All of lore.kernel.org
 help / color / mirror / Atom feed
* [patch 19/42] mmc_block: add dev_t initialization check
@ 2010-01-08 22:42 akpm
  0 siblings, 0 replies; only message in thread
From: akpm @ 2010-01-08 22:42 UTC (permalink / raw)
  To: torvalds; +Cc: akpm, EXT-Anna.Lemehova, adrian.hunter, linux-mmc, stable

From: Anna Lemehova <EXT-Anna.Lemehova@nokia.com>

When a card is removed before mmc_blk_probe() has called add_disk(), then
the minor field is uninitialized and has value 0.  This caused
mmc_blk_put() to always release devidx 0 even if 0 was still in use.  Then
the next mmc_blk_probe() used the first free idx of 0, which oopses in
sysfs, since it is used by another card.

Signed-off-by: Anna Lemehova <EXT-Anna.Lemehova@nokia.com>
Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
Cc: <linux-mmc@vger.kernel.org>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/mmc/card/block.c |    5 +++++
 1 file changed, 5 insertions(+)

diff -puN drivers/mmc/card/block.c~mmc_block-add-dev_t-initialization-check drivers/mmc/card/block.c
--- a/drivers/mmc/card/block.c~mmc_block-add-dev_t-initialization-check
+++ a/drivers/mmc/card/block.c
@@ -85,7 +85,12 @@ static void mmc_blk_put(struct mmc_blk_d
 	mutex_lock(&open_lock);
 	md->usage--;
 	if (md->usage == 0) {
+		int devmaj = MAJOR(disk_devt(md->disk));
 		int devidx = MINOR(disk_devt(md->disk)) >> MMC_SHIFT;
+
+		if (!devmaj)
+			devidx = md->disk->first_minor >> MMC_SHIFT;
+
 		__clear_bit(devidx, dev_use);
 
 		put_disk(md->disk);
_

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2010-01-08 22:50 UTC | newest]

Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-01-08 22:42 [patch 19/42] mmc_block: add dev_t initialization check akpm

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.