dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl
authorMike Snitzer <snitzer@redhat.com>
Thu, 22 Feb 2018 18:31:20 +0000 (13:31 -0500)
committerMike Snitzer <snitzer@redhat.com>
Wed, 7 Mar 2018 01:23:57 +0000 (20:23 -0500)
commit519049afead4f7c3e6446028c41e99fde958cc04
tree8f53318d846950f09877689d95535b8aa86c8743
parent590347e4000356f55eb10b03ced2686bd74dab40
dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl

Otherwise an underlying device's teardown (e.g. SCSI) may race with the
DM ioctl or persistent reservation and result in dereferencing driver
memory that gets freed when the underlying device's final blkdev_put()
occurs.

bdgrab() only increases the refcount for the block_device's inode to
ensure the block_device struct itself will not be freed, but does not
guarantee the block_device will remain associated with the gendisk or
its storage.

Cc: stable@vger.kernel.org # 4.8+
Reported-by: David Jeffery <djeffery@redhat.com>
Suggested-by: David Jeffery <djeffery@redhat.com>
Reviewed-by: Ben Marzinski <bmarzins@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
drivers/md/dm.c