ovl: fix incorrect fdput() on aio completion
authorAmir Goldstein <amir73il@gmail.com>
Tue, 22 Aug 2023 17:50:59 +0000 (20:50 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 23 Sep 2023 09:11:10 +0000 (11:11 +0200)
commite7dcf8339a0f3290944a301d22063d96c9aa4f70
tree92876f19870613a76220ebb7006196e82bc7e8a7
parent17854d92fa4a7d40463a83d558774b6f8ba1749a
ovl: fix incorrect fdput() on aio completion

commit 724768a39374d35b70eaeae8dd87048a2ec7ae8e upstream.

ovl_{read,write}_iter() always call fdput(real) to put one or zero
refcounts of the real file, but for aio, whether it was submitted or not,
ovl_aio_put() also calls fdput(), which is not balanced.  This is only a
problem in the less common case when FDPUT_FPUT flag is set.

To fix the problem use get_file() to take file refcount and use fput()
instead of fdput() in ovl_aio_put().

Fixes: 2406a307ac7d ("ovl: implement async IO routines")
Cc: <stable@vger.kernel.org> # v5.6
Reviewed-by: Miklos Szeredi <miklos@szeredi.hu>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/overlayfs/file.c