Konrad Rzeszutek Wilk
2013-Sep-06 13:37 UTC
Re: [PATCH] xen/blkback: fix reference counting
On Thu, Sep 05, 2013 at 01:00:14PM +0200, Vegard Nossum wrote:> If the permission check fails, we drop a reference to the blkif without > having taken it in the first place. The bug was introduced in commit > 604c499cbbcc3d5fe5fb8d53306aa0fae1990109 (xen/blkback: Check device > permissions before allowing OP_DISCARD). > > Cc: stable@vger.kernel.org > Cc: Jan Beulich <JBeulich@suse.com> > Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>Thank you for spotting that. Let me stick it on my for-jens queue.> Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com> > --- > drivers/block/xen-blkback/blkback.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c > index bf4b9d2..6620b73 100644 > --- a/drivers/block/xen-blkback/blkback.c > +++ b/drivers/block/xen-blkback/blkback.c > @@ -872,49 +872,50 @@ static int xen_blkbk_parse_indirect(struct blkif_request *req, > } > > unmap: > if (segments) > kunmap_atomic(segments); > xen_blkbk_unmap(blkif, pages, indirect_grefs); > return rc; > } > > static int dispatch_discard_io(struct xen_blkif *blkif, > struct blkif_request *req) > { > int err = 0; > int status = BLKIF_RSP_OKAY; > struct block_device *bdev = blkif->vbd.bdev; > unsigned long secure; > struct phys_req preq; > > + xen_blkif_get(blkif); > + > preq.sector_number = req->u.discard.sector_number; > preq.nr_sects = req->u.discard.nr_sectors; > > err = xen_vbd_translate(&preq, blkif, WRITE); > if (err) { > pr_warn(DRV_PFX "access denied: DISCARD [%llu->%llu] on dev=%04x\n", > preq.sector_number, > preq.sector_number + preq.nr_sects, blkif->vbd.pdevice); > goto fail_response; > } > blkif->st_ds_req++; > > - xen_blkif_get(blkif); > secure = (blkif->vbd.discard_secure && > (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ? > BLKDEV_DISCARD_SECURE : 0; > > err = blkdev_issue_discard(bdev, req->u.discard.sector_number, > req->u.discard.nr_sectors, > GFP_KERNEL, secure); > fail_response: > if (err == -EOPNOTSUPP) { > pr_debug(DRV_PFX "discard op failed, not supported\n"); > status = BLKIF_RSP_EOPNOTSUPP; > } else if (err) > status = BLKIF_RSP_ERROR; > > make_response(blkif, req->u.discard.id, req->operation, status); > xen_blkif_put(blkif); > return err; > } > -- > 1.7.10.4 >