Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3d13ebbd authored by Ming Lei's avatar Ming Lei Committed by Greg Kroah-Hartman
Browse files

block: fix use-after-free in disk_part_iter_next 



commit aebf5db917055b38f4945ed6d621d9f07a44ff30 upstream.

Make sure that bdgrab() is done on the 'block_device' instance before
referring to it for avoiding use-after-free.

Cc: <stable@vger.kernel.org>
Reported-by: default avatar <syzbot+825f0f9657d4e528046e@syzkaller.appspotmail.com>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7121c0f8

block/genhd.c

+6 −3
Original line number Diff line number Diff line
@@ -208,14 +208,17 @@ struct hd_struct *disk_part_iter_next(struct disk_part_iter *piter) 
		part = rcu_dereference(ptbl->part[piter->idx]);

		if (!part)

			continue;

		get_device(part_to_dev(part));

		piter->part = part;

		if (!part_nr_sects_read(part) &&

		    !(piter->flags & DISK_PITER_INCL_EMPTY) &&

		    !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&

		      piter->idx == 0))

		      piter->idx == 0)) {

			put_device(part_to_dev(part));

			piter->part = NULL;

			continue;

		}



		get_device(part_to_dev(part));

		piter->part = part;

		piter->idx += inc;

		break;

	}