Commit b9abdcfd authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs fixes from Al Viro:
 "Assorted fixes.

  Some of that is only a matter with fault injection (broken handling of
  small allocation failure in various mount-related places), but the
  last one is a root-triggerable stack overflow, and combined with
  userns it gets really nasty ;-/"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  Don't leak MNT_INTERNAL away from internal mounts
  mm,vmscan: Allow preallocating memory for register_shrinker().
  rpc_pipefs: fix double-dput()
  orangefs_kill_sb(): deal with allocation failures
  jffs2_kill_sb(): deal with failed allocations
  hypfs_kill_super(): deal with failed allocations
parents 43f70c96 16a34adb
...@@ -320,7 +320,7 @@ static void hypfs_kill_super(struct super_block *sb) ...@@ -320,7 +320,7 @@ static void hypfs_kill_super(struct super_block *sb)
if (sb->s_root) if (sb->s_root)
hypfs_delete_tree(sb->s_root); hypfs_delete_tree(sb->s_root);
if (sb_info->update_file) if (sb_info && sb_info->update_file)
hypfs_remove(sb_info->update_file); hypfs_remove(sb_info->update_file);
kfree(sb->s_fs_info); kfree(sb->s_fs_info);
sb->s_fs_info = NULL; sb->s_fs_info = NULL;
......
...@@ -342,7 +342,7 @@ static void jffs2_put_super (struct super_block *sb) ...@@ -342,7 +342,7 @@ static void jffs2_put_super (struct super_block *sb)
static void jffs2_kill_sb(struct super_block *sb) static void jffs2_kill_sb(struct super_block *sb)
{ {
struct jffs2_sb_info *c = JFFS2_SB_INFO(sb); struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
if (!sb_rdonly(sb)) if (c && !sb_rdonly(sb))
jffs2_stop_garbage_collect_thread(c); jffs2_stop_garbage_collect_thread(c);
kill_mtd_super(sb); kill_mtd_super(sb);
kfree(c); kfree(c);
......
...@@ -1089,7 +1089,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, ...@@ -1089,7 +1089,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root,
goto out_free; goto out_free;
} }
mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); mnt->mnt.mnt_flags = old->mnt.mnt_flags;
mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL);
/* Don't allow unprivileged users to change mount flags */ /* Don't allow unprivileged users to change mount flags */
if (flag & CL_UNPRIVILEGED) { if (flag & CL_UNPRIVILEGED) {
mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; mnt->mnt.mnt_flags |= MNT_LOCK_ATIME;
......
...@@ -579,6 +579,11 @@ void orangefs_kill_sb(struct super_block *sb) ...@@ -579,6 +579,11 @@ void orangefs_kill_sb(struct super_block *sb)
/* provided sb cleanup */ /* provided sb cleanup */
kill_anon_super(sb); kill_anon_super(sb);
if (!ORANGEFS_SB(sb)) {
mutex_lock(&orangefs_request_mutex);
mutex_unlock(&orangefs_request_mutex);
return;
}
/* /*
* issue the unmount to userspace to tell it to remove the * issue the unmount to userspace to tell it to remove the
* dynamic mount info it has for this superblock * dynamic mount info it has for this superblock
......
...@@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s) ...@@ -167,6 +167,7 @@ static void destroy_unused_super(struct super_block *s)
security_sb_free(s); security_sb_free(s);
put_user_ns(s->s_user_ns); put_user_ns(s->s_user_ns);
kfree(s->s_subtype); kfree(s->s_subtype);
free_prealloced_shrinker(&s->s_shrink);
/* no delays needed */ /* no delays needed */
destroy_super_work(&s->destroy_work); destroy_super_work(&s->destroy_work);
} }
...@@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, ...@@ -252,6 +253,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags,
s->s_shrink.count_objects = super_cache_count; s->s_shrink.count_objects = super_cache_count;
s->s_shrink.batch = 1024; s->s_shrink.batch = 1024;
s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE; s->s_shrink.flags = SHRINKER_NUMA_AWARE | SHRINKER_MEMCG_AWARE;
if (prealloc_shrinker(&s->s_shrink))
goto fail;
return s; return s;
fail: fail:
...@@ -518,11 +521,7 @@ struct super_block *sget_userns(struct file_system_type *type, ...@@ -518,11 +521,7 @@ struct super_block *sget_userns(struct file_system_type *type,
hlist_add_head(&s->s_instances, &type->fs_supers); hlist_add_head(&s->s_instances, &type->fs_supers);
spin_unlock(&sb_lock); spin_unlock(&sb_lock);
get_filesystem(type); get_filesystem(type);
err = register_shrinker(&s->s_shrink); register_shrinker_prepared(&s->s_shrink);
if (err) {
deactivate_locked_super(s);
s = ERR_PTR(err);
}
return s; return s;
} }
......
...@@ -75,6 +75,9 @@ struct shrinker { ...@@ -75,6 +75,9 @@ struct shrinker {
#define SHRINKER_NUMA_AWARE (1 << 0) #define SHRINKER_NUMA_AWARE (1 << 0)
#define SHRINKER_MEMCG_AWARE (1 << 1) #define SHRINKER_MEMCG_AWARE (1 << 1)
extern int register_shrinker(struct shrinker *); extern int prealloc_shrinker(struct shrinker *shrinker);
extern void unregister_shrinker(struct shrinker *); extern void register_shrinker_prepared(struct shrinker *shrinker);
extern int register_shrinker(struct shrinker *shrinker);
extern void unregister_shrinker(struct shrinker *shrinker);
extern void free_prealloced_shrinker(struct shrinker *shrinker);
#endif #endif
...@@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone ...@@ -303,7 +303,7 @@ unsigned long lruvec_lru_size(struct lruvec *lruvec, enum lru_list lru, int zone
/* /*
* Add a shrinker callback to be called from the vm. * Add a shrinker callback to be called from the vm.
*/ */
int register_shrinker(struct shrinker *shrinker) int prealloc_shrinker(struct shrinker *shrinker)
{ {
size_t size = sizeof(*shrinker->nr_deferred); size_t size = sizeof(*shrinker->nr_deferred);
...@@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker) ...@@ -313,10 +313,29 @@ int register_shrinker(struct shrinker *shrinker)
shrinker->nr_deferred = kzalloc(size, GFP_KERNEL); shrinker->nr_deferred = kzalloc(size, GFP_KERNEL);
if (!shrinker->nr_deferred) if (!shrinker->nr_deferred)
return -ENOMEM; return -ENOMEM;
return 0;
}
void free_prealloced_shrinker(struct shrinker *shrinker)
{
kfree(shrinker->nr_deferred);
shrinker->nr_deferred = NULL;
}
void register_shrinker_prepared(struct shrinker *shrinker)
{
down_write(&shrinker_rwsem); down_write(&shrinker_rwsem);
list_add_tail(&shrinker->list, &shrinker_list); list_add_tail(&shrinker->list, &shrinker_list);
up_write(&shrinker_rwsem); up_write(&shrinker_rwsem);
}
int register_shrinker(struct shrinker *shrinker)
{
int err = prealloc_shrinker(shrinker);
if (err)
return err;
register_shrinker_prepared(shrinker);
return 0; return 0;
} }
EXPORT_SYMBOL(register_shrinker); EXPORT_SYMBOL(register_shrinker);
......
...@@ -1375,6 +1375,7 @@ rpc_gssd_dummy_depopulate(struct dentry *pipe_dentry) ...@@ -1375,6 +1375,7 @@ rpc_gssd_dummy_depopulate(struct dentry *pipe_dentry)
struct dentry *clnt_dir = pipe_dentry->d_parent; struct dentry *clnt_dir = pipe_dentry->d_parent;
struct dentry *gssd_dir = clnt_dir->d_parent; struct dentry *gssd_dir = clnt_dir->d_parent;
dget(pipe_dentry);
__rpc_rmpipe(d_inode(clnt_dir), pipe_dentry); __rpc_rmpipe(d_inode(clnt_dir), pipe_dentry);
__rpc_depopulate(clnt_dir, gssd_dummy_info_file, 0, 1); __rpc_depopulate(clnt_dir, gssd_dummy_info_file, 0, 1);
__rpc_depopulate(gssd_dir, gssd_dummy_clnt_dir, 0, 1); __rpc_depopulate(gssd_dir, gssd_dummy_clnt_dir, 0, 1);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment