Commit bcd7f78d authored by Jeff Layton's avatar Jeff Layton

locks: have flock_lock_file take an inode pointer instead of a filp

...and rename it to better describe how it works.

In order to fix a use-after-free in NFS, we need to be able to remove
locks from an inode after the filp associated with them may have already
been freed. flock_lock_file already only dereferences the filp to get to
the inode, so just change it so the callers do that.

All of the callers already pass in a lock request that has the fl_file
set properly, so we don't need to pass it in individually. With that
change it now only dereferences the filp to get to the inode, so just
push that out to the callers.
Signed-off-by: default avatarJeff Layton <jeff.layton@primarydata.com>
Reviewed-by: default avatar"J. Bruce Fields" <bfields@fieldses.org>
Tested-by: default avatar"J. Bruce Fields" <bfields@fieldses.org>
parent ed056764
...@@ -862,12 +862,11 @@ static int posix_locks_deadlock(struct file_lock *caller_fl, ...@@ -862,12 +862,11 @@ static int posix_locks_deadlock(struct file_lock *caller_fl,
* whether or not a lock was successfully freed by testing the return * whether or not a lock was successfully freed by testing the return
* value for -ENOENT. * value for -ENOENT.
*/ */
static int flock_lock_file(struct file *filp, struct file_lock *request) static int flock_lock_inode(struct inode *inode, struct file_lock *request)
{ {
struct file_lock *new_fl = NULL; struct file_lock *new_fl = NULL;
struct file_lock *fl; struct file_lock *fl;
struct file_lock_context *ctx; struct file_lock_context *ctx;
struct inode *inode = file_inode(filp);
int error = 0; int error = 0;
bool found = false; bool found = false;
LIST_HEAD(dispose); LIST_HEAD(dispose);
...@@ -890,7 +889,7 @@ static int flock_lock_file(struct file *filp, struct file_lock *request) ...@@ -890,7 +889,7 @@ static int flock_lock_file(struct file *filp, struct file_lock *request)
goto find_conflict; goto find_conflict;
list_for_each_entry(fl, &ctx->flc_flock, fl_list) { list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
if (filp != fl->fl_file) if (request->fl_file != fl->fl_file)
continue; continue;
if (request->fl_type == fl->fl_type) if (request->fl_type == fl->fl_type)
goto out; goto out;
...@@ -1862,7 +1861,7 @@ int flock_lock_file_wait(struct file *filp, struct file_lock *fl) ...@@ -1862,7 +1861,7 @@ int flock_lock_file_wait(struct file *filp, struct file_lock *fl)
int error; int error;
might_sleep(); might_sleep();
for (;;) { for (;;) {
error = flock_lock_file(filp, fl); error = flock_lock_inode(file_inode(filp), fl);
if (error != FILE_LOCK_DEFERRED) if (error != FILE_LOCK_DEFERRED)
break; break;
error = wait_event_interruptible(fl->fl_wait, !fl->fl_next); error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);
...@@ -2401,7 +2400,8 @@ locks_remove_flock(struct file *filp) ...@@ -2401,7 +2400,8 @@ locks_remove_flock(struct file *filp)
.fl_type = F_UNLCK, .fl_type = F_UNLCK,
.fl_end = OFFSET_MAX, .fl_end = OFFSET_MAX,
}; };
struct file_lock_context *flctx = file_inode(filp)->i_flctx; struct inode *inode = file_inode(filp);
struct file_lock_context *flctx = inode->i_flctx;
if (list_empty(&flctx->flc_flock)) if (list_empty(&flctx->flc_flock))
return; return;
...@@ -2409,7 +2409,7 @@ locks_remove_flock(struct file *filp) ...@@ -2409,7 +2409,7 @@ locks_remove_flock(struct file *filp)
if (filp->f_op->flock) if (filp->f_op->flock)
filp->f_op->flock(filp, F_SETLKW, &fl); filp->f_op->flock(filp, F_SETLKW, &fl);
else else
flock_lock_file(filp, &fl); flock_lock_inode(inode, &fl);
if (fl.fl_ops && fl.fl_ops->fl_release_private) if (fl.fl_ops && fl.fl_ops->fl_release_private)
fl.fl_ops->fl_release_private(&fl); fl.fl_ops->fl_release_private(&fl);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment