Merge "block: Fix use-after-free in blkdev_get()" (95b4d2a8) · Commits · e / devices / android_kernel_sony_msm8998

fs/block_dev.c

+7 −5

Original line number	Diff line number	Diff line
		@@ -1203,11 +1203,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
		*/
		if (!for_part) {
		ret = devcgroup_inode_permission(bdev->bd_inode, perm);
		if (ret != 0) {
		bdput(bdev);
		if (ret != 0)
		return ret;
		}
		}

		restart:

		@@ -1276,8 +1274,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
		goto out_clear;
		BUG_ON(for_part);
		ret = __blkdev_get(whole, mode, 1);
		if (ret)
		if (ret) {
		bdput(whole);
		goto out_clear;
		}
		bdev->bd_contains = whole;
		bdev->bd_part = disk_get_part(disk, partno);
		if (!(disk->flags & GENHD_FL_UP) \|\|
		@@ -1337,7 +1337,6 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
		put_disk(disk);
		module_put(owner);
		out:
		bdput(bdev);

		return ret;
		}
		@@ -1423,6 +1422,9 @@ int blkdev_get(struct block_device bdev, fmode_t mode, void holder)
		bdput(whole);
		}

		if (res)
		bdput(bdev);

		return res;
		}
		EXPORT_SYMBOL(blkdev_get);