summaryrefslogtreecommitdiffstats
path: root/drivers/block/drbd
diff options
context:
space:
mode:
authorLars Ellenberg <lars.ellenberg@linbit.com>2010-09-14 20:14:09 +0200
committerPhilipp Reisner <philipp.reisner@linbit.com>2010-10-14 18:38:41 +0200
commitf65363cfa05fe60874030461a0eeb84b7e60cba4 (patch)
tree02bec26e82989cf7fff97e3f4ff0108b74032832 /drivers/block/drbd
parent8979d9c9e0bc8e54cf5bd7a89abb2145f087b5e1 (diff)
downloadop-kernel-dev-f65363cfa05fe60874030461a0eeb84b7e60cba4.zip
op-kernel-dev-f65363cfa05fe60874030461a0eeb84b7e60cba4.tar.gz
drbd: fix possible access after free
If we release the page pointed to by md_io_tmpp, we need to zero out the pointer, too, as that may be used later to decide whether we need to allocate a new page again. Impact: a previously freed page may be used and clobbered. Depending on what that particular page is being used for meanwhile, this may result in silent data corruption of completely unrelated things. Only of concern on devices with logical_block_size != 512 byte, if you re-attach after becoming diskless once. Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com> Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Diffstat (limited to 'drivers/block/drbd')
-rw-r--r--drivers/block/drbd/drbd_main.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 4f33714..e1f2c2e 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1407,8 +1407,10 @@ static void after_state_ch(struct drbd_conf *mdev, union drbd_state os,
drbd_free_bc(mdev->ldev);
mdev->ldev = NULL;);
- if (mdev->md_io_tmpp)
+ if (mdev->md_io_tmpp) {
__free_page(mdev->md_io_tmpp);
+ mdev->md_io_tmpp = NULL;
+ }
}
/* Disks got bigger while they were detached */
OpenPOWER on IntegriCloud