diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2021-04-12 04:27:50 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2021-04-12 04:27:49 -0700 |
| commit | 95b4d2a89bf252bfe2bb5d2f7ba6c9ba1ff44ada (patch) | |
| tree | e265437ae93432b3317657e2aa84be80de5357e4 | |
| parent | 8afce7745c26116e878f2fc25e54897c8c0ddbe6 (diff) | |
| parent | 2a4c896e489fe9b445843cba19b36e3dd2cd0006 (diff) | |
Merge "block: Fix use-after-free in blkdev_get()"
| -rw-r--r-- | fs/block_dev.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/fs/block_dev.c b/fs/block_dev.c index 43b80ca84d9c..71f332c3e68a 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1203,10 +1203,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) */ if (!for_part) { ret = devcgroup_inode_permission(bdev->bd_inode, perm); - if (ret != 0) { - bdput(bdev); + if (ret != 0) return ret; - } } restart: @@ -1276,8 +1274,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) goto out_clear; BUG_ON(for_part); ret = __blkdev_get(whole, mode, 1); - if (ret) + if (ret) { + bdput(whole); goto out_clear; + } bdev->bd_contains = whole; bdev->bd_part = disk_get_part(disk, partno); if (!(disk->flags & GENHD_FL_UP) || @@ -1337,7 +1337,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part) put_disk(disk); module_put(owner); out: - bdput(bdev); return ret; } @@ -1423,6 +1422,9 @@ int blkdev_get(struct block_device *bdev, fmode_t mode, void *holder) bdput(whole); } + if (res) + bdput(bdev); + return res; } EXPORT_SYMBOL(blkdev_get); |