linux-kernel - Re: mmc/card/block.c : mmc_blk

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080904160808.a23a2197.akpm@linux-foundation.org>
Date:	Thu, 4 Sep 2008 16:08:08 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	<sasin@...omon-systech.com>
Cc:	linux-kernel@...r.kernel.org, Pierre Ossman <drzeus-list@...eus.cx>
Subject: Re: mmc/card/block.c : mmc_blk_open readonly mount bug?

On Thu, 4 Sep 2008 17:17:15 +0800
<sasin@...omon-systech.com> wrote:

> mmc_block_open increments md->usage although it returns with -EROFS when
> default mounting a MMC/SD card with write protect switch on.  This
> reference counting bug prevents /dev/mmcblkX from being released on card
> removal, and situation worsen with reinsertion until the minor number
> range runs out.
> 
> "return -EROFS;"
> 
> should be replaced by
> 
> "
> {
> ret = -EROFS;
> mmc_blk_put(md);
> }
> "

It's unknown what kernel version you're looking at.  The code in 2.6.25
and 2.6.26 and 2.6.27 has changed since then, but the bug appears to
still be there.

From: Andrew Morton <akpm@...ux-foundation.org>

mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on.  This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.

Reported-by: <sasin@...omon-systech.com>
Cc: Pierre Ossman <drzeus-list@...eus.cx>
Cc: <stable@...nel.org>		[2.6.25.x, 2.6.26.x]
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 drivers/mmc/card/block.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff -puN drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open drivers/mmc/card/block.c
--- a/drivers/mmc/card/block.c~drivers-mmc-card-blockc-fix-refcount-leak-in-mmc_block_open
+++ a/drivers/mmc/card/block.c
@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *in
 			check_disk_change(inode->i_bdev);
 		ret = 0;

-		if ((filp->f_mode & FMODE_WRITE) && md->read_only)
+		if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
+			mmc_blk_put(md);
 			ret = -EROFS;
+		}
 	}

 	return ret;
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/