facebook/flashcache — pull request #107 by Zedzap (2013-02-10 00:23:47+00:00)
Title: Fix use-after-free in flashcache_destroy

The sb variable points to buf. Then buf gets freed and reallocated, so the sb pointer points to freed memory. The variable is then reused to invalidate the cache_sb_state, which is writing to memory that has been freed. In addition, that change never gets saved because the buf that is written to disk does not point to the same memory as sb.

Fixed this by using a separate buffer for the superblock that doesn't get freed.