* [patch] fs: fix use after free in get_tree_bdev
@ 2020-02-10 18:10 Jeff Moyer
2020-02-11 9:52 ` Ian Kent
0 siblings, 1 reply; 2+ messages in thread
From: Jeff Moyer @ 2020-02-10 18:10 UTC (permalink / raw)
To: viro, linux-fsdevel; +Cc: raven
Commit 6fcf0c72e4b9 ("vfs: add missing blkdev_put() in get_tree_bdev()")
introduced a use-after-free of the bdev. This was caught by fstests
generic/085, which now results in a kernel panic. Fix it.
Cc: stable@vger.kernel.org # v5.4+
Fixes: 6fcf0c72e4b9 ("vfs: add missing blkdev_put() in get_tree_bdev()")
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
diff --git a/fs/super.c b/fs/super.c
index cd352530eca9..a288cd60d2ae 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1302,8 +1302,8 @@ int get_tree_bdev(struct fs_context *fc,
mutex_lock(&bdev->bd_fsfreeze_mutex);
if (bdev->bd_fsfreeze_count > 0) {
mutex_unlock(&bdev->bd_fsfreeze_mutex);
- blkdev_put(bdev, mode);
warnf(fc, "%pg: Can't mount, blockdev is frozen", bdev);
+ blkdev_put(bdev, mode);
return -EBUSY;
}
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [patch] fs: fix use after free in get_tree_bdev
2020-02-10 18:10 [patch] fs: fix use after free in get_tree_bdev Jeff Moyer
@ 2020-02-11 9:52 ` Ian Kent
0 siblings, 0 replies; 2+ messages in thread
From: Ian Kent @ 2020-02-11 9:52 UTC (permalink / raw)
To: Jeff Moyer, viro, linux-fsdevel
On Mon, 2020-02-10 at 13:10 -0500, Jeff Moyer wrote:
> Commit 6fcf0c72e4b9 ("vfs: add missing blkdev_put() in
> get_tree_bdev()")
> introduced a use-after-free of the bdev. This was caught by fstests
> generic/085, which now results in a kernel panic. Fix it.
Oops!
Thanks Jeff.
Acked-by: Ian Kent <raven@themaw.net>
>
> Cc: stable@vger.kernel.org # v5.4+
> Fixes: 6fcf0c72e4b9 ("vfs: add missing blkdev_put() in
> get_tree_bdev()")
> Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
>
> diff --git a/fs/super.c b/fs/super.c
> index cd352530eca9..a288cd60d2ae 100644
> --- a/fs/super.c
> +++ b/fs/super.c
> @@ -1302,8 +1302,8 @@ int get_tree_bdev(struct fs_context *fc,
> mutex_lock(&bdev->bd_fsfreeze_mutex);
> if (bdev->bd_fsfreeze_count > 0) {
> mutex_unlock(&bdev->bd_fsfreeze_mutex);
> - blkdev_put(bdev, mode);
> warnf(fc, "%pg: Can't mount, blockdev is frozen",
> bdev);
> + blkdev_put(bdev, mode);
> return -EBUSY;
> }
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-02-11 9:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-02-10 18:10 [patch] fs: fix use after free in get_tree_bdev Jeff Moyer
2020-02-11 9:52 ` Ian Kent
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).