From: Andrew Morton <akpm@linux-foundation.org>
Date: Sat, 6 Sep 2008 01:10:03 +0000 (+0000)
Subject: drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()
X-Git-Tag: v2.6.26.6~68
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4fa9a2f9e5ad0171b890ecea3433276e66bc8353;p=thirdparty%2Fkernel%2Fstable.git

drivers/mmc/card/block.c: fix refcount leak in mmc_block_open()

commit 70bb08962ea9bd50797ae9f16b2493f5f7c65053 upstream

mmc_block_open() increments md->usage although it returns with -EROFS when
default mounting a MMC/SD card with write protect switch on.  This
reference counting bug prevents /dev/mmcblkX from being released on card
removal, and situation worsen with reinsertion until the minor number
range runs out.

Reported-by: <sasin@solomon-systech.com>
Acked-by: Pierre Ossman <drzeus-list@drzeus.cx>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index f9ad960d7c1a6..55a104dd83470 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -103,8 +103,10 @@ static int mmc_blk_open(struct inode *inode, struct file *filp)
 			check_disk_change(inode->i_bdev);
 		ret = 0;
 
-		if ((filp->f_mode & FMODE_WRITE) && md->read_only)
+		if ((filp->f_mode & FMODE_WRITE) && md->read_only) {
+			mmc_blk_put(md);
 			ret = -EROFS;
+		}
 	}
 
 	return ret;