mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: nd->inode is not set on the second attempt in path_walk() unfuck proc_sysctl ->d_compare() minimal fix for do_filp_open() race
This commit is contained in:
commit
78833dd706
5 changed files with 42 additions and 16 deletions
14
fs/namei.c
14
fs/namei.c
|
@ -1546,6 +1546,7 @@ static int path_walk(const char *name, struct nameidata *nd)
|
|||
/* nd->path had been dropped */
|
||||
current->total_link_count = 0;
|
||||
nd->path = save;
|
||||
nd->inode = save.dentry->d_inode;
|
||||
path_get(&nd->path);
|
||||
nd->flags |= LOOKUP_REVAL;
|
||||
result = link_path_walk(name, nd);
|
||||
|
@ -2455,22 +2456,29 @@ struct file *do_filp_open(int dfd, const char *pathname,
|
|||
/* !O_CREAT, simple open */
|
||||
error = do_path_lookup(dfd, pathname, flags, &nd);
|
||||
if (unlikely(error))
|
||||
goto out_filp;
|
||||
goto out_filp2;
|
||||
error = -ELOOP;
|
||||
if (!(nd.flags & LOOKUP_FOLLOW)) {
|
||||
if (nd.inode->i_op->follow_link)
|
||||
goto out_path;
|
||||
goto out_path2;
|
||||
}
|
||||
error = -ENOTDIR;
|
||||
if (nd.flags & LOOKUP_DIRECTORY) {
|
||||
if (!nd.inode->i_op->lookup)
|
||||
goto out_path;
|
||||
goto out_path2;
|
||||
}
|
||||
audit_inode(pathname, nd.path.dentry);
|
||||
filp = finish_open(&nd, open_flag, acc_mode);
|
||||
out2:
|
||||
release_open_intent(&nd);
|
||||
return filp;
|
||||
|
||||
out_path2:
|
||||
path_put(&nd.path);
|
||||
out_filp2:
|
||||
filp = ERR_PTR(error);
|
||||
goto out2;
|
||||
|
||||
creat:
|
||||
/* OK, have to create the file. Find the parent. */
|
||||
error = path_init_rcu(dfd, pathname,
|
||||
|
|
|
@ -27,6 +27,7 @@
|
|||
static void proc_evict_inode(struct inode *inode)
|
||||
{
|
||||
struct proc_dir_entry *de;
|
||||
struct ctl_table_header *head;
|
||||
|
||||
truncate_inode_pages(&inode->i_data, 0);
|
||||
end_writeback(inode);
|
||||
|
@ -38,8 +39,11 @@ static void proc_evict_inode(struct inode *inode)
|
|||
de = PROC_I(inode)->pde;
|
||||
if (de)
|
||||
pde_put(de);
|
||||
if (PROC_I(inode)->sysctl)
|
||||
sysctl_head_put(PROC_I(inode)->sysctl);
|
||||
head = PROC_I(inode)->sysctl;
|
||||
if (head) {
|
||||
rcu_assign_pointer(PROC_I(inode)->sysctl, NULL);
|
||||
sysctl_head_put(head);
|
||||
}
|
||||
}
|
||||
|
||||
struct vfsmount *proc_mnt;
|
||||
|
|
|
@ -408,15 +408,18 @@ static int proc_sys_compare(const struct dentry *parent,
|
|||
const struct dentry *dentry, const struct inode *inode,
|
||||
unsigned int len, const char *str, const struct qstr *name)
|
||||
{
|
||||
struct ctl_table_header *head;
|
||||
/* Although proc doesn't have negative dentries, rcu-walk means
|
||||
* that inode here can be NULL */
|
||||
/* AV: can it, indeed? */
|
||||
if (!inode)
|
||||
return 0;
|
||||
return 1;
|
||||
if (name->len != len)
|
||||
return 1;
|
||||
if (memcmp(name->name, str, len))
|
||||
return 1;
|
||||
return !sysctl_is_seen(PROC_I(inode)->sysctl);
|
||||
head = rcu_dereference(PROC_I(inode)->sysctl);
|
||||
return !head || !sysctl_is_seen(head);
|
||||
}
|
||||
|
||||
static const struct dentry_operations proc_sys_dentry_operations = {
|
||||
|
|
|
@ -25,6 +25,7 @@
|
|||
#include <linux/kernel.h>
|
||||
#include <linux/types.h>
|
||||
#include <linux/compiler.h>
|
||||
#include <linux/rcupdate.h>
|
||||
|
||||
struct completion;
|
||||
|
||||
|
@ -1037,10 +1038,15 @@ struct ctl_table_root {
|
|||
struct ctl_table trees. */
|
||||
struct ctl_table_header
|
||||
{
|
||||
struct ctl_table *ctl_table;
|
||||
struct list_head ctl_entry;
|
||||
int used;
|
||||
int count;
|
||||
union {
|
||||
struct {
|
||||
struct ctl_table *ctl_table;
|
||||
struct list_head ctl_entry;
|
||||
int used;
|
||||
int count;
|
||||
};
|
||||
struct rcu_head rcu;
|
||||
};
|
||||
struct completion *unregistering;
|
||||
struct ctl_table *ctl_table_arg;
|
||||
struct ctl_table_root *root;
|
||||
|
|
|
@ -194,9 +194,9 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
|
|||
static struct ctl_table root_table[];
|
||||
static struct ctl_table_root sysctl_table_root;
|
||||
static struct ctl_table_header root_table_header = {
|
||||
.count = 1,
|
||||
{{.count = 1,
|
||||
.ctl_table = root_table,
|
||||
.ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),
|
||||
.ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),}},
|
||||
.root = &sysctl_table_root,
|
||||
.set = &sysctl_table_root.default_set,
|
||||
};
|
||||
|
@ -1567,11 +1567,16 @@ void sysctl_head_get(struct ctl_table_header *head)
|
|||
spin_unlock(&sysctl_lock);
|
||||
}
|
||||
|
||||
static void free_head(struct rcu_head *rcu)
|
||||
{
|
||||
kfree(container_of(rcu, struct ctl_table_header, rcu));
|
||||
}
|
||||
|
||||
void sysctl_head_put(struct ctl_table_header *head)
|
||||
{
|
||||
spin_lock(&sysctl_lock);
|
||||
if (!--head->count)
|
||||
kfree(head);
|
||||
call_rcu(&head->rcu, free_head);
|
||||
spin_unlock(&sysctl_lock);
|
||||
}
|
||||
|
||||
|
@ -1948,10 +1953,10 @@ void unregister_sysctl_table(struct ctl_table_header * header)
|
|||
start_unregistering(header);
|
||||
if (!--header->parent->count) {
|
||||
WARN_ON(1);
|
||||
kfree(header->parent);
|
||||
call_rcu(&header->parent->rcu, free_head);
|
||||
}
|
||||
if (!--header->count)
|
||||
kfree(header);
|
||||
call_rcu(&header->rcu, free_head);
|
||||
spin_unlock(&sysctl_lock);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue