From: Yu Kuai <yukuai3@huawei.com> mainline inclusion from mainline-v6.9-rc6 commit 9617cd6f24b294552a817f80f5225431ef67b540 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I0 CVE: CVE-2024-35859 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- At the time bdev_may_open() is called, module reference is grabbed already, hence module reference should be released if bdev_may_open() failed. This problem is found by code review. Fixes: ed5cc702d311 ("block: Add config option to not allow writing to mounted devices") Signed-off-by: Yu Kuai <yukuai3@huawei.com> Link: https://lore.kernel.org/r/20240406090930.2252838-22-yukuai1@huaweicloud.com Signed-off-by: Christian Brauner <brauner@kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com> --- block/bdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/bdev.c b/block/bdev.c index b555deef0d76..07e8e3686aea 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -946,7 +946,7 @@ struct bdev_handle *bdev_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, goto abort_claiming; ret = -EBUSY; if (!bdev_may_open(bdev, mode)) - goto abort_claiming; + goto put_module; if (bdev_is_partition(bdev)) ret = blkdev_get_part(bdev, mode); else -- 2.31.1