aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2013-06-01 06:51:52 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2013-06-01 06:51:52 -0400
commit6cf3c736200e3924d8ce6b37e5006a4598b9236d (patch)
tree9560341b063c1a10e62201c84141af0d63396b61
parentf8cb27916ae256ef3b4e2ecca7262109dcfdd083 (diff)
parent4ad1f70ebcdb69393ce083f514bf4a4a3a3e65cb (diff)
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull assorted fixes from Al Viro: "There'll be more - I'm trying to dig out from under the pile of mail (a couple of weeks of something flu-like ;-/) and there's several more things waiting for review; this is just the obvious stuff." * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: zoran: racy refcount handling in vm_ops ->open()/->close() befs_readdir(): do not increment ->f_pos if filldir tells us to stop hpfs: deadlock and race in directory lseek() qnx6: qnx6_readdir() has a braino in pos calculation fix buffer leak after "scsi: saner replacements for ->proc_info()" vfs: Fix invalid ida_remove() call
-rw-r--r--drivers/media/pci/zoran/zoran.h2
-rw-r--r--drivers/media/pci/zoran/zoran_driver.c15
-rw-r--r--drivers/scsi/scsi_proc.c1
-rw-r--r--fs/befs/linuxvfs.c4
-rw-r--r--fs/hpfs/dir.c10
-rw-r--r--fs/pnode.c3
-rw-r--r--fs/qnx6/dir.c2
7 files changed, 21 insertions, 16 deletions
diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h
index ca2754a3cd63..5e040085c2ff 100644
--- a/drivers/media/pci/zoran/zoran.h
+++ b/drivers/media/pci/zoran/zoran.h
@@ -176,7 +176,7 @@ struct zoran_fh;
176 176
177struct zoran_mapping { 177struct zoran_mapping {
178 struct zoran_fh *fh; 178 struct zoran_fh *fh;
179 int count; 179 atomic_t count;
180}; 180};
181 181
182struct zoran_buffer { 182struct zoran_buffer {
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c
index 1168a84a737d..d133c30c3fdc 100644
--- a/drivers/media/pci/zoran/zoran_driver.c
+++ b/drivers/media/pci/zoran/zoran_driver.c
@@ -2803,8 +2803,7 @@ static void
2803zoran_vm_open (struct vm_area_struct *vma) 2803zoran_vm_open (struct vm_area_struct *vma)
2804{ 2804{
2805 struct zoran_mapping *map = vma->vm_private_data; 2805 struct zoran_mapping *map = vma->vm_private_data;
2806 2806 atomic_inc(&map->count);
2807 map->count++;
2808} 2807}
2809 2808
2810static void 2809static void
@@ -2815,7 +2814,7 @@ zoran_vm_close (struct vm_area_struct *vma)
2815 struct zoran *zr = fh->zr; 2814 struct zoran *zr = fh->zr;
2816 int i; 2815 int i;
2817 2816
2818 if (--map->count > 0) 2817 if (!atomic_dec_and_mutex_lock(&map->count, &zr->resource_lock))
2819 return; 2818 return;
2820 2819
2821 dprintk(3, KERN_INFO "%s: %s - munmap(%s)\n", ZR_DEVNAME(zr), 2820 dprintk(3, KERN_INFO "%s: %s - munmap(%s)\n", ZR_DEVNAME(zr),
@@ -2828,14 +2827,16 @@ zoran_vm_close (struct vm_area_struct *vma)
2828 kfree(map); 2827 kfree(map);
2829 2828
2830 /* Any buffers still mapped? */ 2829 /* Any buffers still mapped? */
2831 for (i = 0; i < fh->buffers.num_buffers; i++) 2830 for (i = 0; i < fh->buffers.num_buffers; i++) {
2832 if (fh->buffers.buffer[i].map) 2831 if (fh->buffers.buffer[i].map) {
2832 mutex_unlock(&zr->resource_lock);
2833 return; 2833 return;
2834 }
2835 }
2834 2836
2835 dprintk(3, KERN_INFO "%s: %s - free %s buffers\n", ZR_DEVNAME(zr), 2837 dprintk(3, KERN_INFO "%s: %s - free %s buffers\n", ZR_DEVNAME(zr),
2836 __func__, mode_name(fh->map_mode)); 2838 __func__, mode_name(fh->map_mode));
2837 2839
2838 mutex_lock(&zr->resource_lock);
2839 2840
2840 if (fh->map_mode == ZORAN_MAP_MODE_RAW) { 2841 if (fh->map_mode == ZORAN_MAP_MODE_RAW) {
2841 if (fh->buffers.active != ZORAN_FREE) { 2842 if (fh->buffers.active != ZORAN_FREE) {
@@ -2939,7 +2940,7 @@ zoran_mmap (struct file *file,
2939 goto mmap_unlock_and_return; 2940 goto mmap_unlock_and_return;
2940 } 2941 }
2941 map->fh = fh; 2942 map->fh = fh;
2942 map->count = 1; 2943 atomic_set(&map->count, 1);
2943 2944
2944 vma->vm_ops = &zoran_vm_ops; 2945 vma->vm_ops = &zoran_vm_ops;
2945 vma->vm_flags |= VM_DONTEXPAND; 2946 vma->vm_flags |= VM_DONTEXPAND;
diff --git a/drivers/scsi/scsi_proc.c b/drivers/scsi/scsi_proc.c
index db66357211ed..86f0c5d5c116 100644
--- a/drivers/scsi/scsi_proc.c
+++ b/drivers/scsi/scsi_proc.c
@@ -84,6 +84,7 @@ static int proc_scsi_host_open(struct inode *inode, struct file *file)
84 84
85static const struct file_operations proc_scsi_fops = { 85static const struct file_operations proc_scsi_fops = {
86 .open = proc_scsi_host_open, 86 .open = proc_scsi_host_open,
87 .release = single_release,
87 .read = seq_read, 88 .read = seq_read,
88 .llseek = seq_lseek, 89 .llseek = seq_lseek,
89 .write = proc_scsi_host_write 90 .write = proc_scsi_host_write
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index 8615ee89ab55..f95dddced968 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -265,8 +265,8 @@ befs_readdir(struct file *filp, void *dirent, filldir_t filldir)
265 result = filldir(dirent, keybuf, keysize, filp->f_pos, 265 result = filldir(dirent, keybuf, keysize, filp->f_pos,
266 (ino_t) value, d_type); 266 (ino_t) value, d_type);
267 } 267 }
268 268 if (!result)
269 filp->f_pos++; 269 filp->f_pos++;
270 270
271 befs_debug(sb, "<--- befs_readdir() filp->f_pos %Ld", filp->f_pos); 271 befs_debug(sb, "<--- befs_readdir() filp->f_pos %Ld", filp->f_pos);
272 272
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c
index 546f6d39713a..834ac13c04b7 100644
--- a/fs/hpfs/dir.c
+++ b/fs/hpfs/dir.c
@@ -33,25 +33,27 @@ static loff_t hpfs_dir_lseek(struct file *filp, loff_t off, int whence)
33 if (whence == SEEK_DATA || whence == SEEK_HOLE) 33 if (whence == SEEK_DATA || whence == SEEK_HOLE)
34 return -EINVAL; 34 return -EINVAL;
35 35
36 mutex_lock(&i->i_mutex);
36 hpfs_lock(s); 37 hpfs_lock(s);
37 38
38 /*printk("dir lseek\n");*/ 39 /*printk("dir lseek\n");*/
39 if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok; 40 if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok;
40 mutex_lock(&i->i_mutex);
41 pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1; 41 pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1;
42 while (pos != new_off) { 42 while (pos != new_off) {
43 if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh); 43 if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh);
44 else goto fail; 44 else goto fail;
45 if (pos == 12) goto fail; 45 if (pos == 12) goto fail;
46 } 46 }
47 mutex_unlock(&i->i_mutex); 47 hpfs_add_pos(i, &filp->f_pos);
48ok: 48ok:
49 filp->f_pos = new_off;
49 hpfs_unlock(s); 50 hpfs_unlock(s);
50 return filp->f_pos = new_off;
51fail:
52 mutex_unlock(&i->i_mutex); 51 mutex_unlock(&i->i_mutex);
52 return new_off;
53fail:
53 /*printk("illegal lseek: %016llx\n", new_off);*/ 54 /*printk("illegal lseek: %016llx\n", new_off);*/
54 hpfs_unlock(s); 55 hpfs_unlock(s);
56 mutex_unlock(&i->i_mutex);
55 return -ESPIPE; 57 return -ESPIPE;
56} 58}
57 59
diff --git a/fs/pnode.c b/fs/pnode.c
index 3d2a7141b87a..9af0df15256e 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -83,7 +83,8 @@ static int do_make_slave(struct mount *mnt)
83 if (peer_mnt == mnt) 83 if (peer_mnt == mnt)
84 peer_mnt = NULL; 84 peer_mnt = NULL;
85 } 85 }
86 if (IS_MNT_SHARED(mnt) && list_empty(&mnt->mnt_share)) 86 if (mnt->mnt_group_id && IS_MNT_SHARED(mnt) &&
87 list_empty(&mnt->mnt_share))
87 mnt_release_group_id(mnt); 88 mnt_release_group_id(mnt);
88 89
89 list_del_init(&mnt->mnt_share); 90 list_del_init(&mnt->mnt_share);
diff --git a/fs/qnx6/dir.c b/fs/qnx6/dir.c
index 8798d065e400..afa6be6fc397 100644
--- a/fs/qnx6/dir.c
+++ b/fs/qnx6/dir.c
@@ -120,7 +120,7 @@ static int qnx6_readdir(struct file *filp, void *dirent, filldir_t filldir)
120 struct inode *inode = file_inode(filp); 120 struct inode *inode = file_inode(filp);
121 struct super_block *s = inode->i_sb; 121 struct super_block *s = inode->i_sb;
122 struct qnx6_sb_info *sbi = QNX6_SB(s); 122 struct qnx6_sb_info *sbi = QNX6_SB(s);
123 loff_t pos = filp->f_pos & (QNX6_DIR_ENTRY_SIZE - 1); 123 loff_t pos = filp->f_pos & ~(QNX6_DIR_ENTRY_SIZE - 1);
124 unsigned long npages = dir_pages(inode); 124 unsigned long npages = dir_pages(inode);
125 unsigned long n = pos >> PAGE_CACHE_SHIFT; 125 unsigned long n = pos >> PAGE_CACHE_SHIFT;
126 unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE; 126 unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE;