Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea5ec76d authored by Vegard Nossum's avatar Vegard Nossum Committed by Jens Axboe
Browse files

xen/blkback: fix reference counting 



If the permission check fails, we drop a reference to the blkif without
having taken it in the first place. The bug was introduced in commit
604c499c (xen/blkback: Check device
permissions before allowing OP_DISCARD).

Cc: stable@vger.kernel.org
Cc: Jan Beulich <JBeulich@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: default avatarVegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent c47206e2

drivers/block/xen-blkback/blkback.c

+2 −1
Original line number Diff line number Diff line
@@ -887,6 +887,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif, 
	unsigned long secure;

	struct phys_req preq;



	xen_blkif_get(blkif);



	preq.sector_number = req->u.discard.sector_number;

	preq.nr_sects      = req->u.discard.nr_sectors;
@@ -899,7 +901,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif, 
	}

	blkif->st_ds_req++;



	xen_blkif_get(blkif);

	secure = (blkif->vbd.discard_secure &&

		 (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?

		 BLKDEV_DISCARD_SECURE : 0;