Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
Fix failure exit in ipathfs
fix oops in fs/9p late mount failure
fix leak in romfs_fill_super()
get rid of pointless checks after simple_pin_fs()
Fix failure exits in bfs_fill_super()
fix affs parse_options()
Fix remount races with symlink handling in affs
Fix a leak in affs_fill_super()
+62
-58
+1
-3
drivers/infiniband/hw/ipath/ipath_fs.c
+1
-3
drivers/infiniband/hw/ipath/ipath_fs.c
···
346
346
list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
347
347
spin_unlock_irqrestore(&ipath_devs_lock, flags);
348
348
ret = create_device_files(sb, dd);
349
-
if (ret) {
350
-
deactivate_locked_super(sb);
349
+
if (ret)
351
350
goto bail;
352
-
}
353
351
spin_lock_irqsave(&ipath_devs_lock, flags);
354
352
}
355
353
+2
-1
fs/9p/vfs_super.c
+2
-1
fs/9p/vfs_super.c
+1
-1
fs/affs/affs.h
+1
-1
fs/affs/affs.h
···
106
106
u32 s_last_bmap;
107
107
struct buffer_head *s_bmap_bh;
108
108
char *s_prefix; /* Prefix for volumes and assigns. */
109
-
int s_prefix_len; /* Length of prefix. */
110
109
char s_volume[32]; /* Volume prefix for absolute symlinks. */
110
+
spinlock_t symlink_lock; /* protects the previous two */
111
111
};
112
112
113
113
#define SF_INTL 0x0001 /* International filesystem. */
+5
-2
fs/affs/namei.c
+5
-2
fs/affs/namei.c
···
341
341
p = (char *)AFFS_HEAD(bh)->table;
342
342
lc = '/';
343
343
if (*symname == '/') {
344
+
struct affs_sb_info *sbi = AFFS_SB(sb);
344
345
while (*symname == '/')
345
346
symname++;
346
-
while (AFFS_SB(sb)->s_volume[i]) /* Cannot overflow */
347
-
*p++ = AFFS_SB(sb)->s_volume[i++];
347
+
spin_lock(&sbi->symlink_lock);
348
+
while (sbi->s_volume[i]) /* Cannot overflow */
349
+
*p++ = sbi->s_volume[i++];
350
+
spin_unlock(&sbi->symlink_lock);
348
351
}
349
352
while (i < maxlen && (c = *symname++)) {
350
353
if (c == '.' && lc == '/' && *symname == '.' && symname[1] == '/') {
+22
-9
fs/affs/super.c
+22
-9
fs/affs/super.c
···
203
203
switch (token) {
204
204
case Opt_bs:
205
205
if (match_int(&args[0], &n))
206
-
return -EINVAL;
206
+
return 0;
207
207
if (n != 512 && n != 1024 && n != 2048
208
208
&& n != 4096) {
209
209
printk ("AFFS: Invalid blocksize (512, 1024, 2048, 4096 allowed)\n");
···
213
213
break;
214
214
case Opt_mode:
215
215
if (match_octal(&args[0], &option))
216
-
return 1;
216
+
return 0;
217
217
*mode = option & 0777;
218
218
*mount_opts |= SF_SETMODE;
219
219
break;
···
221
221
*mount_opts |= SF_MUFS;
222
222
break;
223
223
case Opt_prefix:
224
-
/* Free any previous prefix */
225
-
kfree(*prefix);
226
224
*prefix = match_strdup(&args[0]);
227
225
if (!*prefix)
228
226
return 0;
···
231
233
break;
232
234
case Opt_reserved:
233
235
if (match_int(&args[0], reserved))
234
-
return 1;
236
+
return 0;
235
237
break;
236
238
case Opt_root:
237
239
if (match_int(&args[0], root))
238
-
return 1;
240
+
return 0;
239
241
break;
240
242
case Opt_setgid:
241
243
if (match_int(&args[0], &option))
242
-
return 1;
244
+
return 0;
243
245
*gid = option;
244
246
*mount_opts |= SF_SETGID;
245
247
break;
246
248
case Opt_setuid:
247
249
if (match_int(&args[0], &option))
248
-
return -EINVAL;
250
+
return 0;
249
251
*uid = option;
250
252
*mount_opts |= SF_SETUID;
251
253
break;
···
309
311
return -ENOMEM;
310
312
sb->s_fs_info = sbi;
311
313
mutex_init(&sbi->s_bmlock);
314
+
spin_lock_init(&sbi->symlink_lock);
312
315
313
316
if (!parse_options(data,&uid,&gid,&i,&reserved,&root_block,
314
317
&blocksize,&sbi->s_prefix,
315
318
sbi->s_volume, &mount_flags)) {
316
319
printk(KERN_ERR "AFFS: Error parsing options\n");
320
+
kfree(sbi->s_prefix);
321
+
kfree(sbi);
317
322
return -EINVAL;
318
323
}
319
324
/* N.B. after this point s_prefix must be released */
···
517
516
unsigned long mount_flags;
518
517
int res = 0;
519
518
char *new_opts = kstrdup(data, GFP_KERNEL);
519
+
char volume[32];
520
+
char *prefix = NULL;
520
521
521
522
pr_debug("AFFS: remount(flags=0x%x,opts=\"%s\")\n",*flags,data);
522
523
523
524
*flags |= MS_NODIRATIME;
524
525
526
+
memcpy(volume, sbi->s_volume, 32);
525
527
if (!parse_options(data, &uid, &gid, &mode, &reserved, &root_block,
526
-
&blocksize, &sbi->s_prefix, sbi->s_volume,
528
+
&blocksize, &prefix, volume,
527
529
&mount_flags)) {
530
+
kfree(prefix);
528
531
kfree(new_opts);
529
532
return -EINVAL;
530
533
}
···
539
534
sbi->s_mode = mode;
540
535
sbi->s_uid = uid;
541
536
sbi->s_gid = gid;
537
+
/* protect against readers */
538
+
spin_lock(&sbi->symlink_lock);
539
+
if (prefix) {
540
+
kfree(sbi->s_prefix);
541
+
sbi->s_prefix = prefix;
542
+
}
543
+
memcpy(sbi->s_volume, volume, 32);
544
+
spin_unlock(&sbi->symlink_lock);
542
545
543
546
if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY)) {
544
547
unlock_kernel();
+5
-2
fs/affs/symlink.c
+5
-2
fs/affs/symlink.c
···
20
20
int i, j;
21
21
char c;
22
22
char lc;
23
-
char *pf;
24
23
25
24
pr_debug("AFFS: follow_link(ino=%lu)\n",inode->i_ino);
26
25
···
31
32
j = 0;
32
33
lf = (struct slink_front *)bh->b_data;
33
34
lc = 0;
34
-
pf = AFFS_SB(inode->i_sb)->s_prefix ? AFFS_SB(inode->i_sb)->s_prefix : "/";
35
35
36
36
if (strchr(lf->symname,':')) { /* Handle assign or volume name */
37
+
struct affs_sb_info *sbi = AFFS_SB(inode->i_sb);
38
+
char *pf;
39
+
spin_lock(&sbi->symlink_lock);
40
+
pf = sbi->s_prefix ? sbi->s_prefix : "/";
37
41
while (i < 1023 && (c = pf[i]))
38
42
link[i++] = c;
43
+
spin_unlock(&sbi->symlink_lock);
39
44
while (i < 1023 && lf->symname[j] != ':')
40
45
link[i++] = lf->symname[j++];
41
46
if (i < 1023)
+21
-22
fs/bfs/inode.c
+21
-22
fs/bfs/inode.c
···
353
353
struct inode *inode;
354
354
unsigned i, imap_len;
355
355
struct bfs_sb_info *info;
356
-
long ret = -EINVAL;
356
+
int ret = -EINVAL;
357
357
unsigned long i_sblock, i_eblock, i_eoff, s_size;
358
358
359
359
info = kzalloc(sizeof(*info), GFP_KERNEL);
360
360
if (!info)
361
361
return -ENOMEM;
362
+
mutex_init(&info->bfs_lock);
362
363
s->s_fs_info = info;
363
364
364
365
sb_set_blocksize(s, BFS_BSIZE);
365
366
366
-
bh = sb_bread(s, 0);
367
-
if(!bh)
367
+
info->si_sbh = sb_bread(s, 0);
368
+
if (!info->si_sbh)
368
369
goto out;
369
-
bfs_sb = (struct bfs_super_block *)bh->b_data;
370
+
bfs_sb = (struct bfs_super_block *)info->si_sbh->b_data;
370
371
if (le32_to_cpu(bfs_sb->s_magic) != BFS_MAGIC) {
371
372
if (!silent)
372
373
printf("No BFS filesystem on %s (magic=%08x)\n",
373
374
s->s_id, le32_to_cpu(bfs_sb->s_magic));
374
-
goto out;
375
+
goto out1;
375
376
}
376
377
if (BFS_UNCLEAN(bfs_sb, s) && !silent)
377
378
printf("%s is unclean, continuing\n", s->s_id);
378
379
379
380
s->s_magic = BFS_MAGIC;
380
-
info->si_sbh = bh;
381
381
382
382
if (le32_to_cpu(bfs_sb->s_start) > le32_to_cpu(bfs_sb->s_end)) {
383
383
printf("Superblock is corrupted\n");
384
-
goto out;
384
+
goto out1;
385
385
}
386
386
387
387
info->si_lasti = (le32_to_cpu(bfs_sb->s_start) - BFS_BSIZE) /
···
390
390
imap_len = (info->si_lasti / 8) + 1;
391
391
info->si_imap = kzalloc(imap_len, GFP_KERNEL);
392
392
if (!info->si_imap)
393
-
goto out;
393
+
goto out1;
394
394
for (i = 0; i < BFS_ROOT_INO; i++)
395
395
set_bit(i, info->si_imap);
396
396
···
398
398
inode = bfs_iget(s, BFS_ROOT_INO);
399
399
if (IS_ERR(inode)) {
400
400
ret = PTR_ERR(inode);
401
-
kfree(info->si_imap);
402
-
goto out;
401
+
goto out2;
403
402
}
404
403
s->s_root = d_alloc_root(inode);
405
404
if (!s->s_root) {
406
405
iput(inode);
407
406
ret = -ENOMEM;
408
-
kfree(info->si_imap);
409
-
goto out;
407
+
goto out2;
410
408
}
411
409
412
410
info->si_blocks = (le32_to_cpu(bfs_sb->s_end) + 1) >> BFS_BSIZE_BITS;
···
417
419
bh = sb_bread(s, info->si_blocks - 1);
418
420
if (!bh) {
419
421
printf("Last block not available: %lu\n", info->si_blocks - 1);
420
-
iput(inode);
421
422
ret = -EIO;
422
-
kfree(info->si_imap);
423
-
goto out;
423
+
goto out3;
424
424
}
425
425
brelse(bh);
426
426
···
455
459
printf("Inode 0x%08x corrupted\n", i);
456
460
457
461
brelse(bh);
458
-
s->s_root = NULL;
459
-
kfree(info->si_imap);
460
-
kfree(info);
461
-
s->s_fs_info = NULL;
462
-
return -EIO;
462
+
ret = -EIO;
463
+
goto out3;
463
464
}
464
465
465
466
if (!di->i_ino) {
···
476
483
s->s_dirt = 1;
477
484
}
478
485
dump_imap("read_super", s);
479
-
mutex_init(&info->bfs_lock);
480
486
return 0;
481
487
488
+
out3:
489
+
dput(s->s_root);
490
+
s->s_root = NULL;
491
+
out2:
492
+
kfree(info->si_imap);
493
+
out1:
494
+
brelse(info->si_sbh);
482
495
out:
483
-
brelse(bh);
496
+
mutex_destroy(&info->bfs_lock);
484
497
kfree(info);
485
498
s->s_fs_info = NULL;
486
499
return ret;
+2
-9
fs/debugfs/inode.c
+2
-9
fs/debugfs/inode.c
···
160
160
* block. A pointer to that is in the struct vfsmount that we
161
161
* have around.
162
162
*/
163
-
if (!parent) {
164
-
if (debugfs_mount && debugfs_mount->mnt_sb) {
165
-
parent = debugfs_mount->mnt_sb->s_root;
166
-
}
167
-
}
168
-
if (!parent) {
169
-
pr_debug("debugfs: Ah! can not find a parent!\n");
170
-
return -EFAULT;
171
-
}
163
+
if (!parent)
164
+
parent = debugfs_mount->mnt_sb->s_root;
172
165
173
166
*dentry = NULL;
174
167
mutex_lock(&parent->d_inode->i_mutex);
+1
fs/romfs/super.c
+1
fs/romfs/super.c
+2
-9
security/inode.c
+2
-9
security/inode.c
···
156
156
* block. A pointer to that is in the struct vfsmount that we
157
157
* have around.
158
158
*/
159
-
if (!parent ) {
160
-
if (mount && mount->mnt_sb) {
161
-
parent = mount->mnt_sb->s_root;
162
-
}
163
-
}
164
-
if (!parent) {
165
-
pr_debug("securityfs: Ah! can not find a parent!\n");
166
-
return -EFAULT;
167
-
}
159
+
if (!parent)
160
+
parent = mount->mnt_sb->s_root;
168
161
169
162
mutex_lock(&parent->d_inode->i_mutex);
170
163
*dentry = lookup_one_len(name, parent, strlen(name));