BUG in blkdev_{get,open}: bdev->bd_op points to unmapped area

From: Alberto Parga Fernández (alb.par@teleline.es)
Date: Tue May 30 2000 - 15:03:38 EST


Hi,

About a month ago, I sent a report to the list with the subject "BUG in
blkdev_get (?)" where I was getting an OOPS trying to mount an empty floppy,
removing the module and doing the mount again.

This bug is present also in 2.4.0-test1-ac4.

<newbie explanation>
The first time you call blkdev_{get,open} for the floppy, bd_op is NULL, so
get_blkfops() is called and loads the module. But if the bdev->bd_op->open()
call fails, as seems to happen a lot with all the floppy problems reported,
bd_op is left pointing to the block_device_operations of the floppy module.
Unload the module, try to access the floppy again, bd_op not NULL and there you
go ...
<\newbie explanation>

A "Works For Me (tm)" patch follows

============== CUT ==============
--- block_dev.c~ Mon May 29 13:46:59 2000
+++ block_dev.c Tue May 30 18:34:48 2000
@@ -597,6 +597,8 @@
     ret = bdev->bd_op->open(fake_inode, &fake_file);
    if (!ret)
     atomic_inc(&bdev->bd_openers);
+ else if (!atomic_read(&bdev->bd_openers))
+ bdev->bd_op = NULL;
    iput(fake_inode);
   }
  }
@@ -617,6 +619,8 @@
    ret = bdev->bd_op->open(inode,filp);
   if (!ret)
    atomic_inc(&bdev->bd_openers);
+ else if (!atomic_read(&bdev->bd_openers))
+ bdev->bd_op = NULL;
  }
  up(&bdev->bd_sem);
  return ret;
============== CUT ==============

I'm not sure if this is correct so I would appreciate a reply

Thanks

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Wed May 31 2000 - 21:00:25 EST