what that particular page is being used for meanwhile, this may result
    in silent data corruption of completely unrelated things.
    
    Only of concern on devices with logical_block_size != 512 byte,
    if you re-attach after becoming diskless once.
    Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
    Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
    f65363cf
drbd_main.c 104 KB