Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull final vfs updates from Al Viro:
"Assorted cleanups and fixes all over the place"
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
sg_write()/bsg_write() is not fit to be called under KERNEL_DS
ufs: fix function declaration for ufs_truncate_blocks
fs: exec: apply CLOEXEC before changing dumpable task flags
seq_file: reset iterator to first record for zero offset
vfs: fix isize/pos/len checks for reflink & dedupe
[iov_iter] fix iterate_all_kinds() on empty iterators
move aio compat to fs/aio.c
reorganize do_make_slave()
clone_private_mount() doesn't need to touch namespace_sem
remove a bogus claim about namespace_sem being held by callers of mnt_alloc_id()
+198
-168
+3
block/bsg.c
+3
block/bsg.c
+3
drivers/scsi/sg.c
+3
drivers/scsi/sg.c
···
581
581
sg_io_hdr_t *hp;
582
582
unsigned char cmnd[SG_MAX_CDB_SIZE];
583
583
584
+
if (unlikely(segment_eq(get_fs(), KERNEL_DS)))
585
+
return -EINVAL;
586
+
584
587
if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp)))
585
588
return -ENXIO;
586
589
SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp,
+95
-2
fs/aio.c
+95
-2
fs/aio.c
···
1367
1367
return ret;
1368
1368
}
1369
1369
1370
+
#ifdef CONFIG_COMPAT
1371
+
COMPAT_SYSCALL_DEFINE2(io_setup, unsigned, nr_events, u32 __user *, ctx32p)
1372
+
{
1373
+
struct kioctx *ioctx = NULL;
1374
+
unsigned long ctx;
1375
+
long ret;
1376
+
1377
+
ret = get_user(ctx, ctx32p);
1378
+
if (unlikely(ret))
1379
+
goto out;
1380
+
1381
+
ret = -EINVAL;
1382
+
if (unlikely(ctx || nr_events == 0)) {
1383
+
pr_debug("EINVAL: ctx %lu nr_events %u\n",
1384
+
ctx, nr_events);
1385
+
goto out;
1386
+
}
1387
+
1388
+
ioctx = ioctx_alloc(nr_events);
1389
+
ret = PTR_ERR(ioctx);
1390
+
if (!IS_ERR(ioctx)) {
1391
+
/* truncating is ok because it's a user address */
1392
+
ret = put_user((u32)ioctx->user_id, ctx32p);
1393
+
if (ret)
1394
+
kill_ioctx(current->mm, ioctx, NULL);
1395
+
percpu_ref_put(&ioctx->users);
1396
+
}
1397
+
1398
+
out:
1399
+
return ret;
1400
+
}
1401
+
#endif
1402
+
1370
1403
/* sys_io_destroy:
1371
1404
* Destroy the aio_context specified. May cancel any outstanding
1372
1405
* AIOs and block on completion. Will fail with -ENOSYS if not
···
1624
1591
return ret;
1625
1592
}
1626
1593
1627
-
long do_io_submit(aio_context_t ctx_id, long nr,
1628
-
struct iocb __user *__user *iocbpp, bool compat)
1594
+
static long do_io_submit(aio_context_t ctx_id, long nr,
1595
+
struct iocb __user *__user *iocbpp, bool compat)
1629
1596
{
1630
1597
struct kioctx *ctx;
1631
1598
long ret = 0;
···
1694
1661
{
1695
1662
return do_io_submit(ctx_id, nr, iocbpp, 0);
1696
1663
}
1664
+
1665
+
#ifdef CONFIG_COMPAT
1666
+
static inline long
1667
+
copy_iocb(long nr, u32 __user *ptr32, struct iocb __user * __user *ptr64)
1668
+
{
1669
+
compat_uptr_t uptr;
1670
+
int i;
1671
+
1672
+
for (i = 0; i < nr; ++i) {
1673
+
if (get_user(uptr, ptr32 + i))
1674
+
return -EFAULT;
1675
+
if (put_user(compat_ptr(uptr), ptr64 + i))
1676
+
return -EFAULT;
1677
+
}
1678
+
return 0;
1679
+
}
1680
+
1681
+
#define MAX_AIO_SUBMITS (PAGE_SIZE/sizeof(struct iocb *))
1682
+
1683
+
COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
1684
+
int, nr, u32 __user *, iocb)
1685
+
{
1686
+
struct iocb __user * __user *iocb64;
1687
+
long ret;
1688
+
1689
+
if (unlikely(nr < 0))
1690
+
return -EINVAL;
1691
+
1692
+
if (nr > MAX_AIO_SUBMITS)
1693
+
nr = MAX_AIO_SUBMITS;
1694
+
1695
+
iocb64 = compat_alloc_user_space(nr * sizeof(*iocb64));
1696
+
ret = copy_iocb(nr, iocb, iocb64);
1697
+
if (!ret)
1698
+
ret = do_io_submit(ctx_id, nr, iocb64, 1);
1699
+
return ret;
1700
+
}
1701
+
#endif
1697
1702
1698
1703
/* lookup_kiocb
1699
1704
* Finds a given iocb for cancellation.
···
1832
1761
}
1833
1762
return ret;
1834
1763
}
1764
+
1765
+
#ifdef CONFIG_COMPAT
1766
+
COMPAT_SYSCALL_DEFINE5(io_getevents, compat_aio_context_t, ctx_id,
1767
+
compat_long_t, min_nr,
1768
+
compat_long_t, nr,
1769
+
struct io_event __user *, events,
1770
+
struct compat_timespec __user *, timeout)
1771
+
{
1772
+
struct timespec t;
1773
+
struct timespec __user *ut = NULL;
1774
+
1775
+
if (timeout) {
1776
+
if (compat_get_timespec(&t, timeout))
1777
+
return -EFAULT;
1778
+
1779
+
ut = compat_alloc_user_space(sizeof(*ut));
1780
+
if (copy_to_user(ut, &t, sizeof(t)))
1781
+
return -EFAULT;
1782
+
}
1783
+
return sys_io_getevents(ctx_id, min_nr, nr, events, ut);
1784
+
}
1785
+
#endif
-75
fs/compat.c
-75
fs/compat.c
···
487
487
return compat_sys_fcntl64(fd, cmd, arg);
488
488
}
489
489
490
-
COMPAT_SYSCALL_DEFINE2(io_setup, unsigned, nr_reqs, u32 __user *, ctx32p)
491
-
{
492
-
long ret;
493
-
aio_context_t ctx64;
494
-
495
-
mm_segment_t oldfs = get_fs();
496
-
if (unlikely(get_user(ctx64, ctx32p)))
497
-
return -EFAULT;
498
-
499
-
set_fs(KERNEL_DS);
500
-
/* The __user pointer cast is valid because of the set_fs() */
501
-
ret = sys_io_setup(nr_reqs, (aio_context_t __user *) &ctx64);
502
-
set_fs(oldfs);
503
-
/* truncating is ok because it's a user address */
504
-
if (!ret)
505
-
ret = put_user((u32) ctx64, ctx32p);
506
-
return ret;
507
-
}
508
-
509
-
COMPAT_SYSCALL_DEFINE5(io_getevents, compat_aio_context_t, ctx_id,
510
-
compat_long_t, min_nr,
511
-
compat_long_t, nr,
512
-
struct io_event __user *, events,
513
-
struct compat_timespec __user *, timeout)
514
-
{
515
-
struct timespec t;
516
-
struct timespec __user *ut = NULL;
517
-
518
-
if (timeout) {
519
-
if (compat_get_timespec(&t, timeout))
520
-
return -EFAULT;
521
-
522
-
ut = compat_alloc_user_space(sizeof(*ut));
523
-
if (copy_to_user(ut, &t, sizeof(t)) )
524
-
return -EFAULT;
525
-
}
526
-
return sys_io_getevents(ctx_id, min_nr, nr, events, ut);
527
-
}
528
-
529
490
/* A write operation does a read from user space and vice versa */
530
491
#define vrfy_dir(type) ((type) == READ ? VERIFY_WRITE : VERIFY_READ)
531
492
···
560
599
ret = tot_len;
561
600
562
601
out:
563
-
return ret;
564
-
}
565
-
566
-
static inline long
567
-
copy_iocb(long nr, u32 __user *ptr32, struct iocb __user * __user *ptr64)
568
-
{
569
-
compat_uptr_t uptr;
570
-
int i;
571
-
572
-
for (i = 0; i < nr; ++i) {
573
-
if (get_user(uptr, ptr32 + i))
574
-
return -EFAULT;
575
-
if (put_user(compat_ptr(uptr), ptr64 + i))
576
-
return -EFAULT;
577
-
}
578
-
return 0;
579
-
}
580
-
581
-
#define MAX_AIO_SUBMITS (PAGE_SIZE/sizeof(struct iocb *))
582
-
583
-
COMPAT_SYSCALL_DEFINE3(io_submit, compat_aio_context_t, ctx_id,
584
-
int, nr, u32 __user *, iocb)
585
-
{
586
-
struct iocb __user * __user *iocb64;
587
-
long ret;
588
-
589
-
if (unlikely(nr < 0))
590
-
return -EINVAL;
591
-
592
-
if (nr > MAX_AIO_SUBMITS)
593
-
nr = MAX_AIO_SUBMITS;
594
-
595
-
iocb64 = compat_alloc_user_space(nr * sizeof(*iocb64));
596
-
ret = copy_iocb(nr, iocb, iocb64);
597
-
if (!ret)
598
-
ret = do_io_submit(ctx_id, nr, iocb64, 1);
599
602
return ret;
600
603
}
601
604
+8
-2
fs/exec.c
+8
-2
fs/exec.c
···
19
19
* current->executable is only used by the procfs. This allows a dispatch
20
20
* table to check for several different types of binary formats. We keep
21
21
* trying until we recognize the file or we run out of supported binary
22
-
* formats.
22
+
* formats.
23
23
*/
24
24
25
25
#include <linux/slab.h>
···
1268
1268
flush_thread();
1269
1269
current->personality &= ~bprm->per_clear;
1270
1270
1271
+
/*
1272
+
* We have to apply CLOEXEC before we change whether the process is
1273
+
* dumpable (in setup_new_exec) to avoid a race with a process in userspace
1274
+
* trying to access the should-be-closed file descriptors of a process
1275
+
* undergoing exec(2).
1276
+
*/
1277
+
do_close_on_exec(current->files);
1271
1278
return 0;
1272
1279
1273
1280
out:
···
1337
1330
group */
1338
1331
current->self_exec_id++;
1339
1332
flush_signal_handlers(current, 0);
1340
-
do_close_on_exec(current->files);
1341
1333
}
1342
1334
EXPORT_SYMBOL(setup_new_exec);
1343
1335
+2
-6
fs/namespace.c
+2
-6
fs/namespace.c
···
96
96
return &mountpoint_hashtable[tmp & mp_hash_mask];
97
97
}
98
98
99
-
/*
100
-
* allocation is serialized by namespace_sem, but we need the spinlock to
101
-
* serialize with freeing.
102
-
*/
103
99
static int mnt_alloc_id(struct mount *mnt)
104
100
{
105
101
int res;
···
1030
1034
if (IS_MNT_SLAVE(old))
1031
1035
list_add(&mnt->mnt_slave, &old->mnt_slave);
1032
1036
mnt->mnt_master = old->mnt_master;
1037
+
} else {
1038
+
CLEAR_MNT_SHARED(mnt);
1033
1039
}
1034
1040
if (flag & CL_MAKE_SHARED)
1035
1041
set_mnt_shared(mnt);
···
1826
1828
if (IS_MNT_UNBINDABLE(old_mnt))
1827
1829
return ERR_PTR(-EINVAL);
1828
1830
1829
-
down_read(&namespace_sem);
1830
1831
new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE);
1831
-
up_read(&namespace_sem);
1832
1832
if (IS_ERR(new_mnt))
1833
1833
return ERR_CAST(new_mnt);
1834
1834
+1
-1
fs/ocfs2/refcounttree.c
+1
-1
fs/ocfs2/refcounttree.c
+37
-39
fs/pnode.c
+37
-39
fs/pnode.c
···
67
67
68
68
static int do_make_slave(struct mount *mnt)
69
69
{
70
-
struct mount *peer_mnt = mnt, *master = mnt->mnt_master;
71
-
struct mount *slave_mnt;
70
+
struct mount *master, *slave_mnt;
72
71
73
-
/*
74
-
* slave 'mnt' to a peer mount that has the
75
-
* same root dentry. If none is available then
76
-
* slave it to anything that is available.
77
-
*/
78
-
while ((peer_mnt = next_peer(peer_mnt)) != mnt &&
79
-
peer_mnt->mnt.mnt_root != mnt->mnt.mnt_root) ;
80
-
81
-
if (peer_mnt == mnt) {
82
-
peer_mnt = next_peer(mnt);
83
-
if (peer_mnt == mnt)
84
-
peer_mnt = NULL;
85
-
}
86
-
if (mnt->mnt_group_id && IS_MNT_SHARED(mnt) &&
87
-
list_empty(&mnt->mnt_share))
88
-
mnt_release_group_id(mnt);
89
-
90
-
list_del_init(&mnt->mnt_share);
91
-
mnt->mnt_group_id = 0;
92
-
93
-
if (peer_mnt)
94
-
master = peer_mnt;
95
-
96
-
if (master) {
97
-
list_for_each_entry(slave_mnt, &mnt->mnt_slave_list, mnt_slave)
98
-
slave_mnt->mnt_master = master;
99
-
list_move(&mnt->mnt_slave, &master->mnt_slave_list);
100
-
list_splice(&mnt->mnt_slave_list, master->mnt_slave_list.prev);
101
-
INIT_LIST_HEAD(&mnt->mnt_slave_list);
102
-
} else {
103
-
struct list_head *p = &mnt->mnt_slave_list;
104
-
while (!list_empty(p)) {
105
-
slave_mnt = list_first_entry(p,
106
-
struct mount, mnt_slave);
107
-
list_del_init(&slave_mnt->mnt_slave);
108
-
slave_mnt->mnt_master = NULL;
72
+
if (list_empty(&mnt->mnt_share)) {
73
+
if (IS_MNT_SHARED(mnt)) {
74
+
mnt_release_group_id(mnt);
75
+
CLEAR_MNT_SHARED(mnt);
109
76
}
77
+
master = mnt->mnt_master;
78
+
if (!master) {
79
+
struct list_head *p = &mnt->mnt_slave_list;
80
+
while (!list_empty(p)) {
81
+
slave_mnt = list_first_entry(p,
82
+
struct mount, mnt_slave);
83
+
list_del_init(&slave_mnt->mnt_slave);
84
+
slave_mnt->mnt_master = NULL;
85
+
}
86
+
return 0;
87
+
}
88
+
} else {
89
+
struct mount *m;
90
+
/*
91
+
* slave 'mnt' to a peer mount that has the
92
+
* same root dentry. If none is available then
93
+
* slave it to anything that is available.
94
+
*/
95
+
for (m = master = next_peer(mnt); m != mnt; m = next_peer(m)) {
96
+
if (m->mnt.mnt_root == mnt->mnt.mnt_root) {
97
+
master = m;
98
+
break;
99
+
}
100
+
}
101
+
list_del_init(&mnt->mnt_share);
102
+
mnt->mnt_group_id = 0;
103
+
CLEAR_MNT_SHARED(mnt);
110
104
}
105
+
list_for_each_entry(slave_mnt, &mnt->mnt_slave_list, mnt_slave)
106
+
slave_mnt->mnt_master = master;
107
+
list_move(&mnt->mnt_slave, &master->mnt_slave_list);
108
+
list_splice(&mnt->mnt_slave_list, master->mnt_slave_list.prev);
109
+
INIT_LIST_HEAD(&mnt->mnt_slave_list);
111
110
mnt->mnt_master = master;
112
-
CLEAR_MNT_SHARED(mnt);
113
111
return 0;
114
112
}
115
113
+11
-7
fs/read_write.c
+11
-7
fs/read_write.c
···
1669
1669
* Check that the two inodes are eligible for cloning, the ranges make
1670
1670
* sense, and then flush all dirty data. Caller must ensure that the
1671
1671
* inodes have been locked against any other modifications.
1672
+
*
1673
+
* Returns: 0 for "nothing to clone", 1 for "something to clone", or
1674
+
* the usual negative error code.
1672
1675
*/
1673
1676
int vfs_clone_file_prep_inodes(struct inode *inode_in, loff_t pos_in,
1674
1677
struct inode *inode_out, loff_t pos_out,
···
1698
1695
1699
1696
/* Are we going all the way to the end? */
1700
1697
isize = i_size_read(inode_in);
1701
-
if (isize == 0) {
1702
-
*len = 0;
1698
+
if (isize == 0)
1703
1699
return 0;
1704
-
}
1705
1700
1706
1701
/* Zero length dedupe exits immediately; reflink goes to EOF. */
1707
1702
if (*len == 0) {
1708
-
if (is_dedupe) {
1709
-
*len = 0;
1703
+
if (is_dedupe || pos_in == isize)
1710
1704
return 0;
1711
-
}
1705
+
if (pos_in > isize)
1706
+
return -EINVAL;
1712
1707
*len = isize - pos_in;
1713
1708
}
1714
1709
···
1770
1769
return -EBADE;
1771
1770
}
1772
1771
1773
-
return 0;
1772
+
return 1;
1774
1773
}
1775
1774
EXPORT_SYMBOL(vfs_clone_file_prep_inodes);
1776
1775
···
1955
1954
if (ret < 0)
1956
1955
goto out;
1957
1956
ret = 0;
1957
+
1958
+
if (off + len > i_size_read(src))
1959
+
return -EINVAL;
1958
1960
1959
1961
/* pre-format output fields to sane values */
1960
1962
for (i = 0; i < count; i++) {
+7
fs/seq_file.c
+7
fs/seq_file.c
···
190
190
*/
191
191
m->version = file->f_version;
192
192
193
+
/*
194
+
* if request is to read from zero offset, reset iterator to first
195
+
* record as it might have been already advanced by previous requests
196
+
*/
197
+
if (*ppos == 0)
198
+
m->index = 0;
199
+
193
200
/* Don't assume *ppos is where we left it */
194
201
if (unlikely(*ppos != m->read_pos)) {
195
202
while ((err = traverse(m, *ppos)) == -EAGAIN)
+1
-1
fs/ufs/inode.c
+1
-1
fs/ufs/inode.c
+1
-1
fs/xfs/xfs_reflink.c
+1
-1
fs/xfs/xfs_reflink.c
-5
include/linux/aio.h
-5
include/linux/aio.h
···
14
14
/* prototypes */
15
15
#ifdef CONFIG_AIO
16
16
extern void exit_aio(struct mm_struct *mm);
17
-
extern long do_io_submit(aio_context_t ctx_id, long nr,
18
-
struct iocb __user *__user *iocbpp, bool compat);
19
17
void kiocb_set_cancel_fn(struct kiocb *req, kiocb_cancel_fn *cancel);
20
18
#else
21
19
static inline void exit_aio(struct mm_struct *mm) { }
22
-
static inline long do_io_submit(aio_context_t ctx_id, long nr,
23
-
struct iocb __user * __user *iocbpp,
24
-
bool compat) { return 0; }
25
20
static inline void kiocb_set_cancel_fn(struct kiocb *req,
26
21
kiocb_cancel_fn *cancel) { }
27
22
#endif /* CONFIG_AIO */
+3
kernel/sys_ni.c
+3
kernel/sys_ni.c
···
150
150
cond_syscall(sys_io_submit);
151
151
cond_syscall(sys_io_cancel);
152
152
cond_syscall(sys_io_getevents);
153
+
cond_syscall(compat_sys_io_setup);
154
+
cond_syscall(compat_sys_io_submit);
155
+
cond_syscall(compat_sys_io_getevents);
153
156
cond_syscall(sys_sysfs);
154
157
cond_syscall(sys_syslog);
155
158
cond_syscall(sys_process_vm_readv);
+26
-29
lib/iov_iter.c
+26
-29
lib/iov_iter.c
···
73
73
}
74
74
75
75
#define iterate_all_kinds(i, n, v, I, B, K) { \
76
-
size_t skip = i->iov_offset; \
77
-
if (unlikely(i->type & ITER_BVEC)) { \
78
-
struct bio_vec v; \
79
-
struct bvec_iter __bi; \
80
-
iterate_bvec(i, n, v, __bi, skip, (B)) \
81
-
} else if (unlikely(i->type & ITER_KVEC)) { \
82
-
const struct kvec *kvec; \
83
-
struct kvec v; \
84
-
iterate_kvec(i, n, v, kvec, skip, (K)) \
85
-
} else { \
86
-
const struct iovec *iov; \
87
-
struct iovec v; \
88
-
iterate_iovec(i, n, v, iov, skip, (I)) \
76
+
if (likely(n)) { \
77
+
size_t skip = i->iov_offset; \
78
+
if (unlikely(i->type & ITER_BVEC)) { \
79
+
struct bio_vec v; \
80
+
struct bvec_iter __bi; \
81
+
iterate_bvec(i, n, v, __bi, skip, (B)) \
82
+
} else if (unlikely(i->type & ITER_KVEC)) { \
83
+
const struct kvec *kvec; \
84
+
struct kvec v; \
85
+
iterate_kvec(i, n, v, kvec, skip, (K)) \
86
+
} else { \
87
+
const struct iovec *iov; \
88
+
struct iovec v; \
89
+
iterate_iovec(i, n, v, iov, skip, (I)) \
90
+
} \
89
91
} \
90
92
}
91
93
···
578
576
WARN_ON(1);
579
577
return false;
580
578
}
581
-
if (unlikely(i->count < bytes)) \
579
+
if (unlikely(i->count < bytes))
582
580
return false;
583
581
584
582
iterate_all_kinds(i, bytes, v, ({
···
622
620
WARN_ON(1);
623
621
return false;
624
622
}
625
-
if (unlikely(i->count < bytes)) \
623
+
if (unlikely(i->count < bytes))
626
624
return false;
627
625
iterate_all_kinds(i, bytes, v, ({
628
626
if (__copy_from_user_nocache((to += v.iov_len) - v.iov_len,
···
839
837
unsigned long res = 0;
840
838
size_t size = i->count;
841
839
842
-
if (!size)
843
-
return 0;
844
-
845
840
if (unlikely(i->type & ITER_PIPE)) {
846
-
if (i->iov_offset && allocated(&i->pipe->bufs[i->idx]))
841
+
if (size && i->iov_offset && allocated(&i->pipe->bufs[i->idx]))
847
842
return size | i->iov_offset;
848
843
return size;
849
844
}
···
855
856
856
857
unsigned long iov_iter_gap_alignment(const struct iov_iter *i)
857
858
{
858
-
unsigned long res = 0;
859
+
unsigned long res = 0;
859
860
size_t size = i->count;
860
-
if (!size)
861
-
return 0;
862
861
863
862
if (unlikely(i->type & ITER_PIPE)) {
864
863
WARN_ON(1);
···
871
874
(res |= (!res ? 0 : (unsigned long)v.iov_base) |
872
875
(size != v.iov_len ? size : 0))
873
876
);
874
-
return res;
877
+
return res;
875
878
}
876
879
EXPORT_SYMBOL(iov_iter_gap_alignment);
877
880
···
905
908
size_t capacity;
906
909
int idx;
907
910
911
+
if (!maxsize)
912
+
return 0;
913
+
908
914
if (!sanity(i))
909
915
return -EFAULT;
910
916
···
925
925
{
926
926
if (maxsize > i->count)
927
927
maxsize = i->count;
928
-
929
-
if (!maxsize)
930
-
return 0;
931
928
932
929
if (unlikely(i->type & ITER_PIPE))
933
930
return pipe_get_pages(i, pages, maxsize, maxpages, start);
···
972
975
int idx;
973
976
int npages;
974
977
978
+
if (!maxsize)
979
+
return 0;
980
+
975
981
if (!sanity(i))
976
982
return -EFAULT;
977
983
···
1005
1005
1006
1006
if (maxsize > i->count)
1007
1007
maxsize = i->count;
1008
-
1009
-
if (!maxsize)
1010
-
return 0;
1011
1008
1012
1009
if (unlikely(i->type & ITER_PIPE))
1013
1010
return pipe_get_pages_alloc(i, pages, maxsize, start);