Commit aebf5db9 authored by Ming Lei's avatar Ming Lei Committed by Jens Axboe
Browse files

block: fix use-after-free in disk_part_iter_next 



Make sure that bdgrab() is done on the 'block_device' instance before
referring to it for avoiding use-after-free.

Cc: <stable@vger.kernel.org>
Reported-by: default avatar <syzbot+825f0f9657d4e528046e@syzkaller.appspotmail.com>
Signed-off-by: default avatarMing Lei <ming.lei@redhat.com>
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 6d4d2735

block/genhd.c

+7 −4
Original line number Diff line number Diff line
@@ -246,15 +246,18 @@ struct block_device *disk_part_iter_next(struct disk_part_iter *piter) 
		part = rcu_dereference(ptbl->part[piter->idx]);

		if (!part)

			continue;

		piter->part = bdgrab(part);

		if (!piter->part)

			continue;

		if (!bdev_nr_sectors(part) &&

		    !(piter->flags & DISK_PITER_INCL_EMPTY) &&

		    !(piter->flags & DISK_PITER_INCL_EMPTY_PART0 &&

		      piter->idx == 0))

		      piter->idx == 0)) {

			bdput(piter->part);

			piter->part = NULL;

			continue;

		}



		piter->part = bdgrab(part);

		if (!piter->part)

			continue;

		piter->idx += inc;

		break;

	}