[PATCH] block: NULL dereference on error path in __blkdev_get()

[PATCH] block: NULL dereference on error path in __blkdev_get()

[Tejun Heo]

From: Dan Carpenter <error27@gmail.com>

"disk" is always NULL when we goto out.  There was a check for this
before, but it was removed in 69e02c59a7d9 "block: Don't check events
while open is in progress".

Signed-off-by: Dan Carpenter <error27@gmail.com>
Acked-by: Tejun Heo <tj@kernel.org>

diff --git a/fs/block_dev.c b/fs/block_dev.c
index fbe05cb..7d02afb 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1181,9 +1181,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  out_unlock_bdev:
 	mutex_unlock(&bdev->bd_mutex);
 	disk_unblock_events(disk);
- out:
 	module_put(disk->fops->owner);
 	put_disk(disk);
+ out:
 	bdput(bdev);
 
 	return ret;

Re: [PATCH] block: NULL dereference on error path in __blkdev_get()

[Justin TerAvest]

On Fri, Mar 18, 2011 at 1:37 AM, Tejun Heo <tj@kernel.org> wrote:
> From: Dan Carpenter <error27@gmail.com>
>
> "disk" is always NULL when we goto out.  There was a check for this
> before, but it was removed in 69e02c59a7d9 "block: Don't check events
> while open is in progress".
>
> Signed-off-by: Dan Carpenter <error27@gmail.com>
> Acked-by: Tejun Heo <tj@kernel.org>

I was running into this problem too; this patch fixes the problem.

Tested-by: Justin TerAvest <teravest@google.com>

>
> diff --git a/fs/block_dev.c b/fs/block_dev.c
> index fbe05cb..7d02afb 100644
> --- a/fs/block_dev.c
> +++ b/fs/block_dev.c
> @@ -1181,9 +1181,9 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
>  out_unlock_bdev:
>        mutex_unlock(&bdev->bd_mutex);
>        disk_unblock_events(disk);
> - out:
>        module_put(disk->fops->owner);
>        put_disk(disk);
> + out:
>        bdput(bdev);
>
>        return ret;
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at  http://www.tux.org/lkml/
>

Re: [PATCH] block: NULL dereference on error path in __blkdev_get()

[Jens Axboe]

On 2011-03-18 09:37, Tejun Heo wrote:
> From: Dan Carpenter <error27@gmail.com>
> 
> "disk" is always NULL when we goto out.  There was a check for this
> before, but it was removed in 69e02c59a7d9 "block: Don't check events
> while open is in progress".

Thanks, applied.

-- 
Jens Axboe