mmc/card/block.c : mmc_blk_open readonly mount bug?

mmc/card/block.c : mmc_blk_open readonly mount bug?

[sasin]

mmc_block_open increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on.  This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.

"return -EROFS;"

should be replaced by

"
{
ret = -EROFS;
mmc_blk_put(md);
}
"


Best regards,
Sasi

Re: mmc/card/block.c : mmc_blk_open readonly mount bug?

[Andrew Morton]

On Thu, 4 Sep 2008 17:17:15 +0800
<sasin@solomon-systech.com> wrote:

> mmc_block_open increments md->usage although it returns with -EROFS when
> default mounting a MMC/SD card with write protect switch on.  This
> reference counting bug prevents /dev/mmcblkX from being released on card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
> 
> "return -EROFS;"
> 
> should be replaced by
> 
> "
> {
> ret = -EROFS;
> mmc_blk_put(md);
> }
> "

It's unknown what kernel version you're looking at.  The code in 2.6.25
and 2.6.26 and 2.6.27 has changed since then, but the bug appears to
still be there.

From: Andrew Morton <akpm@linux-foundation.org>

mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on.  This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.

Reported-by: <sasin@solomon-systech.com>
Cc: Pierre Ossman <drzeus-list@drzeus.cx>
Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/mmc/card/block.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff -puN drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open drivers/mmc/card/block.c
--- a/drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open
+++ a/drivers/mmc/card/block.c
@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in
 			check_disk_change(inode->i_bdev);
 		ret = 0;
 
-		if ((filp->f_mode & FMODE_WRITE) && md->read_only)
+		if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
+			mmc_blk_put(md);
 			ret = -EROFS;
+		}
 	}
 
 	return ret;
_

Re: mmc/card/block.c : mmc_blk_open readonly mount bug?

[Pierre Ossman]

[-- Attachment #1: Type: text/plain, Size: 1131 bytes --]

On Thu, 4 Sep 2008 16:08:08 -0700
Andrew Morton <akpm@linux-foundation.org> wrote:

> From: Andrew Morton <akpm@linux-foundation.org>
> 
> mmc_block_open() increments md->usage although it returns with -EROFS when
> default mounting a MMC/SD card with write protect switch on.  This
> reference counting bug prevents /dev/mmcblkX from being released on card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
> 
> Reported-by: <sasin@solomon-systech.com>
> Cc: Pierre Ossman <drzeus-list@drzeus.cx>
> Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---

I wonder how that bug has been able to go unnoticed for so long...

Acked-by: Pierre Ossman <drzeus@drzeus.cx>

-- 
     -- Pierre Ossman

  Linux kernel, MMC maintainer        http://www.kernel.org
  rdesktop, core developer          http://www.rdesktop.org

  WARNING: This correspondence is being monitored by the
  Swedish government. Make sure your server uses encryption
  for SMTP traffic and consider using PGP for end-to-end
  encryption.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 197 bytes --]

RE: mmc/card/block.c : mmc_blk_open readonly mount bug?

[sasin]

Guess nobody tests with readonly?  We had a socket on our board that
flipped the write protect signal, and the rest you know :-)

-----Original Message-----
From: Pierre Ossman [mailto:drzeus-list@drzeus.cx] 
Sent: Friday, September 05, 2008 1:07 PM
To: Andrew Morton
Cc: Sasi Nair; linux-kernel@vger.kernel.org
Subject: Re: mmc/card/block.c : mmc_blk_open readonly mount bug?


On Thu, 4 Sep 2008 16:08:08 -0700
Andrew Morton <akpm@linux-foundation.org> wrote:

> From: Andrew Morton <akpm@linux-foundation.org>
> 
> mmc_block_open() increments md->usage although it returns with -EROFS
when
> default mounting a MMC/SD card with write protect switch on.  This
> reference counting bug prevents /dev/mmcblkX from being released on
card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
> 
> Reported-by: <sasin@solomon-systech.com>
> Cc: Pierre Ossman <drzeus-list@drzeus.cx>
> Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---

I wonder how that bug has been able to go unnoticed for so long...

Acked-by: Pierre Ossman <drzeus@drzeus.cx>

-- 
     -- Pierre Ossman

  Linux kernel, MMC maintainer        http://www.kernel.org
  rdesktop, core developer          http://www.rdesktop.org

  WARNING: This correspondence is being monitored by the
  Swedish government. Make sure your server uses encryption
  for SMTP traffic and consider using PGP for end-to-end
  encryption.