Al Viro [Mon, 17 Jun 2013 11:27:47 +0000 (15:27 +0400)]
eisa_eeprom: switch to fixed_size_llseek()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Mon, 17 Jun 2013 11:23:54 +0000 (15:23 +0400)]
bna: switch to fixed_size_llseek()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 22 Jun 2013 08:10:22 +0000 (12:10 +0400)]
zorro: switch to fixed_size_llseek()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 16:27:42 +0000 (20:27 +0400)]
mtdchar: switch to fixed_size_llseek()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 16:27:42 +0000 (20:27 +0400)]
new helper: fixed_size_llseek()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 16:05:38 +0000 (20:05 +0400)]
ecryptfs: switch ecryptfs_decode_and_decrypt_filename() from dentry to sb
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 16:05:23 +0000 (20:05 +0400)]
fuse: another open-coded file_inode()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 15:32:35 +0000 (19:32 +0400)]
btrfs: more open-coded file_inode()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 15:08:36 +0000 (19:08 +0400)]
fanotify: quit wanking with FASYNC in ->release()
... especially since there's no way to get that sucker
on the list fsnotify_fasync() works with - the only thing
adding to it is fsnotify_fasync() itself and it's never
called for fanotify files while they are opened.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 15:05:07 +0000 (19:05 +0400)]
comedi: quit wanking with FASYNC in ->release()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 16 Jun 2013 13:25:12 +0000 (17:25 +0400)]
more open-coded file_inode() calls
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 07:37:47 +0000 (11:37 +0400)]
kill find_inode_number()
the only remaining caller (in ncpfs) is guaranteed to return 0 -
we only hit it if we'd just checked that there's no dentry with
such name.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 19 Jun 2013 09:21:03 +0000 (13:21 +0400)]
coda: don't bother with find_inode_number()
the fallback it's using for dcache misses is actually the
same value we would've used for inumber anyway.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 07:33:10 +0000 (11:33 +0400)]
proc_fill_cache(): clean up, get rid of pointless find_inode_number() use
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 07:15:20 +0000 (11:15 +0400)]
proc_fill_cache(): just make instantiate_t return int
all instances always return ERR_PTR(-E...) or NULL, anyway
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 06:45:10 +0000 (10:45 +0400)]
proc_pid_readdir(): stop wanking with proc_fill_cache() for /proc/self
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 06:26:35 +0000 (10:26 +0400)]
proc_fill_cache(): kill pointless check
we'd just checked that child->d_inode is non-NULL, for fuck sake!
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 01:53:23 +0000 (05:53 +0400)]
ncpfs: don't bother with EBUSY on removal of busy directories
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 15 Jun 2013 01:49:36 +0000 (05:49 +0400)]
don't call file_pos_write() if vfs_{read,write}{,v}() fails
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
David Howells [Thu, 13 Jun 2013 22:37:55 +0000 (23:37 +0100)]
SELinux: Institute file_path_has_perm()
Create a file_path_has_perm() function that is like path_has_perm() but
instead takes a file struct that is the source of both the path and the
inode (rather than getting the inode from the dentry in the path). This
is then used where appropriate.
This will be useful for situations like unionmount where it will be
possible to have an apparently-negative dentry (eg. a fallthrough) that is
open with the file struct pointing to an inode on the lower fs.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
David Howells [Thu, 13 Jun 2013 22:37:49 +0000 (23:37 +0100)]
Replace a bunch of file->dentry->d_inode refs with file_inode()
Replace a bunch of file->dentry->d_inode refs with file_inode().
In __fput(), use file->f_inode instead so as not to be affected by any tricks
that file_inode() might grow.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 12 Jun 2013 05:35:33 +0000 (09:35 +0400)]
udf: provide ->tmpfile()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 11 Jun 2013 08:52:02 +0000 (12:52 +0400)]
ext3 ->tmpfile() support
In this case we do need a bit more than usual, due to orphan
list handling.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 11 Jun 2013 04:34:36 +0000 (08:34 +0400)]
allow the temp files created by open() to be linked to
O_TMPFILE | O_CREAT => linkat() with AT_SYMLINK_FOLLOW and /proc/self/fd/<n>
as oldpath (i.e. flink()) will create a link
O_TMPFILE | O_CREAT | O_EXCL => ENOENT on attempt to link those guys
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 7 Jun 2013 05:20:27 +0000 (01:20 -0400)]
[O_TMPFILE] it's still short a few helpers, but infrastructure should be OK now...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Tue, 11 Jun 2013 04:23:01 +0000 (08:23 +0400)]
allow build_open_flags() to return an error
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 24 May 2013 00:10:34 +0000 (20:10 -0400)]
lift file_*_write out of do_splice_direct()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 24 May 2013 00:07:11 +0000 (20:07 -0400)]
lift file_*_write out of do_splice_from()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 6 Jun 2013 13:12:33 +0000 (09:12 -0400)]
do_last(): fix missing checks for LAST_BIND case
/proc/self/cwd with O_CREAT should fail with EISDIR. /proc/self/exe, OTOH,
should fail with ENOTDIR when opened with O_DIRECTORY.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 5 Jun 2013 18:09:55 +0000 (14:09 -0400)]
pcm_native: switch to fdget()/fdput()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 May 2013 02:22:04 +0000 (22:22 -0400)]
[readdir] constify ->actor
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 May 2013 01:44:23 +0000 (21:44 -0400)]
[readdir] ->readdir() is gone
everything's converted to ->iterate()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 May 2013 01:23:40 +0000 (21:23 -0400)]
[readdir] convert ecryptfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 May 2013 01:15:30 +0000 (21:15 -0400)]
[readdir] convert coda
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 23 May 2013 01:06:00 +0000 (21:06 -0400)]
[readdir] convert ocfs2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 22:37:16 +0000 (18:37 -0400)]
[readdir] convert fatfs
... pox upon the idiotic ioctls; life would be much easier without
those.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 21:07:56 +0000 (17:07 -0400)]
[readdir] convert xfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 20:48:09 +0000 (16:48 -0400)]
[readdir] convert btrfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 20:34:19 +0000 (16:34 -0400)]
[readdir] convert hostfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 20:31:14 +0000 (16:31 -0400)]
[readdir] convert afs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 19:11:27 +0000 (15:11 -0400)]
[readdir] convert ncpfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 18:59:39 +0000 (14:59 -0400)]
[readdir] convert hfsplus
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 18:29:35 +0000 (14:29 -0400)]
[readdir] convert hfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 17:44:05 +0000 (13:44 -0400)]
[readdir] convert befs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 22 May 2013 20:17:25 +0000 (16:17 -0400)]
[readdir] convert cifs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 07:15:00 +0000 (03:15 -0400)]
[readdir] convert freevxfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 07:03:58 +0000 (03:03 -0400)]
[readdir] convert fuse
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 06:58:57 +0000 (02:58 -0400)]
[readdir] convert hpfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 02:58:58 +0000 (22:58 -0400)]
reiserfs: switch reiserfs_readdir_dentry to inode
... and clean the callers up a bit
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 02:45:29 +0000 (22:45 -0400)]
reiserfs: is_privroot_deh() needs only directory inode, actually
... and that - only to get the superblock. Privroot is a directory
and we don't allow hardlinks to those...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 02:42:17 +0000 (22:42 -0400)]
[readdir] convert reiserfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 01:22:31 +0000 (21:22 -0400)]
[readdir] convert ntfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 18 May 2013 01:11:59 +0000 (21:11 -0400)]
[readdir] convert isofs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 22:08:49 +0000 (18:08 -0400)]
[readdir] convert jffs2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 22:02:17 +0000 (18:02 -0400)]
[readdir] convert f2fs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 21:51:41 +0000 (17:51 -0400)]
[readdir] convert 9p
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 21:44:42 +0000 (17:44 -0400)]
[readdir] convert affs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 21:30:10 +0000 (17:30 -0400)]
[readdir] convert adfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 21:06:34 +0000 (17:06 -0400)]
[readdir] convert logfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 21:00:34 +0000 (17:00 -0400)]
[readdir] convert jfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 20:52:26 +0000 (16:52 -0400)]
[readdir] convert ceph
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 20:34:50 +0000 (16:34 -0400)]
[readdir] convert nfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 20:08:53 +0000 (16:08 -0400)]
[readdir] convert ext4
and trim the living hell out bogosities in inline dir case
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 19:32:10 +0000 (15:32 -0400)]
[readdir] convert qnx6
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 19:17:59 +0000 (15:17 -0400)]
[readdir] convert qnx4
... and use strnlen() instead of strlen() - it's done on untrusted data,
after all.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Fri, 17 May 2013 19:05:25 +0000 (15:05 -0400)]
[readdir] convert omfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 18:36:14 +0000 (14:36 -0400)]
[readdir] convert nilfs2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 18:31:02 +0000 (14:31 -0400)]
[readdir] convert sysfs
get rid of the kludges in sysfs_readdir()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 18:14:48 +0000 (14:14 -0400)]
[readdir] convert gfs2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 17:48:17 +0000 (13:48 -0400)]
[readdir] convert exofs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 17:41:48 +0000 (13:41 -0400)]
[readdir] convert bfs
... and get rid of that ridiculous mutex in bfs_readdir()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 16:07:31 +0000 (12:07 -0400)]
[readdir] convert procfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:52:12 +0000 (01:52 -0400)]
[readdir] convert openpromfs
what the hell is op_mutex for, BTW?
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:41:10 +0000 (01:41 -0400)]
[readdir] convert efs
* sanity checks belong before risky operation, not after it
* don't quit as soon as we'd found an entry
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:28:34 +0000 (01:28 -0400)]
[readdir] convert configfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:22:00 +0000 (01:22 -0400)]
[readdir] convert romfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:17:58 +0000 (01:17 -0400)]
[readdir] convert squashfs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:14:46 +0000 (01:14 -0400)]
[readdir] convert ubifs
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 05:09:37 +0000 (01:09 -0400)]
[readdir] convert udf
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 01:02:48 +0000 (21:02 -0400)]
[readdir] convert ext3
new helper: dir_relax(inode). Call when you are in location that will
_not_ be invalidated by directory modifications (block boundary, in case
of ext*). Returns whether the directory has survived (dropping i_mutex
allows rmdir to kill the sucker; if it returns false to us, ->iterate()
is obviously done)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Thu, 16 May 2013 00:23:06 +0000 (20:23 -0400)]
[readdir] switch dcache_readdir() users to ->iterate()
new helpers - dir_emit_dot(file, ctx, dentry), dir_emit_dotdot(file, ctx),
dir_emit_dots(file, ctx).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 15 May 2013 22:51:49 +0000 (18:51 -0400)]
[readdir] simple local unixlike: switch to ->iterate()
ext2, ufs, minix, sysv
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 15 May 2013 22:49:12 +0000 (18:49 -0400)]
[readdir] introduce ->iterate(), ctx->pos, dir_emit()
New method - ->iterate(file, ctx). That's the replacement for ->readdir();
it takes callback from ctx->actor, uses ctx->pos instead of file->f_pos and
calls dir_emit(ctx, ...) instead of filldir(data, ...). It does *not*
update file->f_pos (or look at it, for that matter); iterate_dir() does the
update.
Note that dir_emit() takes the offset from ctx->pos (and eventually
filldir_t will lose that argument).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Wed, 15 May 2013 17:52:59 +0000 (13:52 -0400)]
[readdir] introduce iterate_dir() and dir_context
iterate_dir(): new helper, replacing vfs_readdir().
struct dir_context: contains the readdir callback (and will get more stuff
in it), embedded into whatever data that callback wants to deal with;
eventually, we'll be passing it to ->readdir() replacement instead of
(data,filldir) pair.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 12 May 2013 14:14:07 +0000 (10:14 -0400)]
move linux/loop.h to drivers/block
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sun, 12 May 2013 14:12:11 +0000 (10:12 -0400)]
compat.c: LOOP_CLR_FD is taken care of in loop.c itself...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:39:26 +0000 (12:39 -0400)]
pxa3xx: VM_IO is set by io_remap_pfn_range()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:38:38 +0000 (12:38 -0400)]
au1100fb: VM_IO is set by io_remap_pfn_range()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:37:38 +0000 (12:37 -0400)]
au1200fb: io_remap_pfn_range() sets VM_IO
... and single return is quite sufficient to get out of function, TYVM
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:33:31 +0000 (12:33 -0400)]
vfio: remap_pfn_range() sets all those flags...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:27:16 +0000 (12:27 -0400)]
i810: VM_IO is set by io_remap_pfn_range()
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:23:17 +0000 (12:23 -0400)]
drm: io_remap_pfn_range() sets VM_IO...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:21:55 +0000 (12:21 -0400)]
sparc: __pci_mmap_set_flags() is useless
io_remap_pfn_range() does all we need
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:19:34 +0000 (12:19 -0400)]
mn10300: don't bother with VM_IO
io_remap_pfn_range() sets it
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:18:01 +0000 (12:18 -0400)]
hose_mmap_page_range(): io_remap_pfn_range() will set all those flags...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:15:47 +0000 (12:15 -0400)]
samsung: don't bother with setting VM_IO
io_remap_pfn_range() will set it just fine
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 11 May 2013 16:13:10 +0000 (12:13 -0400)]
consolidate io_remap_pfn_range definitions
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Artem Bityutskiy [Fri, 28 Jun 2013 11:15:15 +0000 (14:15 +0300)]
UBIFS: fix a horrid bug
Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no
mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are
in the middle of 'ubifs_readdir()'.
This means that 'file->private_data' can be freed while 'ubifs_readdir()' uses
it, and this is a very bad bug: not only 'ubifs_readdir()' can return garbage,
but this may corrupt memory and lead to all kinds of problems like crashes an
security holes.
This patch fixes the problem by using the 'file->f_version' field, which
'->llseek()' always unconditionally sets to zero. We set it to 1 in
'ubifs_readdir()' and whenever we detect that it became 0, we know there was a
seek and it is time to clear the state saved in 'file->private_data'.
I tested this patch by writing a user-space program which runds readdir and
seek in parallell. I could easily crash the kernel without these patches, but
could not crash it with these patches.
Cc: stable@vger.kernel.org
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Artem Bityutskiy [Fri, 28 Jun 2013 11:15:14 +0000 (14:15 +0300)]
UBIFS: prepare to fix a horrid bug
Al Viro pointed me to the fact that '->readdir()' and '->llseek()' have no
mutual exclusion, which means the 'ubifs_dir_llseek()' can be run while we are
in the middle of 'ubifs_readdir()'.
First of all, this means that 'file->private_data' can be freed while
'ubifs_readdir()' uses it. But this particular patch does not fix the problem.
This patch is only a preparation, and the fix will follow next.
In this patch we make 'ubifs_readdir()' stop using 'file->f_pos' directly,
because 'file->f_pos' can be changed by '->llseek()' at any point. This may
lead 'ubifs_readdir()' to returning inconsistent data: directory entry names
may correspond to incorrect file positions.
So here we introduce a local variable 'pos', read 'file->f_pose' once at very
the beginning, and then stick to 'pos'. The result of this is that when
'ubifs_dir_llseek()' changes 'file->f_pos' while we are in the middle of
'ubifs_readdir()', the latter "wins".
Cc: stable@vger.kernel.org
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Al Viro [Sat, 22 Jun 2013 07:01:38 +0000 (11:01 +0400)]
aout32 coredump compat fix
dump_seek() does SEEK_CUR, not SEEK_SET; native binfmt_aout
handles it correctly (seeks by PAGE_SIZE - sizeof(struct user),
getting the current position to PAGE_SIZE), compat one seeks
by PAGE_SIZE and ends up at PAGE_SIZE + already written...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
projects / GitHub / exynos8895 / android_kernel_samsung_universal8895.git / log