Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client

torvalds · torvalds · commit 849ee3d46a73 · 2015-12-04T12:46:07.000-08:00
Pull Ceph fix from Sage Weil:
 "This addresses a refcounting bug that leads to a use-after-free"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  rbd: don't put snap_context twice in rbd_queue_workfn()
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
@@ -3442,6 +3442,7 @@ static void rbd_queue_workfn(struct work_struct *work)
 		goto err_rq;
 	}
 	img_request->rq = rq;
+	snapc = NULL; /* img_request consumes a ref */
 
 	if (op_type == OBJ_OP_DISCARD)
 		result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,

Original file line number	Diff line number	Diff line change
`@@ -3442,6 +3442,7 @@ static void rbd_queue_workfn(struct work_struct *work)`
`3442`	`3442`	`goto err_rq;`
`3443`	`3443`	`}`
`3444`	`3444`	`img_request->rq = rq;`
	`3445`	`+ snapc = NULL; /* img_request consumes a ref */`
`3445`	`3446`
`3446`	`3447`	`if (op_type == OBJ_OP_DISCARD)`
`3447`	`3448`	`result = rbd_img_request_fill(img_request, OBJ_REQUEST_NODATA,`