Commit 78833dd7 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  nd->inode is not set on the second attempt in path_walk()
  unfuck proc_sysctl ->d_compare()
  minimal fix for do_filp_open() race
parents a5abba98 b306419a
......@@ -1546,6 +1546,7 @@ static int path_walk(const char *name, struct nameidata *nd)
/* nd->path had been dropped */
current->total_link_count = 0;
nd->path = save;
nd->inode = save.dentry->d_inode;
path_get(&nd->path);
nd->flags |= LOOKUP_REVAL;
result = link_path_walk(name, nd);
......@@ -2455,22 +2456,29 @@ struct file *do_filp_open(int dfd, const char *pathname,
/* !O_CREAT, simple open */
error = do_path_lookup(dfd, pathname, flags, &nd);
if (unlikely(error))
goto out_filp;
goto out_filp2;
error = -ELOOP;
if (!(nd.flags & LOOKUP_FOLLOW)) {
if (nd.inode->i_op->follow_link)
goto out_path;
goto out_path2;
}
error = -ENOTDIR;
if (nd.flags & LOOKUP_DIRECTORY) {
if (!nd.inode->i_op->lookup)
goto out_path;
goto out_path2;
}
audit_inode(pathname, nd.path.dentry);
filp = finish_open(&nd, open_flag, acc_mode);
out2:
release_open_intent(&nd);
return filp;
out_path2:
path_put(&nd.path);
out_filp2:
filp = ERR_PTR(error);
goto out2;
creat:
/* OK, have to create the file. Find the parent. */
error = path_init_rcu(dfd, pathname,
......
......@@ -27,6 +27,7 @@
static void proc_evict_inode(struct inode *inode)
{
struct proc_dir_entry *de;
struct ctl_table_header *head;
truncate_inode_pages(&inode->i_data, 0);
end_writeback(inode);
......@@ -38,8 +39,11 @@ static void proc_evict_inode(struct inode *inode)
de = PROC_I(inode)->pde;
if (de)
pde_put(de);
if (PROC_I(inode)->sysctl)
sysctl_head_put(PROC_I(inode)->sysctl);
head = PROC_I(inode)->sysctl;
if (head) {
rcu_assign_pointer(PROC_I(inode)->sysctl, NULL);
sysctl_head_put(head);
}
}
struct vfsmount *proc_mnt;
......
......@@ -408,15 +408,18 @@ static int proc_sys_compare(const struct dentry *parent,
const struct dentry *dentry, const struct inode *inode,
unsigned int len, const char *str, const struct qstr *name)
{
struct ctl_table_header *head;
/* Although proc doesn't have negative dentries, rcu-walk means
* that inode here can be NULL */
/* AV: can it, indeed? */
if (!inode)
return 0;
return 1;
if (name->len != len)
return 1;
if (memcmp(name->name, str, len))
return 1;
return !sysctl_is_seen(PROC_I(inode)->sysctl);
head = rcu_dereference(PROC_I(inode)->sysctl);
return !head || !sysctl_is_seen(head);
}
static const struct dentry_operations proc_sys_dentry_operations = {
......
......@@ -25,6 +25,7 @@
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/compiler.h>
#include <linux/rcupdate.h>
struct completion;
......@@ -1037,10 +1038,15 @@ struct ctl_table_root {
struct ctl_table trees. */
struct ctl_table_header
{
struct ctl_table *ctl_table;
struct list_head ctl_entry;
int used;
int count;
union {
struct {
struct ctl_table *ctl_table;
struct list_head ctl_entry;
int used;
int count;
};
struct rcu_head rcu;
};
struct completion *unregistering;
struct ctl_table *ctl_table_arg;
struct ctl_table_root *root;
......
......@@ -194,9 +194,9 @@ static int sysrq_sysctl_handler(ctl_table *table, int write,
static struct ctl_table root_table[];
static struct ctl_table_root sysctl_table_root;
static struct ctl_table_header root_table_header = {
.count = 1,
{{.count = 1,
.ctl_table = root_table,
.ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),
.ctl_entry = LIST_HEAD_INIT(sysctl_table_root.default_set.list),}},
.root = &sysctl_table_root,
.set = &sysctl_table_root.default_set,
};
......@@ -1567,11 +1567,16 @@ void sysctl_head_get(struct ctl_table_header *head)
spin_unlock(&sysctl_lock);
}
static void free_head(struct rcu_head *rcu)
{
kfree(container_of(rcu, struct ctl_table_header, rcu));
}
void sysctl_head_put(struct ctl_table_header *head)
{
spin_lock(&sysctl_lock);
if (!--head->count)
kfree(head);
call_rcu(&head->rcu, free_head);
spin_unlock(&sysctl_lock);
}
......@@ -1948,10 +1953,10 @@ void unregister_sysctl_table(struct ctl_table_header * header)
start_unregistering(header);
if (!--header->parent->count) {
WARN_ON(1);
kfree(header->parent);
call_rcu(&header->parent->rcu, free_head);
}
if (!--header->count)
kfree(header);
call_rcu(&header->rcu, free_head);
spin_unlock(&sysctl_lock);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment