Merge "block: Fix use-after-free in blkdev_get()" (7048538e) · Commits · e / devices / android_kernel_fairphone_FP3

fs/block_dev.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -1286,11 +1286,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
		*/
		if (!for_part) {
		ret = devcgroup_inode_permission(bdev->bd_inode, perm);
		if (ret != 0) {
		bdput(bdev);
		if (ret != 0)
		return ret;
		}
		}

		restart:

		@@ -1361,8 +1359,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
		goto out_clear;
		BUG_ON(for_part);
		ret = __blkdev_get(whole, mode, 1);
		if (ret)
		if (ret) {
		bdput(whole);
		goto out_clear;
		}
		bdev->bd_contains = whole;
		bdev->bd_part = disk_get_part(disk, partno);
		if (!(disk->flags & GENHD_FL_UP) \|\|
		@@ -1416,7 +1416,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
		put_disk(disk);
		module_put(owner);
		out:
		bdput(bdev);

		return ret;
		}
		@@ -1502,6 +1501,9 @@ int blkdev_get(struct block_device bdev, fmode_t mode, void holder)
		bdput(whole);
		}

		if (res)
		bdput(bdev);

		return res;
		}
		EXPORT_SYMBOL(blkdev_get);