Skip to content

Commit 647a20d

Browse files
committed
dm: do not reuse dm_blk_ioctl block_device input as local variable
(Ab)using the @bdev passed to dm_blk_ioctl() opens the potential for targets' .prepare_ioctl to fail if they go on to check the bdev for !NULL. Fixes: e56f81e ("dm: refactor ioctl handling") Reported-by: Junichi Nomura <[email protected]> Signed-off-by: Mike Snitzer <[email protected]>
1 parent 5bbbfdf commit 647a20d

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

drivers/md/dm.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -603,9 +603,10 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
603603
{
604604
struct mapped_device *md = bdev->bd_disk->private_data;
605605
struct dm_target *tgt;
606+
struct block_device *tgt_bdev = NULL;
606607
int srcu_idx, r;
607608

608-
r = dm_get_live_table_for_ioctl(md, &tgt, &bdev, &mode, &srcu_idx);
609+
r = dm_get_live_table_for_ioctl(md, &tgt, &tgt_bdev, &mode, &srcu_idx);
609610
if (r < 0)
610611
return r;
611612

@@ -620,7 +621,7 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode,
620621
goto out;
621622
}
622623

623-
r = __blkdev_driver_ioctl(bdev, mode, cmd, arg);
624+
r = __blkdev_driver_ioctl(tgt_bdev, mode, cmd, arg);
624625
out:
625626
dm_put_live_table(md, srcu_idx);
626627
return r;

0 commit comments

Comments
 (0)