Merge tag 'driver-core-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core updates from Greg KH:
 "Here's the "big" driver core update for 4.7-rc1.

  Mostly just debugfs changes, the long-known and messy races with
  removing debugfs files should be fixed thanks to the great work of
  Nicolai Stange.  We also have some isa updates in here (the x86
  maintainers told me to take it through this tree), a new warning when
  we run out of dynamic char major numbers, and a few other assorted
  changes, details in the shortlog.

  All have been in linux-next for some time with no reported issues"

* tag 'driver-core-4.7-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (32 commits)
  Revert "base: dd: don't remove driver_data in -EPROBE_DEFER case"
  gpio: ws16c48: Utilize the ISA bus driver
  gpio: 104-idio-16: Utilize the ISA bus driver
  gpio: 104-idi-48: Utilize the ISA bus driver
  gpio: 104-dio-48e: Utilize the ISA bus driver
  watchdog: ebc-c384_wdt: Utilize the ISA bus driver
  iio: stx104: Utilize the module_isa_driver and max_num_isa_dev macros
  iio: stx104: Add X86 dependency to STX104 Kconfig option
  Documentation: Add ISA bus driver documentation
  isa: Implement the max_num_isa_dev macro
  isa: Implement the module_isa_driver macro
  pnp: pnpbios: Add explicit X86_32 dependency to PNPBIOS
  isa: Decouple X86_32 dependency from the ISA Kconfig option
  driver-core: use 'dev' argument in dev_dbg_ratelimited stub
  base: dd: don't remove driver_data in -EPROBE_DEFER case
  kernfs: Move faulting copy_user operations outside of the mutex
  devcoredump: add scatterlist support
  debugfs: unproxify files created through debugfs_create_u32_array()
  debugfs: unproxify files created through debugfs_create_blob()
  debugfs: unproxify files created through debugfs_create_bool()
  ...

1 files changed, 29 insertions, 22 deletions

diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 7247252ee9b1..e1574008adc9 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -190,15 +190,16 @@ static ssize_t kernfs_file_direct_read(struct kernfs_open_file *of,
         char *buf;
 
         buf = of->prealloc_buf;
-        if (!buf)
+        if (buf)
+                mutex_lock(&of->prealloc_mutex);
+        else
                 buf = kmalloc(len, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
         /*
          * @of->mutex nests outside active ref and is used both to ensure that
-         * the ops aren't called concurrently for the same open file, and
-         * to provide exclusive access to ->prealloc_buf (when that exists).
+         * the ops aren't called concurrently for the same open file.
          */
         mutex_lock(&of->mutex);
         if (!kernfs_get_active(of->kn)) {
@@ -214,21 +215,23 @@ static ssize_t kernfs_file_direct_read(struct kernfs_open_file *of,
         else
                 len = -EINVAL;
 
+        kernfs_put_active(of->kn);
+        mutex_unlock(&of->mutex);
+
         if (len < 0)
-                goto out_unlock;
+                goto out_free;
 
         if (copy_to_user(user_buf, buf, len)) {
                 len = -EFAULT;
-                goto out_unlock;
+                goto out_free;
         }
 
         *ppos += len;
 
- out_unlock:
-        kernfs_put_active(of->kn);
-        mutex_unlock(&of->mutex);
  out_free:
-        if (buf != of->prealloc_buf)
+        if (buf == of->prealloc_buf)
+                mutex_unlock(&of->prealloc_mutex);
+        else
                 kfree(buf);
         return len;
 }
@@ -284,15 +287,22 @@ static ssize_t kernfs_fop_write(struct file *file, const char __user *user_buf,
         }
 
         buf = of->prealloc_buf;
-        if (!buf)
+        if (buf)
+                mutex_lock(&of->prealloc_mutex);
+        else
                 buf = kmalloc(len + 1, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
+        if (copy_from_user(buf, user_buf, len)) {
+                len = -EFAULT;
+                goto out_free;
+        }
+        buf[len] = '\0';        /* guarantee string termination */
+
         /*
          * @of->mutex nests outside active ref and is used both to ensure that
-         * the ops aren't called concurrently for the same open file, and
-         * to provide exclusive access to ->prealloc_buf (when that exists).
+         * the ops aren't called concurrently for the same open file.
          */
         mutex_lock(&of->mutex);
         if (!kernfs_get_active(of->kn)) {
@@ -301,26 +311,22 @@ static ssize_t kernfs_fop_write(struct file *file, const char __user *user_buf,
                 goto out_free;
         }
 
-        if (copy_from_user(buf, user_buf, len)) {
-                len = -EFAULT;
-                goto out_unlock;
-        }
-        buf[len] = '\0';        /* guarantee string termination */
-
         ops = kernfs_ops(of->kn);
         if (ops->write)
                 len = ops->write(of, buf, len, *ppos);
         else
                 len = -EINVAL;
 
+        kernfs_put_active(of->kn);
+        mutex_unlock(&of->mutex);
+
         if (len > 0)
                 *ppos += len;
 
-out_unlock:
-        kernfs_put_active(of->kn);
-        mutex_unlock(&of->mutex);
 out_free:
-        if (buf != of->prealloc_buf)
+        if (buf == of->prealloc_buf)
+                mutex_unlock(&of->prealloc_mutex);
+        else
                 kfree(buf);
         return len;
 }
@@ -687,6 +693,7 @@ static int kernfs_fop_open(struct inode *inode, struct file *file)
                 error = -ENOMEM;
                 if (!of->prealloc_buf)
                         goto err_free;
+                mutex_init(&of->prealloc_mutex);
         }
 
         /*