• Andrew Morton's avatar
    [PATCH] raw.c: dev_t cleanup and oops fix · 0fff81de
    Andrew Morton authored
    Patch from Andries.Brouwer@cwi.nl
    
    The next patch in the dev_t series eliminates the last applied use
    of MAX_BLKDEV - only the definition in major.h remains.
    
    Sneaky as I am, I combine this patch with the fix for an Oops:
    On open, raw_open does
    	filp->f_dentry->d_inode->i_mapping =
    		bdev->bd_inode->i_mapping;
    storing a pointer to bdev stuff.
    But on release this pointer stayed, the block device is not
    referenced anymore and disappears, and the next open references
    undefined stuff.
    I checked, and this can actually cause an Oops - scenario:
    
      # raw /dev/raw/raw12 /dev/hdf
      # dd if=/dev/raw/raw12 of=/dev/null bs=512 count=1
      # raw /dev/raw/raw12 0 0
      # dd if=/dev/raw/raw12 of=/dev/null bs=512 count=1
    
    Oops.
    
    More precisely the problem is that dentry_open does
    file_ra_state_init(&f->f_ra, inode->i_mapping);
    And file_ra_state_init uses mapping->backing_dev_info->ra_pages.
    Ugly, to use so much information about the inode even before
    the inode has been opened.
    
    In the patch below I reset i_mapping upon release of the raw device.
    
    akpm: I fixed a typo and exported default_backing_dev_info to GPL modules for
    this.
    0fff81de
ksyms.c 16.7 KB