block: Fix NULL pointer dereference in sd_revalidate_disk

Since 2.6.39 (1196f8b), when a driver returns -ENOMEDIUM for open(),
__blkdev_get() calls rescan_partitions() to remove
in-kernel partition structures and raise KOBJ_CHANGE uevent.

However it ends up calling driver's revalidate_disk without open
and could cause oops.

In the case of SCSI:

  process A                  process B
  ----------------------------------------------
  sys_open
    __blkdev_get
      sd_open
        returns -ENOMEDIUM
                             scsi_remove_device
                               <scsi_device torn down>
      rescan_partitions
        sd_revalidate_disk
          <oops>
Oopses are reported here:
http://marc.info/?l=linux-scsi&m=132388619710052

This patch separates the partition invalidation from rescan_partitions()
and use it for -ENOMEDIUM case.

Reported-by: Huajun Li <huajun.li.lee@gmail.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>

1 files changed, 12 insertions, 4 deletions

diff --git a/fs/block_dev.c b/fs/block_dev.c
index 0e575d1304b4..5e9f198f7712 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1183,8 +1183,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                          * The latter is necessary to prevent ghost
                          * partitions on a removed medium.
                          */
-                        if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                                rescan_partitions(disk, bdev);
+                        if (bdev->bd_invalidated) {
+                                if (!ret)
+                                        rescan_partitions(disk, bdev);
+                                else if (ret == -ENOMEDIUM)
+                                        invalidate_partitions(disk, bdev);
+                        }
                         if (ret)
                                 goto out_clear;
                 } else {
@@ -1214,8 +1218,12 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                         if (bdev->bd_disk->fops->open)
                                 ret = bdev->bd_disk->fops->open(bdev, mode);
                         /* the same as first opener case, read comment there */
-                        if (bdev->bd_invalidated && (!ret || ret == -ENOMEDIUM))
-                                rescan_partitions(bdev->bd_disk, bdev);
+                        if (bdev->bd_invalidated) {
+                                if (!ret)
+                                        rescan_partitions(bdev->bd_disk, bdev);
+                                else if (ret == -ENOMEDIUM)
+                                        invalidate_partitions(bdev->bd_disk, bdev);
+                        }
                         if (ret)
                                 goto out_unlock_bdev;
                 }