* mmc/card/block.c : mmc_blk_open readonly mount bug?
@ 2008-09-04 9:17 sasin
2008-09-04 23:08 ` Andrew Morton
0 siblings, 1 reply; 4+ messages in thread
From: sasin @ 2008-09-04 9:17 UTC (permalink / raw)
To: linux-kernel
mmc_block_open increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on. This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.
"return -EROFS;"
should be replaced by
"
{
ret = -EROFS;
mmc_blk_put(md);
}
"
Best regards,
Sasi
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: mmc/card/block.c : mmc_blk_open readonly mount bug?
2008-09-04 9:17 mmc/card/block.c : mmc_blk_open readonly mount bug? sasin
@ 2008-09-04 23:08 ` Andrew Morton
2008-09-05 5:06 ` Pierre Ossman
0 siblings, 1 reply; 4+ messages in thread
From: Andrew Morton @ 2008-09-04 23:08 UTC (permalink / raw)
To: sasin; +Cc: linux-kernel, Pierre Ossman
On Thu, 4 Sep 2008 17:17:15 +0800
<sasin@solomon-systech.com> wrote:
> mmc_block_open increments md->usage although it returns with -EROFS when
> default mounting a MMC/SD card with write protect switch on. This
> reference counting bug prevents /dev/mmcblkX from being released on card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
>
> "return -EROFS;"
>
> should be replaced by
>
> "
> {
> ret = -EROFS;
> mmc_blk_put(md);
> }
> "
It's unknown what kernel version you're looking at. The code in 2.6.25
and 2.6.26 and 2.6.27 has changed since then, but the bug appears to
still be there.
From: Andrew Morton <akpm@linux-foundation.org>
mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on. This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.
Reported-by: <sasin@solomon-systech.com>
Cc: Pierre Ossman <drzeus-list@drzeus.cx>
Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
drivers/mmc/card/block.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff -puN drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open drivers/mmc/card/block.c
--- a/drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open
+++ a/drivers/mmc/card/block.c
@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in
check_disk_change(inode->i_bdev);
ret = 0;
- if ((filp->f_mode & FMODE_WRITE) && md->read_only)
+ if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
+ mmc_blk_put(md);
ret = -EROFS;
+ }
}
return ret;
_
^ permalink raw reply [flat|nested] 4+ messages in thread
* RE: mmc/card/block.c : mmc_blk_open readonly mount bug?
@ 2008-09-05 5:36 sasin
0 siblings, 0 replies; 4+ messages in thread
From: sasin @ 2008-09-05 5:36 UTC (permalink / raw)
To: drzeus-list, akpm; +Cc: linux-kernel
Guess nobody tests with readonly? We had a socket on our board that
flipped the write protect signal, and the rest you know :-)
-----Original Message-----
From: Pierre Ossman [mailto:drzeus-list@drzeus.cx]
Sent: Friday, September 05, 2008 1:07 PM
To: Andrew Morton
Cc: Sasi Nair; linux-kernel@vger.kernel.org
Subject: Re: mmc/card/block.c : mmc_blk_open readonly mount bug?
On Thu, 4 Sep 2008 16:08:08 -0700
Andrew Morton <akpm@linux-foundation.org> wrote:
> From: Andrew Morton <akpm@linux-foundation.org>
>
> mmc_block_open() increments md->usage although it returns with -EROFS
when
> default mounting a MMC/SD card with write protect switch on. This
> reference counting bug prevents /dev/mmcblkX from being released on
card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
>
> Reported-by: <sasin@solomon-systech.com>
> Cc: Pierre Ossman <drzeus-list@drzeus.cx>
> Cc: <stable@kernel.org> [2.6.25.x, 2.6.26.x]
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
I wonder how that bug has been able to go unnoticed for so long...
Acked-by: Pierre Ossman <drzeus@drzeus.cx>
--
-- Pierre Ossman
Linux kernel, MMC maintainer http://www.kernel.org
rdesktop, core developer http://www.rdesktop.org
WARNING: This correspondence is being monitored by the
Swedish government. Make sure your server uses encryption
for SMTP traffic and consider using PGP for end-to-end
encryption.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2008-09-05 5:35 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-09-04 9:17 mmc/card/block.c : mmc_blk_open readonly mount bug? sasin
2008-09-04 23:08 ` Andrew Morton
2008-09-05 5:06 ` Pierre Ossman
-- strict thread matches above, loose matches on Subject: below --
2008-09-05 5:36 sasin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox