lkml.org 
[lkml]   [2011]   [Feb]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] block: fix refcounting in BLKBSZSET
From
Date
[and lkml cc-d too]

This fixes bug 29202 in the 2.6.38 regression list.

Please apply.

Thanks,
Miklos

----
Subject: block: fix refcounting in BLKBSZSET

From: Miklos Szeredi <mszeredi@suse.cz>

Adam Kovari and others reported that disconnecting an USB drive with
an ntfs-3g filesystem would cause "kernel BUG at fs/inode.c:1421!" to
be triggered.

The BUG could be traced back to ioctl(BLKBSZSET), which would
erroneously decrement the refcount on the bdev. This is because
blkdev_get() expects the refcount to be already incremented and either
returns success or decrements the refcount and returns an error.

The bug was introduced by e525fd89 (block: make blkdev_get/put()
handle exclusive access), which didn't take into account this behavior
of blkdev_get().

Reported-by: Adam Kovari <kovariadam@gmail.com>
CC: Tejun Heo <tj@kernel.org>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
---
block/ioctl.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)

Index: linux.git/block/ioctl.c
===================================================================
--- linux.git.orig/block/ioctl.c 2011-01-18 09:02:44.000000000 +0100
+++ linux.git/block/ioctl.c 2011-02-24 14:23:56.000000000 +0100
@@ -294,9 +294,11 @@ int blkdev_ioctl(struct block_device *bd
return -EINVAL;
if (get_user(n, (int __user *) arg))
return -EFAULT;
- if (!(mode & FMODE_EXCL) &&
- blkdev_get(bdev, mode | FMODE_EXCL, &bdev) < 0)
- return -EBUSY;
+ if (!(mode & FMODE_EXCL)) {
+ bdgrab(bdev);
+ if (blkdev_get(bdev, mode | FMODE_EXCL, &bdev) < 0)
+ return -EBUSY;
+ }
ret = set_blocksize(bdev, n);
if (!(mode & FMODE_EXCL))
blkdev_put(bdev, mode | FMODE_EXCL);


\
 
 \ /
  Last update: 2011-02-24 15:51    [W:0.045 / U:3.868 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site