Alex Elder 3abef3b358 rbd: fix cleanup in rbd_add()
Bjorn Helgaas pointed out that a recent commit introduced a
use-after-free condition in an error path for rbd_add().
He correctly stated:

    I think b536f69a3a5 "rbd: set up devices only for mapped images"
    introduced a use-after-free error in rbd_add():
	...
    If rbd_dev_device_setup() returns an error, we call
    rbd_dev_image_release(), which ultimately kfrees rbd_dev.
    Then we call rbd_dev_destroy(), which references fields in
    the already-freed rbd_dev struct before kfreeing it again.

The simple fix is to return the error code after the call to
rbd_dev_image_release().

Closer examination revealed that there's no need to clean up
rbd_opts in that function, so fix that too.

Update some other comments that have also become out of date.

Reported-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Alex Elder <elder@inktank.com>
Reviewed-by: Josh Durgin <josh.durgin@inktank.com>
2013-05-17 12:50:10 -05:00
..
2013-03-28 14:29:47 -04:00
2013-02-27 19:10:15 -08:00
2013-03-26 14:48:12 -06:00
2012-01-03 22:54:07 -05:00
2011-08-08 11:40:15 +02:00
2012-03-28 18:30:03 +01:00
2013-04-09 12:05:41 -07:00
2013-02-27 19:10:22 -08:00
2012-09-09 10:35:39 +02:00
2013-05-17 12:50:10 -05:00
2009-03-26 21:15:27 +01:00
2013-02-09 14:23:33 +01:00