Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs fixes from Al Viro.

 - fix io_destroy()/aio_complete() race

 - the vfs_open() change to get rid of open_check_o_direct() boilerplate
   was nice, but buggy. Al has a patch avoiding a revert, but that's
   definitely not a last-day fodder, so for now revert it is...

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  Revert "fs: fold open_check_o_direct into do_dentry_open"
  fix io_destroy()/aio_complete() race

4 files changed, 34 insertions, 21 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 8061d9787e54..49f53516eef0 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -634,9 +634,8 @@ static void free_ioctx_users(struct percpu_ref *ref)
         while (!list_empty(&ctx->active_reqs)) {
                 req = list_first_entry(&ctx->active_reqs,
                                        struct aio_kiocb, ki_list);
-
-                list_del_init(&req->ki_list);
                 kiocb_cancel(req);
+                list_del_init(&req->ki_list);
         }
 
         spin_unlock_irq(&ctx->ctx_lock);
diff --git a/fs/internal.h b/fs/internal.h
index e08972db0303..980d005b21b4 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -125,6 +125,7 @@ int do_fchmodat(int dfd, const char __user *filename, umode_t mode);
 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
                 int flag);
 
+extern int open_check_o_direct(struct file *f);
 extern int vfs_open(const struct path *, struct file *, const struct cred *);
 extern struct file *filp_clone_open(struct file *);
 
diff --git a/fs/namei.c b/fs/namei.c
index 186bd2464fd5..4eb916996345 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3367,7 +3367,9 @@ finish_open_created:
                 goto out;
         *opened |= FILE_OPENED;
 opened:
-        error = ima_file_check(file, op->acc_mode, *opened);
+        error = open_check_o_direct(file);
+        if (!error)
+                error = ima_file_check(file, op->acc_mode, *opened);
         if (!error && will_truncate)
                 error = handle_truncate(file);
 out:
@@ -3447,6 +3449,9 @@ static int do_tmpfile(struct nameidata *nd, unsigned flags,
         error = finish_open(file, child, NULL, opened);
         if (error)
                 goto out2;
+        error = open_check_o_direct(file);
+        if (error)
+                fput(file);
 out2:
         mnt_drop_write(path.mnt);
 out:
diff --git a/fs/open.c b/fs/open.c
index c5ee7cd60424..d0e955b558ad 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -724,6 +724,16 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
         return ksys_fchown(fd, user, group);
 }
 
+int open_check_o_direct(struct file *f)
+{
+        /* NB: we're sure to have correct a_ops only after f_op->open */
+        if (f->f_flags & O_DIRECT) {
+                if (!f->f_mapping->a_ops || !f->f_mapping->a_ops->direct_IO)
+                        return -EINVAL;
+        }
+        return 0;
+}
+
 static int do_dentry_open(struct file *f,
                           struct inode *inode,
                           int (*open)(struct inode *, struct file *),
@@ -745,7 +755,7 @@ static int do_dentry_open(struct file *f,
         if (unlikely(f->f_flags & O_PATH)) {
                 f->f_mode = FMODE_PATH;
                 f->f_op = &empty_fops;
-                goto done;
+                return 0;
         }
 
         if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
@@ -798,12 +808,7 @@ static int do_dentry_open(struct file *f,
         f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
 
         file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
-done:
-        /* NB: we're sure to have correct a_ops only after f_op->open */
-        error = -EINVAL;
-        if ((f->f_flags & O_DIRECT) &&
-            (!f->f_mapping->a_ops || !f->f_mapping->a_ops->direct_IO))
-                goto out_fput;
+
         return 0;
 
 cleanup_all:
@@ -818,9 +823,6 @@ cleanup_file:
         f->f_path.dentry = NULL;
         f->f_inode = NULL;
         return error;
-out_fput:
-        fput(f);
-        return error;
 }
 
 /**
@@ -918,14 +920,20 @@ struct file *dentry_open(const struct path *path, int flags,
         BUG_ON(!path->mnt);
 
         f = get_empty_filp();
-        if (IS_ERR(f))
-                return f;
-
-        f->f_flags = flags;
-        error = vfs_open(path, f, cred);
-        if (error) {
-                put_filp(f);
-                return ERR_PTR(error);
+        if (!IS_ERR(f)) {
+                f->f_flags = flags;
+                error = vfs_open(path, f, cred);
+                if (!error) {
+                        /* from now on we need fput() to dispose of f */
+                        error = open_check_o_direct(f);
+                        if (error) {
+                                fput(f);
+                                f = ERR_PTR(error);
+                        }
+                } else { 
+                        put_filp(f);
+                        f = ERR_PTR(error);
+                }
         }
         return f;
 }