use after free in blkdev
In bd_sched(), a bd_xfer_impl_t is passed to list_remove() a few lines after it was passed to bd_xfer_free().
Updated by Electric Monk about 7 years ago
- Status changed from New to Closed
- % Done changed from 0 to 100
commit dd3928f816b8d87f7ecc81d6ec1eec1257ed0cda Author: Hans Rosenfeld <firstname.lastname@example.org> Date: 2014-09-18T20:38:53.000Z 5182 use after free in blkdev Reviewed by: Marcel Telka <email@example.com> Reviewed by: Igor Kozhukhov <firstname.lastname@example.org> Reviewed by: Josef 'Jeff' Sipek <email@example.com> Reviewed by: Garrett D'Amore <firstname.lastname@example.org> Approved by: Dan McDonald <email@example.com>