• Alex Elder's avatar
    rbd: fix cleanup in rbd_add() · 3abef3b3
    Alex Elder authored
    Bjorn Helgaas pointed out that a recent commit introduced a
    use-after-free condition in an error path for rbd_add().
    He correctly stated:
    
        I think b536f69a "rbd: set up devices only for mapped images"
        introduced a use-after-free error in rbd_add():
    	...
        If rbd_dev_device_setup() returns an error, we call
        rbd_dev_image_release(), which ultimately kfrees rbd_dev.
        Then we call rbd_dev_destroy(), which references fields in
        the already-freed rbd_dev struct before kfreeing it again.
    
    The simple fix is to return the error code after the call to
    rbd_dev_image_release().
    
    Closer examination revealed that there's no need to clean up
    rbd_opts in that function, so fix that too.
    
    Update some other comments that have also become out of date.
    Reported-by: default avatarBjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: default avatarAlex Elder <elder@inktank.com>
    Reviewed-by: default avatarJosh Durgin <josh.durgin@inktank.com>
    3abef3b3
rbd.c 135 KB