1 files changed, 170 insertions, 28 deletions

diff --git a/fs/inode.c b/fs/inode.c
index 9f4f5fecc09..c99163b1b31 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -135,8 +135,8 @@ int inode_init_always(struct super_block *sb, struct inode *inode)
         inode->i_fop = &empty_fops;
         inode->__i_nlink = 1;
         inode->i_opflags = 0;
-        inode->i_uid = 0;
-        inode->i_gid = 0;
+        i_uid_write(inode, 0);
+        i_gid_write(inode, 0);
         atomic_set(&inode->i_writecount, 0);
         inode->i_size = 0;
         inode->i_blocks = 0;
@@ -486,7 +486,7 @@ void __remove_inode_hash(struct inode *inode)
 }
 EXPORT_SYMBOL(__remove_inode_hash);
 
-void end_writeback(struct inode *inode)
+void clear_inode(struct inode *inode)
 {
         might_sleep();
         /*
@@ -500,11 +500,10 @@ void end_writeback(struct inode *inode)
         BUG_ON(!list_empty(&inode->i_data.private_list));
         BUG_ON(!(inode->i_state & I_FREEING));
         BUG_ON(inode->i_state & I_CLEAR);
-        inode_sync_wait(inode);
         /* don't need i_lock here, no concurrent mods to i_state */
         inode->i_state = I_FREEING | I_CLEAR;
 }
-EXPORT_SYMBOL(end_writeback);
+EXPORT_SYMBOL(clear_inode);
 
 /*
  * Free the inode passed in, removing it from the lists it is still connected
@@ -531,12 +530,20 @@ static void evict(struct inode *inode)
 
         inode_sb_list_del(inode);
 
+        /*
+         * Wait for flusher thread to be done with the inode so that filesystem
+         * does not start destroying it while writeback is still running. Since
+         * the inode has I_FREEING set, flusher thread won't start new work on
+         * the inode.  We just have to wait for running writeback to finish.
+         */
+        inode_wait_for_writeback(inode);
+
         if (op->evict_inode) {
                 op->evict_inode(inode);
         } else {
                 if (inode->i_data.nrpages)
                         truncate_inode_pages(&inode->i_data, 0);
-                end_writeback(inode);
+                clear_inode(inode);
         }
         if (S_ISBLK(inode->i_mode) && inode->i_bdev)
                 bd_forget(inode);
@@ -1480,10 +1487,30 @@ static int relatime_need_update(struct vfsmount *mnt, struct inode *inode,
         return 0;
 }
 
+/*
+ * This does the actual work of updating an inodes time or version.  Must have
+ * had called mnt_want_write() before calling this.
+ */
+static int update_time(struct inode *inode, struct timespec *time, int flags)
+{
+        if (inode->i_op->update_time)
+                return inode->i_op->update_time(inode, time, flags);
+
+        if (flags & S_ATIME)
+                inode->i_atime = *time;
+        if (flags & S_VERSION)
+                inode_inc_iversion(inode);
+        if (flags & S_CTIME)
+                inode->i_ctime = *time;
+        if (flags & S_MTIME)
+                inode->i_mtime = *time;
+        mark_inode_dirty_sync(inode);
+        return 0;
+}
+
 /**
  *      touch_atime     -       update the access time
- *      @mnt: mount the inode is accessed on
- *      @dentry: dentry accessed
+ *      @path: the &struct path to update
  *
  *      Update the accessed time on an inode and mark it for writeback.
  *      This function automatically handles read only file systems and media,
@@ -1518,12 +1545,83 @@ void touch_atime(struct path *path)
         if (mnt_want_write(mnt))
                 return;
 
-        inode->i_atime = now;
-        mark_inode_dirty_sync(inode);
+        /*
+         * File systems can error out when updating inodes if they need to
+         * allocate new space to modify an inode (such is the case for
+         * Btrfs), but since we touch atime while walking down the path we
+         * really don't care if we failed to update the atime of the file,
+         * so just ignore the return value.
+         */
+        update_time(inode, &now, S_ATIME);
         mnt_drop_write(mnt);
 }
 EXPORT_SYMBOL(touch_atime);
 
+/*
+ * The logic we want is
+ *
+ *      if suid or (sgid and xgrp)
+ *              remove privs
+ */
+int should_remove_suid(struct dentry *dentry)
+{
+        umode_t mode = dentry->d_inode->i_mode;
+        int kill = 0;
+
+        /* suid always must be killed */
+        if (unlikely(mode & S_ISUID))
+                kill = ATTR_KILL_SUID;
+
+        /*
+         * sgid without any exec bits is just a mandatory locking mark; leave
+         * it alone.  If some exec bits are set, it's a real sgid; kill it.
+         */
+        if (unlikely((mode & S_ISGID) && (mode & S_IXGRP)))
+                kill |= ATTR_KILL_SGID;
+
+        if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
+                return kill;
+
+        return 0;
+}
+EXPORT_SYMBOL(should_remove_suid);
+
+static int __remove_suid(struct dentry *dentry, int kill)
+{
+        struct iattr newattrs;
+
+        newattrs.ia_valid = ATTR_FORCE | kill;
+        return notify_change(dentry, &newattrs);
+}
+
+int file_remove_suid(struct file *file)
+{
+        struct dentry *dentry = file->f_path.dentry;
+        struct inode *inode = dentry->d_inode;
+        int killsuid;
+        int killpriv;
+        int error = 0;
+
+        /* Fast path for nothing security related */
+        if (IS_NOSEC(inode))
+                return 0;
+
+        killsuid = should_remove_suid(dentry);
+        killpriv = security_inode_need_killpriv(dentry);
+
+        if (killpriv < 0)
+                return killpriv;
+        if (killpriv)
+                error = security_inode_killpriv(dentry);
+        if (!error && killsuid)
+                error = __remove_suid(dentry, killsuid);
+        if (!error && (inode->i_sb->s_flags & MS_NOSEC))
+                inode->i_flags |= S_NOSEC;
+
+        return error;
+}
+EXPORT_SYMBOL(file_remove_suid);
+
 /**
  *      file_update_time        -       update mtime and ctime time
  *      @file: file accessed
@@ -1533,18 +1631,20 @@ EXPORT_SYMBOL(touch_atime);
  *      usage in the file write path of filesystems, and filesystems may
  *      choose to explicitly ignore update via this function with the
  *      S_NOCMTIME inode flag, e.g. for network filesystem where these
- *      timestamps are handled by the server.
+ *      timestamps are handled by the server.  This can return an error for
+ *      file systems who need to allocate space in order to update an inode.
  */
 
-void file_update_time(struct file *file)
+int file_update_time(struct file *file)
 {
         struct inode *inode = file->f_path.dentry->d_inode;
         struct timespec now;
-        enum { S_MTIME = 1, S_CTIME = 2, S_VERSION = 4 } sync_it = 0;
+        int sync_it = 0;
+        int ret;
 
         /* First try to exhaust all avenues to not sync */
         if (IS_NOCMTIME(inode))
-                return;
+                return 0;
 
         now = current_fs_time(inode->i_sb);
         if (!timespec_equal(&inode->i_mtime, &now))
@@ -1557,21 +1657,16 @@ void file_update_time(struct file *file)
                 sync_it |= S_VERSION;
 
         if (!sync_it)
-                return;
+                return 0;
 
         /* Finally allowed to write? Takes lock. */
         if (mnt_want_write_file(file))
-                return;
+                return 0;
 
-        /* Only change inode inside the lock region */
-        if (sync_it & S_VERSION)
-                inode_inc_iversion(inode);
-        if (sync_it & S_CTIME)
-                inode->i_ctime = now;
-        if (sync_it & S_MTIME)
-                inode->i_mtime = now;
-        mark_inode_dirty_sync(inode);
+        ret = update_time(inode, &now, sync_it);
         mnt_drop_write_file(file);
+
+        return ret;
 }
 EXPORT_SYMBOL(file_update_time);
 
@@ -1647,6 +1742,7 @@ void __init inode_init_early(void)
                                         HASH_EARLY,
                                         &i_hash_shift,
                                         &i_hash_mask,
+                                        0,
                                         0);
 
         for (loop = 0; loop < (1U << i_hash_shift); loop++)
@@ -1677,6 +1773,7 @@ void __init inode_init(void)
                                         0,
                                         &i_hash_shift,
                                         &i_hash_mask,
+                                        0,
                                         0);
 
         for (loop = 0; loop < (1U << i_hash_shift); loop++)
@@ -1732,12 +1829,57 @@ EXPORT_SYMBOL(inode_init_owner);
  */
 bool inode_owner_or_capable(const struct inode *inode)
 {
-        struct user_namespace *ns = inode_userns(inode);
-
-        if (current_user_ns() == ns && current_fsuid() == inode->i_uid)
+        if (uid_eq(current_fsuid(), inode->i_uid))
                 return true;
-        if (ns_capable(ns, CAP_FOWNER))
+        if (inode_capable(inode, CAP_FOWNER))
                 return true;
         return false;
 }
 EXPORT_SYMBOL(inode_owner_or_capable);
+
+/*
+ * Direct i/o helper functions
+ */
+static void __inode_dio_wait(struct inode *inode)
+{
+        wait_queue_head_t *wq = bit_waitqueue(&inode->i_state, __I_DIO_WAKEUP);
+        DEFINE_WAIT_BIT(q, &inode->i_state, __I_DIO_WAKEUP);
+
+        do {
+                prepare_to_wait(wq, &q.wait, TASK_UNINTERRUPTIBLE);
+                if (atomic_read(&inode->i_dio_count))
+                        schedule();
+        } while (atomic_read(&inode->i_dio_count));
+        finish_wait(wq, &q.wait);
+}
+
+/**
+ * inode_dio_wait - wait for outstanding DIO requests to finish
+ * @inode: inode to wait for
+ *
+ * Waits for all pending direct I/O requests to finish so that we can
+ * proceed with a truncate or equivalent operation.
+ *
+ * Must be called under a lock that serializes taking new references
+ * to i_dio_count, usually by inode->i_mutex.
+ */
+void inode_dio_wait(struct inode *inode)
+{
+        if (atomic_read(&inode->i_dio_count))
+                __inode_dio_wait(inode);
+}
+EXPORT_SYMBOL(inode_dio_wait);
+
+/*
+ * inode_dio_done - signal finish of a direct I/O requests
+ * @inode: inode the direct I/O happens on
+ *
+ * This is called once we've finished processing a direct I/O request,
+ * and is used to wake up callers waiting for direct I/O to be quiesced.
+ */
+void inode_dio_done(struct inode *inode)
+{
+        if (atomic_dec_and_test(&inode->i_dio_count))
+                wake_up_bit(&inode->i_state, __I_DIO_WAKEUP);
+}
+EXPORT_SYMBOL(inode_dio_done);