drbd: fix possible access after free
authorLars Ellenberg <lars.ellenberg@linbit.com>
Tue, 14 Sep 2010 18:14:09 +0000 (20:14 +0200)
committerPhilipp Reisner <philipp.reisner@linbit.com>
Thu, 14 Oct 2010 16:38:41 +0000 (18:38 +0200)
commitf65363cfa05fe60874030461a0eeb84b7e60cba4
tree02bec26e82989cf7fff97e3f4ff0108b74032832
parent8979d9c9e0bc8e54cf5bd7a89abb2145f087b5e1
drbd: fix possible access after free

If we release the page pointed to by md_io_tmpp, we need to zero out the
pointer, too, as that may be used later to decide whether we need to
allocate a new page again.

Impact: a previously freed page may be used and clobbered.  Depending on
what that particular page is being used for meanwhile, this may result
in silent data corruption of completely unrelated things.

Only of concern on devices with logical_block_size != 512 byte,
if you re-attach after becoming diskless once.

Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
drivers/block/drbd/drbd_main.c