rbd: fix double free on rbd_dev->header_name
authorIlya Dryomov <idryomov@gmail.com>
Mon, 31 Aug 2015 12:21:39 +0000 (15:21 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 27 Oct 2015 00:44:51 +0000 (09:44 +0900)
commitf22714069f1bc94b91b463bdc00cc82782f0e363
tree223311812729824a8225d05292fc81383ed1874a
parentad824a8286dd4db9c23e3e3febdd63d4c2c4ae9e
rbd: fix double free on rbd_dev->header_name

commit 3ebe138ac642a195c7f2efdb918f464734421fd6 upstream.

If rbd_dev_image_probe() in rbd_dev_probe_parent() fails, header_name
is freed twice: once in rbd_dev_probe_parent() and then in its caller
rbd_dev_image_probe() (rbd_dev_image_probe() is called recursively to
handle parent images).

rbd_dev_probe_parent() is responsible for probing the parent, so it
shouldn't muck with clone's fields.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/block/rbd.c