summaryrefslogtreecommitdiffstats
path: root/fs (follow)
Commit message (Collapse)AuthorAgeFilesLines
* switch simple cases of fget_light to fdgetAl Viro2012-09-2728-562/+459
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch o2hb_region_dev_write() to fget_light()Al Viro2012-09-271-2/+3
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* proc_map_files_readdir(): don't bother with grabbing filesAl Viro2012-09-271-19/+9
| | | | | | all we need is their ->f_mode, so just collect _that_ Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* make get_file() return its argumentAl Viro2012-09-275-10/+5
| | | | | | simplifies a bunch of callers... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch xfs_find_handle() to fget_light()Al Viro2012-09-271-3/+3
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch xfs_swapext() to fget_light()Al Viro2012-09-271-5/+5
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch coda get_device_index() to fget_light()Al Viro2012-09-271-17/+15
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch btrfs_ioctl_clone() to fget_light()Al Viro2012-09-271-3/+3
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch timerfd_[sg]ettime(2) to fget_light()Al Viro2012-09-271-8/+9
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch epoll_wait(2) to fget_light()Al Viro2012-09-271-3/+3
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch btrfs_ioctl_snap_create_transid() to fget_light()Al Viro2012-09-271-7/+7
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch EXT4_IOC_MOVE_EXT to fget_light()Al Viro2012-09-271-3/+3
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* export fget_lightAl Viro2012-09-271-0/+1
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* ext4: close struct file leak on EXT4_IOC_MOVE_EXTAl Viro2012-09-271-1/+2
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch fchmod(2) to fget_light()Al Viro2012-09-271-7/+5
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch fallocate(2) to fget_light()Al Viro2012-09-271-3/+3
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* switch ftruncate(2) to fget_lightAl Viro2012-09-271-5/+5
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* namei.c: fix BS commentAl Viro2012-09-271-1/+1
| | | | | | | get_write_access() is needed for nfsd, not binfmt_aout (the latter has no business doing anything of that kind, of course) Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* don't leak O_CLOEXEC into ->f_flagsAl Viro2012-09-272-2/+2
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* procfs: Convert /proc/pid/fdinfo/ handling routines to seq-file v2Cyrill Gorcunov2012-09-271-48/+64
| | | | | | | | | | | This patch converts /proc/pid/fdinfo/ handling routines to seq-file which is needed to extend seq operations and plug in auxiliary fdinfo provides from subsystems like eventfd/eventpoll/fsnotify. Note the proc_fd_link no longer call for proc_fd_info, simply because the guts of proc_fd_info() got merged into ->show() of that seq_file Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* procfs: Move /proc/pid/fd[info] handling code to fd.[ch]Cyrill Gorcunov2012-09-275-387/+416
| | | | | | | | | | | | | | | | | | | | | | This patch prepares the ground for further extension of /proc/pid/fd[info] handling code by moving fdinfo handling code into fs/proc/fd.c. I think such move makes both fs/proc/base.c and fs/proc/fd.c easier to read. Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org> Acked-by: Pavel Emelyanov <xemul@parallels.com> CC: Al Viro <viro@ZenIV.linux.org.uk> CC: Alexey Dobriyan <adobriyan@gmail.com> CC: Andrew Morton <akpm@linux-foundation.org> CC: James Bottomley <jbottomley@parallels.com> CC: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com> CC: Alexey Dobriyan <adobriyan@gmail.com> CC: Matthew Helsley <matt.helsley@gmail.com> CC: "J. Bruce Fields" <bfields@fieldses.org> CC: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com> Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* new helper: daemonize_descriptors()Al Viro2012-09-271-0/+6
| | | | | | | | descriptor-related parts of daemonize, done right. As the result we simplify the locking rules for ->files - we hold task_lock in *all* cases when we modify ->files. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* do_coredump(): make sure that descriptor table isn't sharedAl Viro2012-09-271-0/+7
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* new helper: iterate_fd()Al Viro2012-09-271-0/+21
| | | | | | | | | | | | | iterates through the opened files in given descriptor table, calling a supplied function; we stop once non-zero is returned. Callback gets struct file *, descriptor number and const void * argument passed to iterator. It is called with files->file_lock held, so it is not allowed to block. tty_io, netprio_cgroup and selinux flush_unauthorized_files() converted to its use. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* make expand_files() and alloc_fd() staticAl Viro2012-09-271-2/+2
| | | | | | no callers outside of fs/file.c left Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* take __{set,clear}_{open_fd,close_on_exec}() into fs/file.cAl Viro2012-09-271-0/+20
| | | | | | nobody uses those outside anymore. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* new helper: replace_fd()Al Viro2012-09-272-39/+63
| | | | | | analog of dup2(), except that it takes struct file * as source. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* take purely descriptor-related stuff from fcntl.c to file.cAl Viro2012-09-272-128/+135
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* take close-on-exec logics to fs/file.c, clean it up a bitAl Viro2012-09-272-35/+43
| | | | | | | ... and add cond_resched() there, while we are at it. We can get large latencies as is... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* take descriptor-related part of close() to file.cAl Viro2012-09-272-21/+27
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* take fget() and friends to fs/file.cAl Viro2012-09-272-106/+106
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* expose a low-level variant of fd_install() for binderAl Viro2012-09-271-2/+14
| | | | | | | | | | | | | | Similar situation to that of __alloc_fd(); do not use unless you really have to. You should not touch any descriptor table other than your own; it's a sure sign of a really bad API design. As with __alloc_fd(), you *must* use a first-class reference to struct files_struct; something obtained by get_files_struct(some task) (let alone direct task->files) will not do. It must be either current->files, or obtained by get_files_struct(current) by the owner of that sucker and given to you. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* move put_unused_fd() and fd_install() to fs/file.cAl Viro2012-09-272-44/+44
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* trim free_fdtable_rcu()Al Viro2012-09-271-15/+2
| | | | | | embedded case isn't hit anymore Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* don't bother with call_rcu() in put_files_struct()Al Viro2012-09-271-9/+5
| | | | | | | | | | | At that point nobody can see us anyway; everything that looks at files_fdtable(files) is separated from the guts of put_files_struct(files) - either since files is current->files or because we fetched it under task_lock() and hadn't dropped that yet, or because we'd bumped files->count while holding task_lock()... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* move files_struct-related bits from kernel/exit.c to fs/file.cAl Viro2012-09-271-1/+99
| | | | Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* new helper: __alloc_fd()Al Viro2012-09-271-4/+8
| | | | | | | | | | | Essentially, alloc_fd() in a files_struct we own a reference to. Most of the time wanting to use it is a sign of lousy API design (such as android/binder). It's *not* a general-purpose interface; better that than open-coding its guts, but again, playing with other process' descriptor table is a sign of bad design. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* take rlimit check to callers of expand_files()Al Viro2012-09-272-7/+12
| | | | | | | | ... except for one in android, where the check is different and already done in caller. No need to recalculate rlimit many times in alloc_fd() either. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* fanotify: sanitize failure exits in copy_event_to_user()Al Viro2012-09-271-39/+20
| | | | | | | | | | * do copy_to_user() before prepare_for_access_response(); that kills the need in remove_access_response(). * don't do fd_install() until we are past the last possible failure exit. Don't use sys_close() on cleanup side - just put_unused_fd() and fput(). Less racy that way... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* pipe(2) - race-free error recoveryAl Viro2012-09-271-9/+22
| | | | | | | don't mess with sys_close() if copy_to_user() fails; just postpone fd_install() until we know it hasn't. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* autofs4: don't open-code fd_install()Al Viro2012-09-271-16/+2
| | | | | | | | | The only difference between autofs_dev_ioctl_fd_install() and fd_install() is __set_close_on_exec() done by the latter. Just use get_unused_fd_flags(O_CLOEXEC) to allocate the descriptor and be done with that... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* make get_unused_fd_flags() a functionAl Viro2012-09-271-3/+3
| | | | | | ... and get_unused_fd() a macro around it Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
* Merge remote branch 'origin' into for-nextAl Viro2012-09-2781-672/+804
|\
| * Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6Linus Torvalds2012-09-221-1/+1
| |\ | | | | | | | | | | | | | | | | | | Pull cifs fix from Steve French. * 'for-linus' of git://git.samba.org/sfrench/cifs-2.6: cifs: fix return value in cifsConvertToUTF16
| | * cifs: fix return value in cifsConvertToUTF16Jeff Layton2012-09-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function returns the wrong value, which causes the callers to get the length of the resulting pathname wrong when it contains non-ASCII characters. This seems to fix https://bugzilla.samba.org/show_bug.cgi?id=6767 Cc: <stable@vger.kernel.org> Reported-by: Baldvin Kovacs <baldvin.kovacs@gmail.com> Reported-and-Tested-by: Nicolas Lefebvre <nico.lefebvre@gmail.com> Signed-off-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Steve French <smfrench@gmail.com>
| * | Merge tag 'for-linus-v3.6-rc7' of git://oss.sgi.com/xfs/xfsLinus Torvalds2012-09-213-18/+29
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull xfs bugfixes from Ben Myers: - fix a regression related to xfs_sync_worker racing with unmount. - fix a race while discarding xfs buffers. * tag 'for-linus-v3.6-rc7' of git://oss.sgi.com/xfs/xfs: xfs: stop the sync worker before xfs_unmountfs xfs: fix race while discarding buffers [V4]
| | * | xfs: stop the sync worker before xfs_unmountfsBen Myers2012-09-181-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Cancel work of the xfs_sync_worker before teardown of the log in xfs_unmountfs. This prevents occasional crashes on unmount like so: PID: 21602 TASK: ee9df060 CPU: 0 COMMAND: "kworker/0:3" #0 [c5377d28] crash_kexec at c0292c94 #1 [c5377d80] oops_end at c07090c2 #2 [c5377d98] no_context at c06f614e #3 [c5377dbc] __bad_area_nosemaphore at c06f6281 #4 [c5377df4] bad_area_nosemaphore at c06f629b #5 [c5377e00] do_page_fault at c070b0cb #6 [c5377e7c] error_code (via page_fault) at c070892c EAX: f300c6a8 EBX: f300c6a8 ECX: 000000c0 EDX: 000000c0 EBP: c5377ed0 DS: 007b ESI: 00000000 ES: 007b EDI: 00000001 GS: ffffad20 CS: 0060 EIP: c0481ad0 ERR: ffffffff EFLAGS: 00010246 #7 [c5377eb0] atomic64_read_cx8 at c0481ad0 #8 [c5377ebc] xlog_assign_tail_lsn_locked at f7cc7c6e [xfs] #9 [c5377ed4] xfs_trans_ail_delete_bulk at f7ccd520 [xfs] #10 [c5377f0c] xfs_buf_iodone at f7ccb602 [xfs] #11 [c5377f24] xfs_buf_do_callbacks at f7cca524 [xfs] #12 [c5377f30] xfs_buf_iodone_callbacks at f7cca5da [xfs] #13 [c5377f4c] xfs_buf_iodone_work at f7c718d0 [xfs] #14 [c5377f58] process_one_work at c024ee4c #15 [c5377f98] worker_thread at c024f43d #16 [c5377fbc] kthread at c025326b #17 [c5377fe8] kernel_thread_helper at c070e834 PID: 26653 TASK: e79143b0 CPU: 3 COMMAND: "umount" #0 [cde0fda0] __schedule at c0706595 #1 [cde0fe28] schedule at c0706b89 #2 [cde0fe30] schedule_timeout at c0705600 #3 [cde0fe94] __down_common at c0706098 #4 [cde0fec8] __down at c0706122 #5 [cde0fed0] down at c025936f #6 [cde0fee0] xfs_buf_lock at f7c7131d [xfs] #7 [cde0ff00] xfs_freesb at f7cc2236 [xfs] #8 [cde0ff10] xfs_fs_put_super at f7c80f21 [xfs] #9 [cde0ff1c] generic_shutdown_super at c0333d7a #10 [cde0ff38] kill_block_super at c0333e0f #11 [cde0ff48] deactivate_locked_super at c0334218 #12 [cde0ff58] deactivate_super at c033495d #13 [cde0ff68] mntput_no_expire at c034bc13 #14 [cde0ff7c] sys_umount at c034cc69 #15 [cde0ffa0] sys_oldumount at c034ccd4 #16 [cde0ffb0] system_call at c0707e66 commit 11159a05 added this to xfs_log_unmount and needs to be cleaned up at a later date. Signed-off-by: Ben Myers <bpm@sgi.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Reviewed-by: Mark Tinguely <tinguely@sgi.com>
| | * | xfs: fix race while discarding buffers [V4]Carlos Maiolino2012-08-292-18/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | While xfs_buftarg_shrink() is freeing buffers from the dispose list (filled with buffers from lru list), there is a possibility to have xfs_buf_stale() racing with it, and removing buffers from dispose list before xfs_buftarg_shrink() does it. This happens because xfs_buftarg_shrink() handle the dispose list without locking and the test condition in xfs_buf_stale() checks for the buffer being in *any* list: if (!list_empty(&bp->b_lru)) If the buffer happens to be on dispose list, this causes the buffer counter of lru list (btp->bt_lru_nr) to be decremented twice (once in xfs_buftarg_shrink() and another in xfs_buf_stale()) causing a wrong account usage of the lru list. This may cause xfs_buftarg_shrink() to return a wrong value to the memory shrinker shrink_slab(), and such account error may also cause an underflowed value to be returned; since the counter is lower than the current number of items in the lru list, a decrement may happen when the counter is 0, causing an underflow on the counter. The fix uses a new flag field (and a new buffer flag) to serialize buffer handling during the shrink process. The new flag field has been designed to use btp->bt_lru_lock/unlock instead of xfs_buf_lock/unlock mechanism. dchinner, sandeen, aquini and aris also deserve credits for this. Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com> Reviewed-by: Ben Myers <bpm@sgi.com> Reviewed-by: Dave Chinner <dchinner@redhat.com> Signed-off-by: Ben Myers <bpm@sgi.com>
| * | | debugfs: fix u32_array race in format_array_allocLinus Torvalds2012-09-211-34/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The format_array_alloc() function is fundamentally racy, in that it prints the array twice: once to figure out how much space to allocate for the buffer, and the second time to actually print out the data. If any of the array contents changes in between, the allocation size may be wrong, and the end result may be truncated in odd ways. Just don't do it. Allocate a maximum-sized array up-front, and just format the array contents once. The only user of the u32_array interfaces is the Xen spinlock statistics code, and it has 31 entries in the arrays, so the maximum size really isn't that big, and the end result is much simpler code without the bug. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | debugfs: fix race in u32_array_read and allocate array at openDavid Rientjes2012-09-211-22/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | u32_array_open() is racy when multiple threads read from a file with a seek position of zero, i.e. when two or more simultaneous reads are occurring after the non-seekable files are created. It is possible that file->private_data is double-freed because the threads races between kfree(file->private-data); and file->private_data = NULL; The fix is to only do format_array_alloc() when the file is opened and free it when it is closed. Note that because the file has always been non-seekable, you can't open it and read it multiple times anyway, so the data has always been generated just once. The difference is that now it is generated at open time rather than at the time of the first read, and that avoids the race. Reported-by: Dave Jones <davej@redhat.com> Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> Tested-by: Raghavendra <raghavendra.kt@linux.vnet.ibm.com> Signed-off-by: David Rientjes <rientjes@google.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-06 06:46:51 +0100