aboutsummaryrefslogtreecommitdiffstats
path: root/fs/block_dev.c
diff options
context:
space:
mode:
authorJun'ichi Nomura <j-nomura@ce.jp.nec.com>2012-03-02 04:38:33 -0500
committerJens Axboe <axboe@kernel.dk>2012-03-02 04:38:33 -0500
commitfe316bf2d5847bc5dd975668671a7b1067603bc7 (patch)
tree617f6a89b96a8c074d0a2fc1ef4ffc259fb4ed2f /fs/block_dev.c
parent621032ad6eaabf2fe771c4fa0d8f58e1fcfcdba6 (diff)
block: Fix NULL pointer dereference in sd_revalidate_disk
Since 2.6.39 (1196f8b), when a driver returns -ENOMEDIUM for open(), __blkdev_get() calls rescan_partitions() to remove in-kernel partition structures and raise KOBJ_CHANGE uevent. However it ends up calling driver's revalidate_disk without open and could cause oops. In the case of SCSI: process A process B ---------------------------------------------- sys_open __blkdev_get sd_open returns -ENOMEDIUM scsi_remove_device <scsi_device torn down> rescan_partitions sd_revalidate_disk <oops> Oopses are reported here: http://marc.info/?l=linux-scsi&m=132388619710052 This patch separates the partition invalidation from rescan_partitions() and use it for -ENOMEDIUM case. Reported-by: Huajun Li <huajun.li.lee@gmail.com> Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com> Acked-by: Tejun Heo <tj@kernel.org> Cc: stable@kernel.org Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/block_dev.c')
-rw-r--r--fs/block_dev.c16
1 files changed, 12 insertions, 4 deletions
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 0e575d1304b4..5e9f198f7712 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1183,8 +1183,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
1183 * The latter is necessary to prevent ghost 1183 * The latter is necessary to prevent ghost
1184 * partitions on a removed medium. 1184 * partitions on a removed medium.
1185 */ 1185 */
1186 if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) 1186 if (bdev->bd_invalidated) {
1187 rescan_partitions(disk, bdev); 1187 if (!ret)
1188 rescan_partitions(disk, bdev);
1189 else if (ret == -ENOMEDIUM)
1190 invalidate_partitions(disk, bdev);
1191 }
1188 if (ret) 1192 if (ret)
1189 goto out_clear; 1193 goto out_clear;
1190 } else { 1194 } else {
@@ -1214,8 +1218,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
1214 if (bdev->bd_disk->fops->open) 1218 if (bdev->bd_disk->fops->open)
1215 ret = bdev->bd_disk->fops->open(bdev, mode); 1219 ret = bdev->bd_disk->fops->open(bdev, mode);
1216 /* the same as first opener case, read comment there */ 1220 /* the same as first opener case, read comment there */
1217 if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM)) 1221 if (bdev->bd_invalidated) {
1218 rescan_partitions(bdev->bd_disk, bdev); 1222 if (!ret)
1223 rescan_partitions(bdev->bd_disk, bdev);
1224 else if (ret == -ENOMEDIUM)
1225 invalidate_partitions(bdev->bd_disk, bdev);
1226 }
1219 if (ret) 1227 if (ret)
1220 goto out_unlock_bdev; 1228 goto out_unlock_bdev;
1221 } 1229 }