Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull assorted fixes from Al Viro:
"There'll be more - I'm trying to dig out from under the pile of mail
(a couple of weeks of something flu-like ;-/) and there's several more
things waiting for review; this is just the obvious stuff."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
zoran: racy refcount handling in vm_ops ->open()/->close()
befs_readdir(): do not increment ->f_pos if filldir tells us to stop
hpfs: deadlock and race in directory lseek()
qnx6: qnx6_readdir() has a braino in pos calculation
fix buffer leak after "scsi: saner replacements for ->proc_info()"
vfs: Fix invalid ida_remove() call
+21
-16
+1
-1
drivers/media/pci/zoran/zoran.h
+1
-1
drivers/media/pci/zoran/zoran.h
+8
-7
drivers/media/pci/zoran/zoran_driver.c
+8
-7
drivers/media/pci/zoran/zoran_driver.c
···
2803
2803
zoran_vm_open (struct vm_area_struct *vma)
2804
2804
{
2805
2805
struct zoran_mapping *map = vma->vm_private_data;
2806
-
2807
-
map->count++;
2806
+
atomic_inc(&map->count);
2808
2807
}
2809
2808
2810
2809
static void
···
2814
2815
struct zoran *zr = fh->zr;
2815
2816
int i;
2816
2817
2817
-
if (--map->count > 0)
2818
+
if (!atomic_dec_and_mutex_lock(&map->count, &zr->resource_lock))
2818
2819
return;
2819
2820
2820
2821
dprintk(3, KERN_INFO "%s: %s - munmap(%s)\n", ZR_DEVNAME(zr),
···
2827
2828
kfree(map);
2828
2829
2829
2830
/* Any buffers still mapped? */
2830
-
for (i = 0; i < fh->buffers.num_buffers; i++)
2831
-
if (fh->buffers.buffer[i].map)
2831
+
for (i = 0; i < fh->buffers.num_buffers; i++) {
2832
+
if (fh->buffers.buffer[i].map) {
2833
+
mutex_unlock(&zr->resource_lock);
2832
2834
return;
2835
+
}
2836
+
}
2833
2837
2834
2838
dprintk(3, KERN_INFO "%s: %s - free %s buffers\n", ZR_DEVNAME(zr),
2835
2839
__func__, mode_name(fh->map_mode));
2836
2840
2837
-
mutex_lock(&zr->resource_lock);
2838
2841
2839
2842
if (fh->map_mode == ZORAN_MAP_MODE_RAW) {
2840
2843
if (fh->buffers.active != ZORAN_FREE) {
···
2940
2939
goto mmap_unlock_and_return;
2941
2940
}
2942
2941
map->fh = fh;
2943
-
map->count = 1;
2942
+
atomic_set(&map->count, 1);
2944
2943
2945
2944
vma->vm_ops = &zoran_vm_ops;
2946
2945
vma->vm_flags |= VM_DONTEXPAND;
+1
drivers/scsi/scsi_proc.c
+1
drivers/scsi/scsi_proc.c
+2
-2
fs/befs/linuxvfs.c
+2
-2
fs/befs/linuxvfs.c
+6
-4
fs/hpfs/dir.c
+6
-4
fs/hpfs/dir.c
···
33
33
if (whence == SEEK_DATA || whence == SEEK_HOLE)
34
34
return -EINVAL;
35
35
36
+
mutex_lock(&i->i_mutex);
36
37
hpfs_lock(s);
37
38
38
39
/*printk("dir lseek\n");*/
39
40
if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok;
40
-
mutex_lock(&i->i_mutex);
41
41
pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1;
42
42
while (pos != new_off) {
43
43
if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh);
44
44
else goto fail;
45
45
if (pos == 12) goto fail;
46
46
}
47
-
mutex_unlock(&i->i_mutex);
47
+
hpfs_add_pos(i, &filp->f_pos);
48
48
ok:
49
+
filp->f_pos = new_off;
49
50
hpfs_unlock(s);
50
-
return filp->f_pos = new_off;
51
-
fail:
52
51
mutex_unlock(&i->i_mutex);
52
+
return new_off;
53
+
fail:
53
54
/*printk("illegal lseek: %016llx\n", new_off);*/
54
55
hpfs_unlock(s);
56
+
mutex_unlock(&i->i_mutex);
55
57
return -ESPIPE;
56
58
}
57
59
+2
-1
fs/pnode.c
+2
-1
fs/pnode.c
+1
-1
fs/qnx6/dir.c
+1
-1
fs/qnx6/dir.c
···
120
120
struct inode *inode = file_inode(filp);
121
121
struct super_block *s = inode->i_sb;
122
122
struct qnx6_sb_info *sbi = QNX6_SB(s);
123
-
loff_t pos = filp->f_pos & (QNX6_DIR_ENTRY_SIZE - 1);
123
+
loff_t pos = filp->f_pos & ~(QNX6_DIR_ENTRY_SIZE - 1);
124
124
unsigned long npages = dir_pages(inode);
125
125
unsigned long n = pos >> PAGE_CACHE_SHIFT;
126
126
unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE;