Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc vfs updates from Al Viro:
 "All kinds of misc stuff, without any unifying topic, from various
  people.

  Neil's d_anon patch, several bugfixes, introduction of kvmalloc
  analogue of kmemdup_user(), extending bitfield.h to deal with
  fixed-endians, assorted cleanups all over the place..."

* 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (28 commits)
  alpha: osf_sys.c: use timespec64 where appropriate
  alpha: osf_sys.c: fix put_tv32 regression
  jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
  dcache: delete unused d_hash_mask
  dcache: subtract d_hash_shift from 32 in advance
  fs/buffer.c: fold init_buffer() into init_page_buffers()
  fs: fold __inode_permission() into inode_permission()
  fs: add RWF_APPEND
  sctp: use vmemdup_user() rather than badly open-coding memdup_user()
  snd_ctl_elem_init_enum_names(): switch to vmemdup_user()
  replace_user_tlv(): switch to vmemdup_user()
  new primitive: vmemdup_user()
  memdup_user(): switch to GFP_USER
  eventfd: fold eventfd_ctx_get() into eventfd_ctx_fileget()
  eventfd: fold eventfd_ctx_read() into eventfd_read()
  eventfd: convert to use anon_inode_getfd()
  nfs4file: get rid of pointless include of btrfs.h
  uvc_v4l2: clean copyin/copyout up
  vme_user: don't use __copy_..._user()
  usx2y: don't bother with memdup_user() for 16-byte structure
  ...

1 files changed, 28 insertions, 99 deletions

diff --git a/fs/eventfd.c b/fs/eventfd.c
index 6318a9b57e53..04fd824142a1 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -80,24 +80,11 @@ static void eventfd_free(struct kref *kref)
 }
 
 /**
- * eventfd_ctx_get - Acquires a reference to the internal eventfd context.
- * @ctx: [in] Pointer to the eventfd context.
- *
- * Returns: In case of success, returns a pointer to the eventfd context.
- */
-struct eventfd_ctx *eventfd_ctx_get(struct eventfd_ctx *ctx)
-{
-        kref_get(&ctx->kref);
-        return ctx;
-}
-EXPORT_SYMBOL_GPL(eventfd_ctx_get);
-
-/**
  * eventfd_ctx_put - Releases a reference to the internal eventfd context.
  * @ctx: [in] Pointer to eventfd context.
  *
  * The eventfd context reference must have been previously acquired either
- * with eventfd_ctx_get() or eventfd_ctx_fdget().
+ * with eventfd_ctx_fdget() or eventfd_ctx_fileget().
  */
 void eventfd_ctx_put(struct eventfd_ctx *ctx)
 {
@@ -207,36 +194,27 @@ int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *w
 }
 EXPORT_SYMBOL_GPL(eventfd_ctx_remove_wait_queue);
 
-/**
- * eventfd_ctx_read - Reads the eventfd counter or wait if it is zero.
- * @ctx: [in] Pointer to eventfd context.
- * @no_wait: [in] Different from zero if the operation should not block.
- * @cnt: [out] Pointer to the 64-bit counter value.
- *
- * Returns %0 if successful, or the following error codes:
- *
- *  - -EAGAIN      : The operation would have blocked but @no_wait was non-zero.
- *  - -ERESTARTSYS : A signal interrupted the wait operation.
- *
- * If @no_wait is zero, the function might sleep until the eventfd internal
- * counter becomes greater than zero.
- */
-ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt)
+static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
+                            loff_t *ppos)
 {
+        struct eventfd_ctx *ctx = file->private_data;
         ssize_t res;
+        __u64 ucnt = 0;
         DECLARE_WAITQUEUE(wait, current);
 
+        if (count < sizeof(ucnt))
+                return -EINVAL;
+
         spin_lock_irq(&ctx->wqh.lock);
-        *cnt = 0;
         res = -EAGAIN;
         if (ctx->count > 0)
-                res = 0;
-        else if (!no_wait) {
+                res = sizeof(ucnt);
+        else if (!(file->f_flags & O_NONBLOCK)) {
                 __add_wait_queue(&ctx->wqh, &wait);
                 for (;;) {
                         set_current_state(TASK_INTERRUPTIBLE);
                         if (ctx->count > 0) {
-                                res = 0;
+                                res = sizeof(ucnt);
                                 break;
                         }
                         if (signal_pending(current)) {
@@ -250,31 +228,17 @@ ssize_t eventfd_ctx_read(struct eventfd_ctx *ctx, int no_wait, __u64 *cnt)
                 __remove_wait_queue(&ctx->wqh, &wait);
                 __set_current_state(TASK_RUNNING);
         }
-        if (likely(res == 0)) {
-                eventfd_ctx_do_read(ctx, cnt);
+        if (likely(res > 0)) {
+                eventfd_ctx_do_read(ctx, &ucnt);
                 if (waitqueue_active(&ctx->wqh))
                         wake_up_locked_poll(&ctx->wqh, POLLOUT);
         }
         spin_unlock_irq(&ctx->wqh.lock);
 
-        return res;
-}
-EXPORT_SYMBOL_GPL(eventfd_ctx_read);
-
-static ssize_t eventfd_read(struct file *file, char __user *buf, size_t count,
-                            loff_t *ppos)
-{
-        struct eventfd_ctx *ctx = file->private_data;
-        ssize_t res;
-        __u64 cnt;
-
-        if (count < sizeof(cnt))
-                return -EINVAL;
-        res = eventfd_ctx_read(ctx, file->f_flags & O_NONBLOCK, &cnt);
-        if (res < 0)
-                return res;
+        if (res > 0 && put_user(ucnt, (__u64 __user *)buf))
+                return -EFAULT;
 
-        return put_user(cnt, (__u64 __user *) buf) ? -EFAULT : sizeof(cnt);
+        return res;
 }
 
 static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t count,
@@ -405,79 +369,44 @@ EXPORT_SYMBOL_GPL(eventfd_ctx_fdget);
  */
 struct eventfd_ctx *eventfd_ctx_fileget(struct file *file)
 {
+        struct eventfd_ctx *ctx;
+
         if (file->f_op != &eventfd_fops)
                 return ERR_PTR(-EINVAL);
 
-        return eventfd_ctx_get(file->private_data);
+        ctx = file->private_data;
+        kref_get(&ctx->kref);
+        return ctx;
 }
 EXPORT_SYMBOL_GPL(eventfd_ctx_fileget);
 
-/**
- * eventfd_file_create - Creates an eventfd file pointer.
- * @count: Initial eventfd counter value.
- * @flags: Flags for the eventfd file.
- *
- * This function creates an eventfd file pointer, w/out installing it into
- * the fd table. This is useful when the eventfd file is used during the
- * initialization of data structures that require extra setup after the eventfd
- * creation. So the eventfd creation is split into the file pointer creation
- * phase, and the file descriptor installation phase.
- * In this way races with userspace closing the newly installed file descriptor
- * can be avoided.
- * Returns an eventfd file pointer, or a proper error pointer.
- */
-struct file *eventfd_file_create(unsigned int count, int flags)
+SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
 {
-        struct file *file;
         struct eventfd_ctx *ctx;
+        int fd;
 
         /* Check the EFD_* constants for consistency.  */
         BUILD_BUG_ON(EFD_CLOEXEC != O_CLOEXEC);
         BUILD_BUG_ON(EFD_NONBLOCK != O_NONBLOCK);
 
         if (flags & ~EFD_FLAGS_SET)
-                return ERR_PTR(-EINVAL);
+                return -EINVAL;
 
         ctx = kmalloc(sizeof(*ctx), GFP_KERNEL);
         if (!ctx)
-                return ERR_PTR(-ENOMEM);
+                return -ENOMEM;
 
         kref_init(&ctx->kref);
         init_waitqueue_head(&ctx->wqh);
         ctx->count = count;
         ctx->flags = flags;
 
-        file = anon_inode_getfile("[eventfd]", &eventfd_fops, ctx,
-                                  O_RDWR | (flags & EFD_SHARED_FCNTL_FLAGS));
-        if (IS_ERR(file))
+        fd = anon_inode_getfd("[eventfd]", &eventfd_fops, ctx,
+                              O_RDWR | (flags & EFD_SHARED_FCNTL_FLAGS));
+        if (fd < 0)
                 eventfd_free_ctx(ctx);
 
-        return file;
-}
-
-SYSCALL_DEFINE2(eventfd2, unsigned int, count, int, flags)
-{
-        int fd, error;
-        struct file *file;
-
-        error = get_unused_fd_flags(flags & EFD_SHARED_FCNTL_FLAGS);
-        if (error < 0)
-                return error;
-        fd = error;
-
-        file = eventfd_file_create(count, flags);
-        if (IS_ERR(file)) {
-                error = PTR_ERR(file);
-                goto err_put_unused_fd;
-        }
-        fd_install(fd, file);
-
         return fd;
-
-err_put_unused_fd:
-        put_unused_fd(fd);
-
-        return error;
 }
 
 SYSCALL_DEFINE1(eventfd, unsigned int, count)