Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 55793c0d authored by David Sterba's avatar David Sterba Committed by Josef Bacik
Browse files

btrfs: read entire device info under lock 



There's a theoretical possibility of reading stale (or even more
theoretically, freed) data from DEV_INFO ioctl when the device would
disappear between an early mutex unlock and data being copied from the
device structure.

Signed-off-by: default avatarDavid Sterba <dsterba@suse.cz>
Signed-off-by: default avatarJosef Bacik <jbacik@fusionio.com>
parent f7a52a40

fs/btrfs/ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -2432,7 +2432,6 @@ static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg) 


	mutex_lock(&fs_devices->device_list_mutex);

	dev = btrfs_find_device(root->fs_info, di_args->devid, s_uuid, NULL);

	mutex_unlock(&fs_devices->device_list_mutex);



	if (!dev) {

		ret = -ENODEV;
@@ -2456,6 +2455,7 @@ static long btrfs_ioctl_dev_info(struct btrfs_root *root, void __user *arg) 
	}



out:

	mutex_unlock(&fs_devices->device_list_mutex);

	if (ret == 0 && copy_to_user(arg, di_args, sizeof(*di_args)))

		ret = -EFAULT;