rbd: fix cleanup in rbd_add()
authorAlex Elder <elder@inktank.com>
Tue, 14 May 2013 01:35:37 +0000 (20:35 -0500)
committerAlex Elder <elder@inktank.com>
Fri, 17 May 2013 17:50:10 +0000 (12:50 -0500)
commit3abef3b3585bbc67d56fdc9c67761a900fb4b69d
treed94c9555797c77e4c92f2fea22049a962af48de9
parent7262cfca430a1a0e0707149af29ae86bc0ded230
rbd: fix cleanup in rbd_add()

Bjorn Helgaas pointed out that a recent commit introduced a
use-after-free condition in an error path for rbd_add().
He correctly stated:

    I think b536f69a3a5 "rbd: set up devices only for mapped images"
    introduced a use-after-free error in rbd_add():
...
    If rbd_dev_device_setup() returns an error, we call
    rbd_dev_image_release(), which ultimately kfrees rbd_dev.
    Then we call rbd_dev_destroy(), which references fields in
    the already-freed rbd_dev struct before kfreeing it again.

The simple fix is to return the error code after the call to
rbd_dev_image_release().

Closer examination revealed that there's no need to clean up
rbd_opts in that function, so fix that too.

Update some other comments that have also become out of date.

Reported-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Josh Durgin <josh.durgin@inktank.com>
drivers/block/rbd.c