2011-02-24 14:50:11

by Miklos Szeredi

Subject: [PATCH] mm: fix refcounting in swapon

From: Miklos Szeredi <[email protected]>

Grab a reference to bdev before calling blkdev_get(), which expects
the refcount to be already incremented and either returns success or
decrements the refcount and returns an error.

The bug was introduced by e525fd89 (block: make blkdev_get/put()
handle exclusive access), which didn't take into account this behavior
of blkdev_get().

CC: Tejun Heo <[email protected]>
Signed-off-by: Miklos Szeredi <[email protected]>
---
mm/swapfile.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

Index: linux.git/mm/swapfile.c
===================================================================
--- linux.git.orig/mm/swapfile.c 2011-02-24 15:29:26.000000000 +0100
+++ linux.git/mm/swapfile.c 2011-02-24 15:32:31.000000000 +0100
@@ -1940,7 +1940,7 @@ SYSCALL_DEFINE2(swapon, const char __use

error = -EINVAL;
if (S_ISBLK(inode->i_mode)) {
- bdev = I_BDEV(inode);
+ bdev = bdgrab(I_BDEV(inode));
error = blkdev_get(bdev, FMODE_READ | FMODE_WRITE | FMODE_EXCL,
sys_swapon);
if (error < 0) {

2011-02-24 14:55:11

by Tejun Heo

Subject: Re: [PATCH] mm: fix refcounting in swapon

On Thu, Feb 24, 2011 at 03:49:53PM +0100, Miklos Szeredi wrote:
> From: Miklos Szeredi <[email protected]>
>
> Grab a reference to bdev before calling blkdev_get(), which expects
> the refcount to be already incremented and either returns success or
> decrements the refcount and returns an error.
>
> The bug was introduced by e525fd89 (block: make blkdev_get/put()
> handle exclusive access), which didn't take into account this behavior
> of blkdev_get().
>
> CC: Tejun Heo <[email protected]>
> Signed-off-by: Miklos Szeredi <[email protected]>

Acked-by: Tejun Heo <[email protected]>

Thanks.

--
tejun