[PATCH] Linux-2.4.18 block MTD dead-lock

[Takeharu KATO]

MTD developers:

 I found a bug relevant to MTD device and Linux-2.4.18.
I post the report about the issue.

P.S. I attach the patch to fix this problem.
    If you have no time to read following report.
    please see this patch.

-- the report --

1. The symptom
 When we was trying to mount MTD-block-device twice,
second mount process fall in dead-locked state. This 
is due not to be able to obtain the semaphore of 
the superblock().

 We met this with Linux-2.4.18 kernel on PPC405GP. 
This issue has never taken place with Linux-2.4.2.


2. The reason 
 We found  this was caused in the release method of 
MTD. In particular, this method indirectly call 
sync_super with calling ``invalidate_device'' 
in this method.

 When the kernel attempt to mount the block device,
it call ``get_sb_bdev'' function in fs/super.c. This 
function return the super block information to caller 
and this function perform following operations.

       Step1.  Open the block device to be mounted.

       Step2.  Obtain semaphore of the super block to
              update super block information.

       Step3.  Search the block device in super block list  
              for mounted devices.

       Step4. If the device has been already mounted, 
             it close the block device using its release 
             method then return the super block information.

       Step5  If the device has not been mounted yet,
             the file system read the super block from 
             the device and return the information.

 The reason of the deadlock is that the process
keep waiting for the semaphore owned by itself 
when it call MTD release method.
 The process has already obtained the semaphore since
the Step2 was performed. 

3. The solution

We changed the sequence of the function called ``get_sb_bdev''
 in fs/super.c.  We changed the function to make the block device 
to be mounted checked before opening the device. 
 Please refer the patch to make out the changes in detail.

-- the report --

Sincerely, yours.

-- 
Takeharu KATO
Fujitsu Limited
Email:tkato at cs.fujitsu.co.jp (ext. 7112-4621)
-------------- next part --------------
--- linux-2.4.18/fs/super.c	Tue Mar 12 15:04:10 2002
+++ linux-2.4.18-getsbfix/fs/super.c	Tue Nov 26 21:58:02 2002
@@ -15,7 +15,7 @@
  *  Added kerneld support: Jacques Gelinas and Bjorn Ekwall
  *  Added change_root: Werner Almesberger & Hans Lermen, Feb '96
  *  Added options to /proc/mounts:
- *    Torbjörn Lindh (torbjorn.lindh at gopta.se), April 14, 1996.
+ *    Torbj-Aörn Lindh (torbjorn.lindh at gopta.se), April 14, 1996.$)B
  *  Added devfs support: Richard Gooch <rgooch at atnf.csiro.au>, 13-JAN-1998
  *  Heavily rewritten for 'one fs - one tree' dcache architecture. AV, Mar 2000
  */
@@ -645,21 +645,16 @@
 	dev = to_kdev_t(bdev->bd_dev);
 	if (!(flags & MS_RDONLY))
 		mode |= FMODE_WRITE;
-	error = blkdev_get(bdev, mode, 0, BDEV_FS);
-	devfs_put_ops (de);   /*  Decrement module use count now we're safe  */
-	if (error)
-		goto out;
 	check_disk_change(dev);
 	error = -EACCES;
 	if (!(flags & MS_RDONLY) && is_read_only(dev)) {
-		blkdev_put(bdev, BDEV_FS);
+		devfs_put_ops (de);   /*  Decrement module use count   */
 		goto out;
 	}
-
 	error = -ENOMEM;
 	s = alloc_super();
 	if (!s) {
-		blkdev_put(bdev, BDEV_FS);
+		devfs_put_ops (de);   /*  Decrement module use count   */
 		goto out;
 	}
 
@@ -675,16 +670,24 @@
 		    ((flags ^ old->s_flags) & MS_RDONLY)) {
 			spin_unlock(&sb_lock);
 			destroy_super(s);
-			blkdev_put(bdev, BDEV_FS);
+		devfs_put_ops (de);   /*  Decrement module use count   */
 			goto out;
 		}
 		if (!grab_super(old))
 			goto restart;
 		destroy_super(s);
-		blkdev_put(bdev, BDEV_FS);
+		devfs_put_ops (de);   /*  Decrement module use count   */
 		path_release(&nd);
 		return old;
 	}
+	/*
+	 * 2002.11.08 moved by T. KATO  
+	 * To make MTD worked.
+	 */
+	error = blkdev_get(bdev, mode, 0, BDEV_FS);
+	devfs_put_ops (de);   /*  Decrement module use count now we're safe  */
+	if (error)
+		goto out;
 	s->s_dev = dev;
 	s->s_bdev = bdev;
 	s->s_flags = flags;