loop: fix backing file reference leak on validation error

commit 98b7bf54338b797e3a11e8178ce0e806060d8fa3 upstream.

loop_change_fd() and loop_configure() call loop_check_backing_file()
to validate the new backing file. If validation fails, the reference
acquired by fget() was not dropped, leaking a file reference.

Fix this by calling fput(file) before returning the error.

Cc: stable@vger.kernel.org
Cc: Markus Elfring <Markus.Elfring@web.de>
CC: Yang Erkun <yangerkun@huawei.com>
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Yu Kuai <yukuai1@huaweicloud.com>
Fixes: f5c84eff634b ("loop: Add sanity check for read/write_iter")
Signed-off-by: Li Chen <chenl311@chinatelecom.cn>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Yang Erkun <yangerkun@huawei.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index db9b5164cccaf36c5fc2a524fa523661bb49794e..dd411719220198cb82f57a3f4aae8ee05aa678bd 100644 (file)
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -536,8 +536,10 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev,
                return -EBADF;
 
        error = loop_check_backing_file(file);
-       if (error)
+       if (error) {
+               fput(file);
                return error;
+       }
 
        /* suppress uevents while reconfiguring the device */
        dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 1);
@@ -973,8 +975,10 @@ static int loop_configure(struct loop_device *lo, blk_mode_t mode,
                return -EBADF;
 
        error = loop_check_backing_file(file);
-       if (error)
+       if (error) {
+               fput(file);
                return error;
+       }
 
        is_loop = is_loop_device(file);