summaryrefslogtreecommitdiff
path: root/block
diff options
context:
space:
mode:
authorMing Lei <ming.lei@redhat.com>2020-12-21 07:33:35 +0300
committerJens Axboe <axboe@kernel.dk>2021-01-05 21:35:17 +0300
commitaebf5db917055b38f4945ed6d621d9f07a44ff30 (patch)
treecbe567d6e39da630210e8b9284cfaed3db72aa91 /block
parent6d4d273588378c65915acaf7b2ee74e9dd9c130a (diff)
downloadlinux-aebf5db917055b38f4945ed6d621d9f07a44ff30.tar.xz
block: fix use-after-free in disk_part_iter_next
Make sure that bdgrab() is done on the 'block_device' instance before referring to it for avoiding use-after-free. Cc: <stable@vger.kernel.org> Reported-by: syzbot+825f0f9657d4e528046e@syzkaller.appspotmail.com Signed-off-by: Ming Lei <ming.lei@redhat.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'block')
-rw-r--r--block/genhd.c11
1 files changed, 7 insertions, 4 deletions
diff --git a/block/genhd.c b/block/genhd.c
index 73faec438e49..419548e92d82 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -246,15 +246,18 @@ struct block_device *disk_part_iter_next(struct disk_part_iter *piter)
part = rcu_dereference(ptbl->part[piter->idx]);
if (!part)
continue;
+ piter->part = bdgrab(part);
+ if (!piter->part)
+ continue;
if (!bdev_nr_sectors(part) &&
!(piter->flags & DISK_PITER_INCL_EMPTY) &&
!(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&
- piter->idx == 0))
+ piter->idx == 0)) {
+ bdput(piter->part);
+ piter->part = NULL;
continue;
+ }
- piter->part = bdgrab(part);
- if (!piter->part)
- continue;
piter->idx += inc;
break;
}