From: Christoph Hellwig hch@lst.de
mainline inclusion from mainline-v5.13-rc1 commit c76f48eb5c084b1e15c931ae8cc1826cd771d70d category: bugfix bugzilla: 55097 CVE: NA
--------------------------------
There is nothing preventing an ioctl from trying do delete partition concurrenly with del_gendisk, so take open_mutex to serialize against that.
Signed-off-by: Christoph Hellwig hch@lst.de Link: https://lore.kernel.org/r/20210406062303.811835-6-hch@lst.de Signed-off-by: Jens Axboe axboe@kernel.dk Conflicts: block/genhd.c block/partitions/core.c [Yufen: linux-4.19 have not extract blk_drop_partitions().] Signed-off-by: Yufen Yu yuyufen@huawei.com Reviewed-by: Jason Yan yanaijie@huawei.com Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- block/genhd.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
diff --git a/block/genhd.c b/block/genhd.c index 026d3f41c85a1..686a54698aa02 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -756,6 +756,7 @@ void del_gendisk(struct gendisk *disk) { struct disk_part_iter piter; struct hd_struct *part; + struct block_device *bdev;
blk_integrity_del(disk); disk_del_events(disk); @@ -765,6 +766,14 @@ void del_gendisk(struct gendisk *disk) * disk is marked as dead (GENHD_FL_UP cleared). */ down_write(&disk->lookup_sem); + + /* + * If bdev is null, that menas memory allocate fail. Then + * add_partitions can also fail. + */ + bdev = bdget_disk(disk, 0); + if (bdev) + mutex_lock(&bdev->bd_mutex); /* invalidate stuff */ disk_part_iter_init(&piter, disk, DISK_PITER_INCL_EMPTY | DISK_PITER_REVERSE); @@ -774,6 +783,8 @@ void del_gendisk(struct gendisk *disk) delete_partition(disk, part->partno); } disk_part_iter_exit(&piter); + if (bdev) + mutex_unlock(&bdev->bd_mutex);
invalidate_partition(disk, 0); bdev_unhash_inode(disk_devt(disk));