mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 19:00:25 +00:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull vfs fixes from Al Viro: "stable fodder; assorted deadlock fixes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: vt: synchronize_rcu() under spinlock is not nice... Nest rename_lock inside vfsmount_lock Don't bother with redoing rw_verify_area() from default_file_splice_from()
This commit is contained in:
commit
de55eb1d60
5 changed files with 48 additions and 8 deletions
|
@ -93,7 +93,7 @@ vcs_poll_data_free(struct vcs_poll_data *poll)
|
|||
static struct vcs_poll_data *
|
||||
vcs_poll_data_get(struct file *file)
|
||||
{
|
||||
struct vcs_poll_data *poll = file->private_data;
|
||||
struct vcs_poll_data *poll = file->private_data, *kill = NULL;
|
||||
|
||||
if (poll)
|
||||
return poll;
|
||||
|
@ -122,10 +122,12 @@ vcs_poll_data_get(struct file *file)
|
|||
file->private_data = poll;
|
||||
} else {
|
||||
/* someone else raced ahead of us */
|
||||
vcs_poll_data_free(poll);
|
||||
kill = poll;
|
||||
poll = file->private_data;
|
||||
}
|
||||
spin_unlock(&file->f_lock);
|
||||
if (kill)
|
||||
vcs_poll_data_free(kill);
|
||||
|
||||
return poll;
|
||||
}
|
||||
|
|
16
fs/dcache.c
16
fs/dcache.c
|
@ -2542,7 +2542,6 @@ static int prepend_path(const struct path *path,
|
|||
bool slash = false;
|
||||
int error = 0;
|
||||
|
||||
br_read_lock(&vfsmount_lock);
|
||||
while (dentry != root->dentry || vfsmnt != root->mnt) {
|
||||
struct dentry * parent;
|
||||
|
||||
|
@ -2572,8 +2571,6 @@ static int prepend_path(const struct path *path,
|
|||
if (!error && !slash)
|
||||
error = prepend(buffer, buflen, "/", 1);
|
||||
|
||||
out:
|
||||
br_read_unlock(&vfsmount_lock);
|
||||
return error;
|
||||
|
||||
global_root:
|
||||
|
@ -2590,7 +2587,7 @@ static int prepend_path(const struct path *path,
|
|||
error = prepend(buffer, buflen, "/", 1);
|
||||
if (!error)
|
||||
error = is_mounted(vfsmnt) ? 1 : 2;
|
||||
goto out;
|
||||
return error;
|
||||
}
|
||||
|
||||
/**
|
||||
|
@ -2617,9 +2614,11 @@ char *__d_path(const struct path *path,
|
|||
int error;
|
||||
|
||||
prepend(&res, &buflen, "\0", 1);
|
||||
br_read_lock(&vfsmount_lock);
|
||||
write_seqlock(&rename_lock);
|
||||
error = prepend_path(path, root, &res, &buflen);
|
||||
write_sequnlock(&rename_lock);
|
||||
br_read_unlock(&vfsmount_lock);
|
||||
|
||||
if (error < 0)
|
||||
return ERR_PTR(error);
|
||||
|
@ -2636,9 +2635,11 @@ char *d_absolute_path(const struct path *path,
|
|||
int error;
|
||||
|
||||
prepend(&res, &buflen, "\0", 1);
|
||||
br_read_lock(&vfsmount_lock);
|
||||
write_seqlock(&rename_lock);
|
||||
error = prepend_path(path, &root, &res, &buflen);
|
||||
write_sequnlock(&rename_lock);
|
||||
br_read_unlock(&vfsmount_lock);
|
||||
|
||||
if (error > 1)
|
||||
error = -EINVAL;
|
||||
|
@ -2702,11 +2703,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
|
|||
return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
|
||||
|
||||
get_fs_root(current->fs, &root);
|
||||
br_read_lock(&vfsmount_lock);
|
||||
write_seqlock(&rename_lock);
|
||||
error = path_with_deleted(path, &root, &res, &buflen);
|
||||
write_sequnlock(&rename_lock);
|
||||
br_read_unlock(&vfsmount_lock);
|
||||
if (error < 0)
|
||||
res = ERR_PTR(error);
|
||||
write_sequnlock(&rename_lock);
|
||||
path_put(&root);
|
||||
return res;
|
||||
}
|
||||
|
@ -2830,6 +2833,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
|
|||
get_fs_root_and_pwd(current->fs, &root, &pwd);
|
||||
|
||||
error = -ENOENT;
|
||||
br_read_lock(&vfsmount_lock);
|
||||
write_seqlock(&rename_lock);
|
||||
if (!d_unlinked(pwd.dentry)) {
|
||||
unsigned long len;
|
||||
|
@ -2839,6 +2843,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
|
|||
prepend(&cwd, &buflen, "\0", 1);
|
||||
error = prepend_path(&pwd, &root, &cwd, &buflen);
|
||||
write_sequnlock(&rename_lock);
|
||||
br_read_unlock(&vfsmount_lock);
|
||||
|
||||
if (error < 0)
|
||||
goto out;
|
||||
|
@ -2859,6 +2864,7 @@ SYSCALL_DEFINE2(getcwd, char __user *, buf, unsigned long, size)
|
|||
}
|
||||
} else {
|
||||
write_sequnlock(&rename_lock);
|
||||
br_read_unlock(&vfsmount_lock);
|
||||
}
|
||||
|
||||
out:
|
||||
|
|
|
@ -125,3 +125,8 @@ extern int invalidate_inodes(struct super_block *, bool);
|
|||
* dcache.c
|
||||
*/
|
||||
extern struct dentry *__d_alloc(struct super_block *, const struct qstr *);
|
||||
|
||||
/*
|
||||
* read_write.c
|
||||
*/
|
||||
extern ssize_t __kernel_write(struct file *, const char *, size_t, loff_t *);
|
||||
|
|
|
@ -17,6 +17,7 @@
|
|||
#include <linux/splice.h>
|
||||
#include <linux/compat.h>
|
||||
#include "read_write.h"
|
||||
#include "internal.h"
|
||||
|
||||
#include <asm/uaccess.h>
|
||||
#include <asm/unistd.h>
|
||||
|
@ -417,6 +418,30 @@ ssize_t do_sync_write(struct file *filp, const char __user *buf, size_t len, lof
|
|||
|
||||
EXPORT_SYMBOL(do_sync_write);
|
||||
|
||||
ssize_t __kernel_write(struct file *file, const char *buf, size_t count, loff_t *pos)
|
||||
{
|
||||
mm_segment_t old_fs;
|
||||
const char __user *p;
|
||||
ssize_t ret;
|
||||
|
||||
old_fs = get_fs();
|
||||
set_fs(get_ds());
|
||||
p = (__force const char __user *)buf;
|
||||
if (count > MAX_RW_COUNT)
|
||||
count = MAX_RW_COUNT;
|
||||
if (file->f_op->write)
|
||||
ret = file->f_op->write(file, p, count, pos);
|
||||
else
|
||||
ret = do_sync_write(file, p, count, pos);
|
||||
set_fs(old_fs);
|
||||
if (ret > 0) {
|
||||
fsnotify_modify(file);
|
||||
add_wchar(current, ret);
|
||||
}
|
||||
inc_syscw(current);
|
||||
return ret;
|
||||
}
|
||||
|
||||
ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)
|
||||
{
|
||||
ssize_t ret;
|
||||
|
|
|
@ -31,6 +31,7 @@
|
|||
#include <linux/security.h>
|
||||
#include <linux/gfp.h>
|
||||
#include <linux/socket.h>
|
||||
#include "internal.h"
|
||||
|
||||
/*
|
||||
* Attempt to steal a page from a pipe buffer. This should perhaps go into
|
||||
|
@ -1048,9 +1049,10 @@ static int write_pipe_buf(struct pipe_inode_info *pipe, struct pipe_buffer *buf,
|
|||
{
|
||||
int ret;
|
||||
void *data;
|
||||
loff_t tmp = sd->pos;
|
||||
|
||||
data = buf->ops->map(pipe, buf, 0);
|
||||
ret = kernel_write(sd->u.file, data + buf->offset, sd->len, sd->pos);
|
||||
ret = __kernel_write(sd->u.file, data + buf->offset, sd->len, &tmp);
|
||||
buf->ops->unmap(pipe, buf, data);
|
||||
|
||||
return ret;
|
||||
|
|
Loading…
Reference in a new issue