diff options
| author | Andrew Morton <akpm@linux-foundation.org> | 2008-09-06 01:10:03 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-10-08 19:44:40 -0700 |
| commit | 24ac281c6c6ae8d1fe9752cb5647e6d140134a6f (patch) | |
| tree | 02a38f3b85c87d0dacc4144d22e2ae06965fea6a | |
| parent | c73c1f8872fdb4aad48e791667ec3d0c180802ce (diff) | |
| download | lwn-24ac281c6c6ae8d1fe9752cb5647e6d140134a6f.tar.gz lwn-24ac281c6c6ae8d1fe9752cb5647e6d140134a6f.zip | |
drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()
commit 70bb08962ea9bd50797ae9f16b2493f5f7c65053 upstream
mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on. This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.
Reported-by: <sasin@solomon-systech.com>
Acked-by: Pierre Ossman <drzeus-list@drzeus.cx>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/mmc/card/block.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c index 91ded3e82401..3318642b6344 100644 --- a/drivers/mmc/card/block.c +++ b/drivers/mmc/card/block.c @@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *inode, struct file *filp) check_disk_change(inode->i_bdev); ret = 0; - if ((filp->f_mode & FMODE_WRITE) && md->read_only) + if ((filp->f_mode & FMODE_WRITE) && md->read_only) { + mmc_blk_put(md); ret = -EROFS; + } } return ret; |