From: Yu Kuai yukuai3@huawei.com

mainline inclusion from mainline-v6.9-rc6 commit 9617cd6f24b294552a817f80f5225431ef67b540 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9I0 CVE: CVE-2024-35859

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

At the time bdev_may_open() is called, module reference is grabbed already, hence module reference should be released if bdev_may_open() failed.

This problem is found by code review.

Fixes: ed5cc702d311 ("block: Add config option to not allow writing to mounted devices") Signed-off-by: Yu Kuai yukuai3@huawei.com Link: https://lore.kernel.org/r/20240406090930.2252838-22-yukuai1@huaweicloud.com Signed-off-by: Christian Brauner brauner@kernel.org Signed-off-by: Li Lingfeng lilingfeng3@huawei.com --- block/bdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/bdev.c b/block/bdev.c index b555deef0d76..07e8e3686aea 100644 --- a/block/bdev.c +++ b/block/bdev.c @@ -946,7 +946,7 @@ struct bdev_handle *bdev_open_by_dev(dev_t dev, blk_mode_t mode, void *holder, goto abort_claiming; ret = -EBUSY; if (!bdev_may_open(bdev, mode)) - goto abort_claiming; + goto put_module; if (bdev_is_partition(bdev)) ret = blkdev_get_part(bdev, mode); else