diff options
| author | Ilya Dryomov <idryomov@gmail.com> | 2016-05-16 13:18:57 +0200 |
|---|---|---|
| committer | Ilya Dryomov <idryomov@gmail.com> | 2016-05-26 00:36:20 +0200 |
| commit | 663ae2cc04773608e1e741f693e41200fd4faf14 (patch) | |
| tree | a466793ccab81b82ae6bc36440db64bb0e6c512a /Documentation/acpi | |
| parent | 2dcd0af568b0cf583645c8a317dd12e344b1c72a (diff) | |
rbd: get/put img_request in rbd_img_request_submit()
By the time we get to checking for_each_obj_request_safe(img_request)
terminating condition, all obj_requests may be complete and img_request
ref, that rbd_img_request_submit() takes away from its caller, may be
put. Moving the next_obj_request cursor is then a use-after-free on
img_request.
It's totally benign, as the value that's read is never used, but
I think it's still worth fixing.
Cc: Alex Elder <elder@linaro.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Diffstat (limited to 'Documentation/acpi')