From: Andrew Morton <akpm@linux-foundation.org>
To: <sasin@solomon-systech.com>
Cc: linux-kernel@vger.kernel.org, Pierre Ossman <drzeus-list@drzeus.cx>
Subject: Re: mmc/card/block.c : mmc_blk_open readonly mount bug?
Date: Thu, 4 Sep 2008 16:08:08 -0700 [thread overview]
Message-ID: <20080904160808.a23a2197.akpm@linux-foundation.org> (raw)
In-Reply-To: <6334E09627481B4AA5C8DE1E69E19D3B09D1F13A@SSLEXCHANGE.solomonsystech.com>
On Thu, 4 Sep 2008 17:17:15 +0800
<sasin@solomon-systech.com> wrote:
> mmc_block_open increments md->usage although it returns with -EROFS when
> default mounting a MMC/SD card with write protect switch on. This
> reference counting bug prevents /dev/mmcblkX from being released on card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
>
> "return -EROFS;"
>
> should be replaced by
>
> "
> {
> ret = -EROFS;
> mmc_blk_put(md);
> }
> "
It's unknown what kernel version you're looking at. The code in 2.6.25
and 2.6.26 and 2.6.27 has changed since then, but the bug appears to
still be there.
From: Andrew Morton <akpm@linux-foundation.org>
mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on. This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.
Reported-by: <sasin@solomon-systech.com>
Cc: Pierre Ossman <drzeus-list@drzeus.cx>
Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
drivers/mmc/card/block.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff -puN drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open drivers/mmc/card/block.c
--- a/drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open
+++ a/drivers/mmc/card/block.c
@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in
check_disk_change(inode->i_bdev);
ret = 0;
- if ((filp->f_mode & FMODE_WRITE) && md->read_only)
+ if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
+ mmc_blk_put(md);
ret = -EROFS;
+ }
}
return ret;
_
next prev parent reply other threads:[~2008-09-04 23:08 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-09-04 9:17 mmc/card/block.c : mmc_blk_open readonly mount bug? sasin
2008-09-04 23:08 ` Andrew Morton [this message]
2008-09-05 5:06 ` Pierre Ossman
-- strict thread matches above, loose matches on Subject: below --
2008-09-05 5:36 sasin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20080904160808.a23a2197.akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=drzeus-list@drzeus.cx \
--cc=linux-kernel@vger.kernel.org \
--cc=sasin@solomon-systech.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox