rbd: fix double free on rbd_dev->header_name
authorIlya Dryomov <idryomov@gmail.com>
Mon, 31 Aug 2015 12:21:39 +0000 (15:21 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 27 Oct 2015 00:45:59 +0000 (09:45 +0900)
commitd11f754e68258c46d07b1e48ba1e4bf69a802637
tree896b722a0101f56ee64c08d0c73c7afb3039dc54
parent9e7042c2fffcd110d4265f6b258f22175673c28f
rbd: fix double free on rbd_dev->header_name

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/rbd.c