drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()

mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on.  This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.

Reported-by: <sasin@solomon-systech.com>
Acked-by: Pierre Ossman <drzeus-list@drzeus.cx>
Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 3 insertions, 1 deletions

diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index 86dbb366415a..6986f3926244 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *inode, struct file *filp)
                         check_disk_change(inode->i_bdev);
                 ret = 0;
 
-                if ((filp->f_mode & FMODE_WRITE) && md->read_only)
+                if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
+                        mmc_blk_put(md);
                         ret = -EROFS;
+                }
         }
 
         return ret;