• L
    drbd: fix possible access after free · f65363cf
    Lars Ellenberg 提交于
    If we release the page pointed to by md_io_tmpp, we need to zero out the
    pointer, too, as that may be used later to decide whether we need to
    allocate a new page again.
    
    Impact: a previously freed page may be used and clobbered.  Depending on
    what that particular page is being used for meanwhile, this may result
    in silent data corruption of completely unrelated things.
    
    Only of concern on devices with logical_block_size != 512 byte,
    if you re-attach after becoming diskless once.
    Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
    Signed-off-by: NLars Ellenberg <lars.ellenberg@linbit.com>
    f65363cf
drbd_main.c 104.1 KB