Messages in this thread Patch in this message | | | Subject | [PATCH] block: fix refcounting in BLKBSZSET | From | Miklos Szeredi <> | Date | Thu, 24 Feb 2011 15:48:33 +0100 |
| |
[and lkml cc-d too]
This fixes bug 29202 in the 2.6.38 regression list.
Please apply.
Thanks, Miklos
---- Subject: block: fix refcounting in BLKBSZSET
From: Miklos Szeredi <mszeredi@suse.cz>
Adam Kovari and others reported that disconnecting an USB drive with an ntfs-3g filesystem would cause "kernel BUG at fs/inode.c:1421!" to be triggered.
The BUG could be traced back to ioctl(BLKBSZSET), which would erroneously decrement the refcount on the bdev. This is because blkdev_get() expects the refcount to be already incremented and either returns success or decrements the refcount and returns an error.
The bug was introduced by e525fd89 (block: make blkdev_get/put() handle exclusive access), which didn't take into account this behavior of blkdev_get().
Reported-by: Adam Kovari <kovariadam@gmail.com> CC: Tejun Heo <tj@kernel.org> Signed-off-by: Miklos Szeredi <mszeredi@suse.cz> --- block/ioctl.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
Index: linux.git/block/ioctl.c =================================================================== --- linux.git.orig/block/ioctl.c 2011-01-18 09:02:44.000000000 +0100 +++ linux.git/block/ioctl.c 2011-02-24 14:23:56.000000000 +0100 @@ -294,9 +294,11 @@ int blkdev_ioctl(struct block_device *bd return -EINVAL; if (get_user(n, (int __user *) arg)) return -EFAULT; - if (!(mode & FMODE_EXCL) && - blkdev_get(bdev, mode | FMODE_EXCL, &bdev) < 0) - return -EBUSY; + if (!(mode & FMODE_EXCL)) { + bdgrab(bdev); + if (blkdev_get(bdev, mode | FMODE_EXCL, &bdev) < 0) + return -EBUSY; + } ret = set_blocksize(bdev, n); if (!(mode & FMODE_EXCL)) blkdev_put(bdev, mode | FMODE_EXCL);
| |