diff options
| author | Li Chen <me@linux.beauty> | 2025-09-30 08:35:59 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-19 16:37:28 +0200 |
| commit | da716ce37862c6323df0074115847a9375035919 (patch) | |
| tree | 095f5e01d9c735ed02d08ecb8dd87acb9f6da1c1 /drivers/block | |
| parent | 00d9c4a822c44fc64261e2f38e7bb40981fecb08 (diff) | |
| download | linux-da716ce37862c6323df0074115847a9375035919.tar.gz linux-da716ce37862c6323df0074115847a9375035919.tar.bz2 linux-da716ce37862c6323df0074115847a9375035919.zip | |
loop: fix backing file reference leak on validation error
commit 98b7bf54338b797e3a11e8178ce0e806060d8fa3 upstream.
loop_change_fd() and loop_configure() call loop_check_backing_file()
to validate the new backing file. If validation fails, the reference
acquired by fget() was not dropped, leaking a file reference.
Fix this by calling fput(file) before returning the error.
Cc: stable@vger.kernel.org
Cc: Markus Elfring <Markus.Elfring@web.de>
CC: Yang Erkun <yangerkun@huawei.com>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Yu Kuai <yukuai1@huaweicloud.com>
Fixes: f5c84eff634b ("loop: Add sanity check for read/write_iter")
Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Yang Erkun <yangerkun@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/loop.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 053a086d547e..94ec7f747f36 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -551,8 +551,10 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, return -EBADF; error = loop_check_backing_file(file); - if (error) + if (error) { + fput(file); return error; + } /* suppress uevents while reconfiguring the device */ dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1); @@ -993,8 +995,10 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode, return -EBADF; error = loop_check_backing_file(file); - if (error) + if (error) { + fput(file); return error; + } is_loop = is_loop_device(file); |