From 6a2aae06cc1e87e9712a26a639f6a2f3442e2027 Mon Sep 17 00:00:00 2001 From: Pavel Emelianov Date: Sat, 28 Oct 2006 10:38:33 -0700 Subject: [PATCH] Fix potential OOPs in blkdev_open() blkdev_open() calls bc_acquire() to get a struct block_device. Since bc_acquire() may return NULL when system is out of memory an appropriate check is required. Signed-off-by: Pavel Emelianov Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/block_dev.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'fs/block_dev.c') diff --git a/fs/block_dev.c b/fs/block_dev.c index bc8f27cc448..702b88cbd91 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1131,6 +1131,8 @@ static int blkdev_open(struct inode * inode, struct file * filp) filp->f_flags |= O_LARGEFILE; bdev = bd_acquire(inode); + if (bdev == NULL) + return -ENOMEM; res = do_open(bdev, filp, BD_MUTEX_NORMAL); if (res) -- cgit v1.2.3 From bcb55165d3d1ae3ec95807d118fd6d5956cd127b Mon Sep 17 00:00:00 2001 From: Jun'ichi Nomura Date: Mon, 30 Oct 2006 16:23:45 -0500 Subject: [PATCH] fix bd_claim_by_kobject error handling This fixes bd_claim_by_kobject to release bdev correctly in case that bd_claim succeeds but following add_bd_holder fails. Signed-off-by: Jun'ichi Nomura Signed-off-by: Linus Torvalds --- fs/block_dev.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'fs/block_dev.c') diff --git a/fs/block_dev.c b/fs/block_dev.c index 702b88cbd91..b54b0a1b7c6 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -751,8 +751,11 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder, mutex_lock_nested(&bdev->bd_mutex, BD_MUTEX_PARTITION); res = bd_claim(bdev, holder); - if (res == 0) + if (res == 0) { res = add_bd_holder(bdev, bo); + if (res) + bd_release(bdev); + } if (res) free_bd_holder(bo); mutex_unlock(&bdev->bd_mutex); -- cgit v1.2.3 From df6c0cd9a872ebf2298f5d66d8c789f62dbe35fc Mon Sep 17 00:00:00 2001 From: Jun'ichi Nomura Date: Mon, 30 Oct 2006 16:23:56 -0500 Subject: [PATCH] clean up add_bd_holder() add_bd_holder() is called from bd_claim_by_kobject to put a given struct bd_holder in the list if there is no matching entry. There are 3 possible results of add_bd_holder(): 1. there is no matching entry and add the given one to the list 2. there is matching entry, so just increment reference count of the existing one 3. something failed during its course 1 and 2 are successful cases. But for case 2, someone has to free the unused struct bd_holder. The current code frees it inside of add_bd_holder and returns same value 0 for both cases 1 and 2. However, it's natural and less error-prone if caller frees it since it's allocated by the caller. Signed-off-by: Jun'ichi Nomura Signed-off-by: Linus Torvalds --- fs/block_dev.c | 53 +++++++++++++++++++++++++++++++++++------------------ 1 file changed, 35 insertions(+), 18 deletions(-) (limited to 'fs/block_dev.c') diff --git a/fs/block_dev.c b/fs/block_dev.c index b54b0a1b7c6..aaa8301f43f 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -641,17 +641,39 @@ static void free_bd_holder(struct bd_holder *bo) kfree(bo); } +/** + * find_bd_holder - find matching struct bd_holder from the block device + * + * @bdev: struct block device to be searched + * @bo: target struct bd_holder + * + * Returns matching entry with @bo in @bdev->bd_holder_list. + * If found, increment the reference count and return the pointer. + * If not found, returns NULL. + */ +static int find_bd_holder(struct block_device *bdev, struct bd_holder *bo) +{ + struct bd_holder *tmp; + + list_for_each_entry(tmp, &bdev->bd_holder_list, list) + if (tmp->sdir == bo->sdir) { + tmp->count++; + return tmp; + } + + return NULL; +} + /** * add_bd_holder - create sysfs symlinks for bd_claim() relationship * * @bdev: block device to be bd_claimed * @bo: preallocated and initialized by alloc_bd_holder() * - * If there is no matching entry with @bo in @bdev->bd_holder_list, - * add @bo to the list, create symlinks. + * Add @bo to @bdev->bd_holder_list, create symlinks. * - * Returns 0 if symlinks are created or already there. - * Returns -ve if something fails and @bo can be freed. + * Returns 0 if symlinks are created. + * Returns -ve if something fails. */ static int add_bd_holder(struct block_device *bdev, struct bd_holder *bo) { @@ -661,15 +683,6 @@ static int add_bd_holder(struct block_device *bdev, struct bd_holder *bo) if (!bo) return -EINVAL; - list_for_each_entry(tmp, &bdev->bd_holder_list, list) { - if (tmp->sdir == bo->sdir) { - tmp->count++; - /* We've already done what we need to do here. */ - free_bd_holder(bo); - return 0; - } - } - if (!bd_holder_grab_dirs(bdev, bo)) return -EBUSY; @@ -740,7 +753,7 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder, struct kobject *kobj) { int res; - struct bd_holder *bo; + struct bd_holder *bo, *found; if (!kobj) return -EINVAL; @@ -752,11 +765,15 @@ static int bd_claim_by_kobject(struct block_device *bdev, void *holder, mutex_lock_nested(&bdev->bd_mutex, BD_MUTEX_PARTITION); res = bd_claim(bdev, holder); if (res == 0) { - res = add_bd_holder(bdev, bo); - if (res) - bd_release(bdev); + found = find_bd_holder(bdev, bo); + if (found == NULL) { + res = add_bd_holder(bdev, bo); + if (res) + bd_release(bdev); + } } - if (res) + + if (res || found) free_bd_holder(bo); mutex_unlock(&bdev->bd_mutex); -- cgit v1.2.3 From 36a561d6a95c4b89ae4845bf91456b4f784b6eec Mon Sep 17 00:00:00 2001 From: Andrew Morton Date: Mon, 30 Oct 2006 22:07:03 -0800 Subject: [PATCH] find_bd_holder() fix fs/block_dev.c: In function 'find_bd_holder': fs/block_dev.c:666: warning: return makes integer from pointer without a cast fs/block_dev.c:669: warning: return makes integer from pointer without a cast fs/block_dev.c: In function 'add_bd_holder': fs/block_dev.c:685: warning: unused variable 'tmp' fs/block_dev.c: In function 'bd_claim_by_kobject': fs/block_dev.c:773: warning: assignment makes pointer from integer without a cast Acked-by: Jun'ichi Nomura Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/block_dev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'fs/block_dev.c') diff --git a/fs/block_dev.c b/fs/block_dev.c index aaa8301f43f..36c0e7af9d0 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -651,7 +651,8 @@ static void free_bd_holder(struct bd_holder *bo) * If found, increment the reference count and return the pointer. * If not found, returns NULL. */ -static int find_bd_holder(struct block_device *bdev, struct bd_holder *bo) +static struct bd_holder *find_bd_holder(struct block_device *bdev, + struct bd_holder *bo) { struct bd_holder *tmp; @@ -677,7 +678,6 @@ static int find_bd_holder(struct block_device *bdev, struct bd_holder *bo) */ static int add_bd_holder(struct block_device *bdev, struct bd_holder *bo) { - struct bd_holder *tmp; int ret; if (!bo) -- cgit v1.2.3