rbd: fix double free on rbd_dev->header_name
authorIlya Dryomov <idryomov@gmail.com>
Mon, 31 Aug 2015 12:21:39 +0000 (15:21 +0300)
committerSasha Levin <sasha.levin@oracle.com>
Fri, 13 Nov 2015 18:19:56 +0000 (13:19 -0500)
commit0f9d268d33632ff869d2ebaab2631fd23de7212e
tree42d8514368dc1806b641b271b3f2a7c43d1f356c
parent587075664c04347cf92844d11a0463951ff4514d
rbd: fix double free on rbd_dev->header_name

[ Upstream commit 3ebe138ac642a195c7f2efdb918f464734421fd6 ]

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
drivers/block/rbd.c