linux/drivers/mtd/mtd_blkdevs.c, branch v3.0.72

mtd: mtd_blkdevs: don't increase 'open' count on error path

2012-01-26T01:24:32Z

commit 342ff28f5a2e5aa3236617bd2bddf6c749677ef2 upstream. Some error paths in mtd_blkdevs were fixed in the following commit: commit 94735ec4044a6d318b83ad3c5794e931ed168d10 mtd: mtd_blkdevs: fix error path in blktrans_open But on these error paths, the block device's `dev->open' count is already incremented before we check for errors. This meant that, while the error path was handled correctly on the first time through blktrans_open(), the device is erroneously considered already open on the second time through. This problem can be seen, for instance, when a UBI volume is simultaneously mounted as a UBIFS partition and read through its corresponding gluebi mtdblockX device. This results in blktrans_open() passing its error checks (with `dev->open > 0') without actually having a handle on the device. Here's a summarized log of the actions and results with nandsim: # modprobe nandsim # modprobe mtdblock # modprobe gluebi # modprobe ubifs # ubiattach /dev/ubi_ctrl -m 0 ... # ubimkvol /dev/ubi0 -N test -s 16MiB ... # mount -t ubifs ubi0:test /mnt # ls /dev/mtdblock* /dev/mtdblock0 /dev/mtdblock1 # cat /dev/mtdblock1 > /dev/null cat: can't open '/dev/mtdblock4': Device or resource busy # cat /dev/mtdblock1 > /dev/null CPU 0 Unable to handle kernel paging request at virtual address fffffff0, epc == 8031536c, ra == 8031f280 Oops[#1]: ... Call Trace: [<8031536c>] ubi_leb_read+0x14/0x164 [<8031f280>] gluebi_read+0xf0/0x148 [<802edba8>] mtdblock_readsect+0x64/0x198 [<802ecfe4>] mtd_blktrans_thread+0x330/0x3f4 [<8005be98>] kthread+0x88/0x90 [<8000bc04>] kernel_thread_helper+0x10/0x18 Signed-off-by: Brian Norris Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Signed-off-by: Greg Kroah-Hartman

mtd: mtd_blkdevs: fix error path in blktrans_open

2011-05-25T00:53:45Z

The 'blktrans_open()' does not handle possible '__get_mtd_device()' failures because it does not check the error code. Moreover, the 'dev->tr->open()' failures are not handled correctly because in this case the function just goes ahead and gets the mtd device, then returns an error. But Instead, it should _not_ try to get the mtd device, then it should put back the module and the kref. This patch fixes the issue. Note, I only compile-tested it. This patch was inspired by a bug report about a similar issue in 2.6.34 kernels sent by Mike Turner to the MTD mailing list: http://lists.infradead.org/pipermail/linux-mtd/2011-April/034980.html Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-linus-1

2011-03-25T15:41:20Z

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6: (9356 commits) [media] rc: update for bitop name changes fs: simplify iget & friends fs: pull inode->i_lock up out of writeback_single_inode fs: rename inode_lock to inode_hash_lock fs: move i_wb_list out from under inode_lock fs: move i_sb_list out from under inode_lock fs: remove inode_lock from iput_final and prune_icache fs: Lock the inode LRU list separately fs: factor inode disposal fs: protect inode->i_state with inode->i_lock lib, arch: add filter argument to show_mem and fix private implementations SLUB: Write to per cpu data when allocating it slub: Fix debugobjects with lockless fastpath autofs4: Do not potentially dereference NULL pointer returned by fget() in autofs_dev_ioctl_setpipefd() autofs4 - remove autofs4_lock autofs4 - fix d_manage() return on rcu-walk autofs4 - fix autofs4_expire_indirect() traversal autofs4 - fix dentry leak in autofs4_expire_direct() autofs4 - reinstate last used update on access vfs - check non-mountpoint dentry might block in __follow_mount_rcu() ... NOTE! This merge commit was created to fix compilation error. The block tree was merged upstream and removed the 'elv_queue_empty()' function which the new 'mtdswap' driver is using. So a simple merge of the mtd tree with upstream does not compile. And the mtd tree has already be published, so re-basing it is not an option. To fix this unfortunate situation, I had to merge upstream into the mtd-2.6.git tree without committing, put the fixup patch on top of this, and then commit this. The result is that we do not have commits which do not compile. In other words, this merge commit "merges" 3 things: the MTD tree, the upstream tree, and the fixup patch.

mtd_blkdevs: Set the maximum discards size

2011-03-11T14:22:46Z

Set max_discard_sectors to UINT_MAX. Signed-off-by: Jarkko Lavinen Tested-by: Artem Bityutskiy Signed-off-by: David Woodhouse

mtd_blkdevs: Add background processing support

2011-03-11T14:22:46Z

Add a new background method into mtd_blktrans_ops, add background support into mtd_blktrans_thread(), and add mtd_blktrans_cease_background(). If the mtd blktrans dev has the background support, the thread will call background function when the request queue becomes empty. The background operation may run as long as needs to until mtd_blktrans_cease_background() tells to stop. Signed-off-by: Jarkko Lavinen Tested-by: Artem Bityutskiy Signed-off-by: David Woodhouse

mtd: mtd_blkdevs: local symbols should be static

2011-03-11T14:22:42Z

The function blktrans_dev_release and blktrans_dev_put are only used locally in this file and should be static. Signed-off-by: H Hartley Sweeten Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse

mtd: mtd_blkdevs: fix double free on error path

2011-03-11T14:19:44Z

This one liner patch fixes double free that will occur if add_mtd_blktrans_dev fails. On failure it frees the input argument, but all its users also free it on error which is natural thing to do. Thus don't free it. All credit for finding that bug belongs to reporters of the bug in the android bugzilla http://code.google.com/p/android/issues/detail?id=13761 Commit message tweaked by Artem. Signed-off-by: Maxim Levitsky Signed-off-by: Artem Bityutskiy Signed-off-by: David Woodhouse Cc: stable@kernel.org

mtd: Remove redundant mutex from mtd_blkdevs.c

2010-10-30T11:39:21Z

In commit 2a48fc0ab24241755dc93bfd4f01d68efab47f5a ('block: autoconvert trivial BKL users to private mutex'), Arnd replaced the BKL usage with a mutex. However, Maxim has already provided a better fix in commit 480792b7bf188c29b8d4b10fee65c3a06ec5dbf7 ('mtd: blktrans: kill BKL'), which was simply to remove the BKL without replacing it — since he'd already made it do all necessary locking for itself. Signed-off-by: David Woodhouse

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git

2010-10-30T11:35:11Z

Conflicts: drivers/mtd/mtd_blkdevs.c Merge Grant's device-tree bits so that we can apply the subsequent fixes. Signed-off-by: David Woodhouse

MTD: Fix wrong check register_blkdev return value

2010-10-30T11:30:50Z

register_blkdev return 1..255 when major = 0. if (ret ) { printk(KERN_WARNING "Unable to register %s block device on major %d: %d\n", tr->name, tr->major, ret); mutex_unlock(&mtd_table_mutex); return ret; } Above code will return fail when register_blkdev return allocated major number. Signed-off-by: Frank Li Signed-off-by: David Woodhouse