block: Fix NULL pointer dereference in sd_revalidate_disk
authorJun'ichi Nomura <j-nomura@ce.jp.nec.com>
Fri, 2 Mar 2012 09:38:33 +0000 (10:38 +0100)
committerJens Axboe <axboe@kernel.dk>
Fri, 2 Mar 2012 09:38:33 +0000 (10:38 +0100)
commitfe316bf2d5847bc5dd975668671a7b1067603bc7
tree617f6a89b96a8c074d0a2fc1ef4ffc259fb4ed2f
parent621032ad6eaabf2fe771c4fa0d8f58e1fcfcdba6
block: Fix NULL pointer dereference in sd_revalidate_disk

Since 2.6.39 (1196f8b), when a driver returns -ENOMEDIUM for open(),
__blkdev_get() calls rescan_partitions() to remove
in-kernel partition structures and raise KOBJ_CHANGE uevent.

However it ends up calling driver's revalidate_disk without open
and could cause oops.

In the case of SCSI:

  process A                  process B
  ----------------------------------------------
  sys_open
    __blkdev_get
      sd_open
        returns -ENOMEDIUM
                             scsi_remove_device
                               <scsi_device torn down>
      rescan_partitions
        sd_revalidate_disk
          <oops>
Oopses are reported here:
http://marc.info/?l=linux-scsi&m=132388619710052

This patch separates the partition invalidation from rescan_partitions()
and use it for -ENOMEDIUM case.

Reported-by: Huajun Li <huajun.li.lee@gmail.com>
Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
block/partition-generic.c
fs/block_dev.c
include/linux/genhd.h