p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

xen/blkback: fix reference counting 

If the permission check fails, we drop a reference to the blkif without
having taken it in the first place. The bug was introduced in commit
604c499cbb (xen/blkback: Check device
permissions before allowing OP_DISCARD).

Cc: stable@vger.kernel.org
Cc: Jan Beulich <JBeulich@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Vegard Nossum 2013-09-05 13:00:14 +02:00 committed by Jens Axboe
parent c47206e25f
commit ea5ec76d76
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/block/xen-blkback/blkback.c
View File

@ -887,6 +887,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
unsigned long secure; unsigned long secure;
struct phys_req preq; struct phys_req preq;
xen_blkif_get(blkif);
preq.sector_number = req->u.discard.sector_number; preq.sector_number = req->u.discard.sector_number;
preq.nr_sects = req->u.discard.nr_sectors; preq.nr_sects = req->u.discard.nr_sectors;
@ -899,7 +901,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
} }
blkif->st_ds_req++; blkif->st_ds_req++;
xen_blkif_get(blkif);
secure = (blkif->vbd.discard_secure && secure = (blkif->vbd.discard_secure &&
(req->u.discard.flag & BLKIF_DISCARD_SECURE)) ? (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
BLKDEV_DISCARD_SECURE : 0; BLKDEV_DISCARD_SECURE : 0;