linux-kernel - [PATCH UPDATED 1/5] mtd: fix bdev exclusive open bugs in block2mtd::add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4CDE6FAA.9030605@kernel.org>
Date:	Sat, 13 Nov 2010 11:59:54 +0100
From:	Tejun Heo <tj@...nel.org>
To:	axboe@...nel.dk, dedekind1@...il.com
CC:	hch@...radead.org, linux-kernel@...r.kernel.org, petero2@...ia.com,
	schwidefsky@...ibm.com, heiko.carstens@...ibm.com, jack@...e.cz,
	akpm@...ux-foundation.org, adilger.kernel@...ger.ca, tytso@....edu,
	mfasheh@...e.com, joel.becker@...cle.com, aelder@....com,
	dm-devel@...hat.com, drbd-dev@...ts.linbit.com, neilb@...e.de,
	leochen@...adcom.com, sbranden@...adcom.com,
	chris.mason@...cle.com, swhiteho@...hat.com,
	shaggy@...ux.vnet.ibm.com, joern@...fs.org,
	konishi.ryusuke@....ntt.co.jp, reiserfs-devel@...r.kernel.org,
	viro@...iv.linux.org.uk, linux-mtd@...ts.infradead.org
Subject: [PATCH UPDATED 1/5] mtd: fix bdev exclusive open bugs in block2mtd::add_device()

There are two bdev exclusive open bugs.

* open_bdev_exclusive() must not be called with NULL holder.  Use dev
  as the holder.

* open_by_devnum() doesn't open the bdev exclusively but
  block2mtd_free_device() always assumes it.  Explicitly claim the
  bdev.

The latter is rather clumsy but will be simplified with future
blkdev_get/put() cleanups.

- Updated to use local variable @mode to cache FMODE_* masks as
  suggested by Artem Bityutskiy.

Signed-off-by: Tejun Heo <tj@...nel.org>
Cc: linux-mtd@...ts.infradead.org
Cc: Artem Bityutskiy <dedekind1@...il.com>
---

This change will cause two conflicts in the series.  I'm not reposting
them now as they're mostly trivial.  Git tree is fully updated.

 git://git.kernel.org/pub/scm/linux/kernel/git/tj/misc.git cleanup-bd_claim

Jens, please let me know when/if you want the full series reposted.

Thanks.

 drivers/mtd/devices/block2mtd.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

Index: work/drivers/mtd/devices/block2mtd.c
===================================================================
--- work.orig/drivers/mtd/devices/block2mtd.c
+++ work/drivers/mtd/devices/block2mtd.c
@@ -234,6 +234,7 @@ static void block2mtd_free_device(struct
 /* FIXME: ensure that mtd->size % erase_size == 0 */
 static struct block2mtd_dev *add_device(char *devname, int erase_size)
 {
+	const fmode_t mode = FMODE_READ | FMODE_WRITE;
 	struct block_device *bdev;
 	struct block2mtd_dev *dev;
 	char *name;
@@ -246,7 +247,7 @@ static struct block2mtd_dev *add_device(
 		return NULL;

 	/* Get a handle on the device */
-	bdev = open_bdev_exclusive(devname, FMODE_READ|FMODE_WRITE, NULL);
+	bdev = open_bdev_exclusive(devname, mode, dev);
 #ifndef MODULE
 	if (IS_ERR(bdev)) {

@@ -255,7 +256,15 @@ static struct block2mtd_dev *add_device(

 		dev_t devt = name_to_dev_t(devname);
 		if (devt) {
-			bdev = open_by_devnum(devt, FMODE_WRITE | FMODE_READ);
+			bdev = open_by_devnum(devt, mode);
+			if (!IS_ERR(bdev)) {
+				int ret;
+				ret = bd_claim(bdev, dev);
+				if (ret) {
+					blkdev_put(bdev, mode);
+					bdev = ERR_PTR(ret);
+				}
+			}
 		}
 	}
 #endif
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/