Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce23bba8 authored by Tejun Heo's avatar Tejun Heo Committed by Linus Torvalds
Browse files

block: fix synchronization and limit check in blk_alloc_devt() 



idr allocation in blk_alloc_devt() wasn't synchronized against lookup
and removal, and its limit check was off by one - 1 << MINORBITS is
the number of minors allowed, not the maximum allowed minor.

Add locking and rename MAX_EXT_DEVT to NR_EXT_DEVT and fix limit
checking.

Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Acked-by: default avatarJens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d5c7409f

block/genhd.c

+5 −8
Original line number Diff line number Diff line
@@ -26,7 +26,7 @@ static DEFINE_MUTEX(block_class_lock); 
struct kobject *block_depr;



/* for extended dynamic devt allocation, currently only one major is used */

#define MAX_EXT_DEVT		(1 << MINORBITS)

#define NR_EXT_DEVT		(1 << MINORBITS)



/* For extended devt allocation.  ext_devt_mutex prevents look up

 * results from going away underneath its user.
@@ -425,19 +425,16 @@ int blk_alloc_devt(struct hd_struct *part, dev_t *devt) 
			return -ENOMEM;

		mutex_lock(&ext_devt_mutex);

		rc = idr_get_new(&ext_devt_idr, part, &idx);

		if (!rc && idx >= NR_EXT_DEVT) {

			idr_remove(&ext_devt_idr, idx);

			rc = -EBUSY;

		}

		mutex_unlock(&ext_devt_mutex);

	} while (rc == -EAGAIN);



	if (rc)

		return rc;



	if (idx > MAX_EXT_DEVT) {

		mutex_lock(&ext_devt_mutex);

		idr_remove(&ext_devt_idr, idx);

		mutex_unlock(&ext_devt_mutex);

		return -EBUSY;

	}



	*devt = MKDEV(BLOCK_EXT_MAJOR, blk_mangle_minor(idx));

	return 0;

}