[patch-2.3.99-pre4-2] bugfix, module unload race in MCD driver

From: Tigran Aivazian (tigran@veritas.com)
Date: Fri Mar 31 2000 - 15:02:52 EST


Hi Linus,

This is a fix for the bug that Tim noticed (well, he noticed hundreds of
them).

The problem here is that driver's open routine may block without
having incremented the ref count and so let the module be unloaded - not
nice. The file patched is drivers/cdrom/mcd.c.

Tim, presumably you are updating the list on ftp.redhat.com as you are
fixing them?

Regards,
Tigran.

--- mcd.c.0 Fri Mar 31 20:59:30 2000
+++ mcd.c Fri Mar 31 20:56:13 2000
@@ -1107,26 +1107,33 @@
 static int mcd_open(struct cdrom_device_info * cdi, int purpose)
 {
         int st, count=0;
+
+
         if (mcdPresent == 0)
                 return -ENXIO; /* no hardware */
 
- if (!mcd_open_count && mcd_state == MCD_S_IDLE) {
- mcd_invalidate_buffers();
- do {
- st = statusCmd(); /* check drive status */
- if (st == -1)
- return -EIO; /* drive doesn't respond */
- if ((st & MST_READY) == 0) { /* no disk? wait a sec... */
- current->state = TASK_INTERRUPTIBLE;
- schedule_timeout(HZ);
- }
- } while (((st & MST_READY) == 0) && count++ < MCD_RETRY_ATTEMPTS);
+ MOD_INC_USE_COUNT;
+
+ if (!mcd_open_count && mcd_state == MCD_S_IDLE) {
+ mcd_invalidate_buffers();
+ do {
+ st = statusCmd(); /* check drive status */
+ if (st == -1) {
+ MOD_DEC_USE_COUNT;
+ return -EIO; /* drive doesn't respond */
+ }
+ if ((st & MST_READY) == 0) { /* no disk? wait a sec... */
+ current->state = TASK_INTERRUPTIBLE;
+ schedule_timeout(HZ);
+ }
+ } while (((st & MST_READY) == 0) && count++ < MCD_RETRY_ATTEMPTS);
 
- if (updateToc() < 0)
- return -EIO;
- }
+ if (updateToc() < 0) {
+ MOD_DEC_USE_COUNT;
+ return -EIO;
+ }
+ }
         ++mcd_open_count;
- MOD_INC_USE_COUNT;
         return 0;
 }
 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Fri Mar 31 2000 - 21:00:30 EST