diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2013-06-01 06:51:52 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2013-06-01 06:51:52 -0400 |
commit | 6cf3c736200e3924d8ce6b37e5006a4598b9236d (patch) | |
tree | 9560341b063c1a10e62201c84141af0d63396b61 | |
parent | f8cb27916ae256ef3b4e2ecca7262109dcfdd083 (diff) | |
parent | 4ad1f70ebcdb69393ce083f514bf4a4a3a3e65cb (diff) |
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull assorted fixes from Al Viro:
"There'll be more - I'm trying to dig out from under the pile of mail
(a couple of weeks of something flu-like ;-/) and there's several more
things waiting for review; this is just the obvious stuff."
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
zoran: racy refcount handling in vm_ops ->open()/->close()
befs_readdir(): do not increment ->f_pos if filldir tells us to stop
hpfs: deadlock and race in directory lseek()
qnx6: qnx6_readdir() has a braino in pos calculation
fix buffer leak after "scsi: saner replacements for ->proc_info()"
vfs: Fix invalid ida_remove() call
-rw-r--r-- | drivers/media/pci/zoran/zoran.h | 2 | ||||
-rw-r--r-- | drivers/media/pci/zoran/zoran_driver.c | 15 | ||||
-rw-r--r-- | drivers/scsi/scsi_proc.c | 1 | ||||
-rw-r--r-- | fs/befs/linuxvfs.c | 4 | ||||
-rw-r--r-- | fs/hpfs/dir.c | 10 | ||||
-rw-r--r-- | fs/pnode.c | 3 | ||||
-rw-r--r-- | fs/qnx6/dir.c | 2 |
7 files changed, 21 insertions, 16 deletions
diff --git a/drivers/media/pci/zoran/zoran.h b/drivers/media/pci/zoran/zoran.h index ca2754a3cd63..5e040085c2ff 100644 --- a/drivers/media/pci/zoran/zoran.h +++ b/drivers/media/pci/zoran/zoran.h | |||
@@ -176,7 +176,7 @@ struct zoran_fh; | |||
176 | 176 | ||
177 | struct zoran_mapping { | 177 | struct zoran_mapping { |
178 | struct zoran_fh *fh; | 178 | struct zoran_fh *fh; |
179 | int count; | 179 | atomic_t count; |
180 | }; | 180 | }; |
181 | 181 | ||
182 | struct zoran_buffer { | 182 | struct zoran_buffer { |
diff --git a/drivers/media/pci/zoran/zoran_driver.c b/drivers/media/pci/zoran/zoran_driver.c index 1168a84a737d..d133c30c3fdc 100644 --- a/drivers/media/pci/zoran/zoran_driver.c +++ b/drivers/media/pci/zoran/zoran_driver.c | |||
@@ -2803,8 +2803,7 @@ static void | |||
2803 | zoran_vm_open (struct vm_area_struct *vma) | 2803 | zoran_vm_open (struct vm_area_struct *vma) |
2804 | { | 2804 | { |
2805 | struct zoran_mapping *map = vma->vm_private_data; | 2805 | struct zoran_mapping *map = vma->vm_private_data; |
2806 | 2806 | atomic_inc(&map->count); | |
2807 | map->count++; | ||
2808 | } | 2807 | } |
2809 | 2808 | ||
2810 | static void | 2809 | static void |
@@ -2815,7 +2814,7 @@ zoran_vm_close (struct vm_area_struct *vma) | |||
2815 | struct zoran *zr = fh->zr; | 2814 | struct zoran *zr = fh->zr; |
2816 | int i; | 2815 | int i; |
2817 | 2816 | ||
2818 | if (--map->count > 0) | 2817 | if (!atomic_dec_and_mutex_lock(&map->count, &zr->resource_lock)) |
2819 | return; | 2818 | return; |
2820 | 2819 | ||
2821 | dprintk(3, KERN_INFO "%s: %s - munmap(%s)\n", ZR_DEVNAME(zr), | 2820 | dprintk(3, KERN_INFO "%s: %s - munmap(%s)\n", ZR_DEVNAME(zr), |
@@ -2828,14 +2827,16 @@ zoran_vm_close (struct vm_area_struct *vma) | |||
2828 | kfree(map); | 2827 | kfree(map); |
2829 | 2828 | ||
2830 | /* Any buffers still mapped? */ | 2829 | /* Any buffers still mapped? */ |
2831 | for (i = 0; i < fh->buffers.num_buffers; i++) | 2830 | for (i = 0; i < fh->buffers.num_buffers; i++) { |
2832 | if (fh->buffers.buffer[i].map) | 2831 | if (fh->buffers.buffer[i].map) { |
2832 | mutex_unlock(&zr->resource_lock); | ||
2833 | return; | 2833 | return; |
2834 | } | ||
2835 | } | ||
2834 | 2836 | ||
2835 | dprintk(3, KERN_INFO "%s: %s - free %s buffers\n", ZR_DEVNAME(zr), | 2837 | dprintk(3, KERN_INFO "%s: %s - free %s buffers\n", ZR_DEVNAME(zr), |
2836 | __func__, mode_name(fh->map_mode)); | 2838 | __func__, mode_name(fh->map_mode)); |
2837 | 2839 | ||
2838 | mutex_lock(&zr->resource_lock); | ||
2839 | 2840 | ||
2840 | if (fh->map_mode == ZORAN_MAP_MODE_RAW) { | 2841 | if (fh->map_mode == ZORAN_MAP_MODE_RAW) { |
2841 | if (fh->buffers.active != ZORAN_FREE) { | 2842 | if (fh->buffers.active != ZORAN_FREE) { |
@@ -2939,7 +2940,7 @@ zoran_mmap (struct file *file, | |||
2939 | goto mmap_unlock_and_return; | 2940 | goto mmap_unlock_and_return; |
2940 | } | 2941 | } |
2941 | map->fh = fh; | 2942 | map->fh = fh; |
2942 | map->count = 1; | 2943 | atomic_set(&map->count, 1); |
2943 | 2944 | ||
2944 | vma->vm_ops = &zoran_vm_ops; | 2945 | vma->vm_ops = &zoran_vm_ops; |
2945 | vma->vm_flags |= VM_DONTEXPAND; | 2946 | vma->vm_flags |= VM_DONTEXPAND; |
diff --git a/drivers/scsi/scsi_proc.c b/drivers/scsi/scsi_proc.c index db66357211ed..86f0c5d5c116 100644 --- a/drivers/scsi/scsi_proc.c +++ b/drivers/scsi/scsi_proc.c | |||
@@ -84,6 +84,7 @@ static int proc_scsi_host_open(struct inode *inode, struct file *file) | |||
84 | 84 | ||
85 | static const struct file_operations proc_scsi_fops = { | 85 | static const struct file_operations proc_scsi_fops = { |
86 | .open = proc_scsi_host_open, | 86 | .open = proc_scsi_host_open, |
87 | .release = single_release, | ||
87 | .read = seq_read, | 88 | .read = seq_read, |
88 | .llseek = seq_lseek, | 89 | .llseek = seq_lseek, |
89 | .write = proc_scsi_host_write | 90 | .write = proc_scsi_host_write |
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c index 8615ee89ab55..f95dddced968 100644 --- a/fs/befs/linuxvfs.c +++ b/fs/befs/linuxvfs.c | |||
@@ -265,8 +265,8 @@ befs_readdir(struct file *filp, void *dirent, filldir_t filldir) | |||
265 | result = filldir(dirent, keybuf, keysize, filp->f_pos, | 265 | result = filldir(dirent, keybuf, keysize, filp->f_pos, |
266 | (ino_t) value, d_type); | 266 | (ino_t) value, d_type); |
267 | } | 267 | } |
268 | 268 | if (!result) | |
269 | filp->f_pos++; | 269 | filp->f_pos++; |
270 | 270 | ||
271 | befs_debug(sb, "<--- befs_readdir() filp->f_pos %Ld", filp->f_pos); | 271 | befs_debug(sb, "<--- befs_readdir() filp->f_pos %Ld", filp->f_pos); |
272 | 272 | ||
diff --git a/fs/hpfs/dir.c b/fs/hpfs/dir.c index 546f6d39713a..834ac13c04b7 100644 --- a/fs/hpfs/dir.c +++ b/fs/hpfs/dir.c | |||
@@ -33,25 +33,27 @@ static loff_t hpfs_dir_lseek(struct file *filp, loff_t off, int whence) | |||
33 | if (whence == SEEK_DATA || whence == SEEK_HOLE) | 33 | if (whence == SEEK_DATA || whence == SEEK_HOLE) |
34 | return -EINVAL; | 34 | return -EINVAL; |
35 | 35 | ||
36 | mutex_lock(&i->i_mutex); | ||
36 | hpfs_lock(s); | 37 | hpfs_lock(s); |
37 | 38 | ||
38 | /*printk("dir lseek\n");*/ | 39 | /*printk("dir lseek\n");*/ |
39 | if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok; | 40 | if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok; |
40 | mutex_lock(&i->i_mutex); | ||
41 | pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1; | 41 | pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1; |
42 | while (pos != new_off) { | 42 | while (pos != new_off) { |
43 | if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh); | 43 | if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh); |
44 | else goto fail; | 44 | else goto fail; |
45 | if (pos == 12) goto fail; | 45 | if (pos == 12) goto fail; |
46 | } | 46 | } |
47 | mutex_unlock(&i->i_mutex); | 47 | hpfs_add_pos(i, &filp->f_pos); |
48 | ok: | 48 | ok: |
49 | filp->f_pos = new_off; | ||
49 | hpfs_unlock(s); | 50 | hpfs_unlock(s); |
50 | return filp->f_pos = new_off; | ||
51 | fail: | ||
52 | mutex_unlock(&i->i_mutex); | 51 | mutex_unlock(&i->i_mutex); |
52 | return new_off; | ||
53 | fail: | ||
53 | /*printk("illegal lseek: %016llx\n", new_off);*/ | 54 | /*printk("illegal lseek: %016llx\n", new_off);*/ |
54 | hpfs_unlock(s); | 55 | hpfs_unlock(s); |
56 | mutex_unlock(&i->i_mutex); | ||
55 | return -ESPIPE; | 57 | return -ESPIPE; |
56 | } | 58 | } |
57 | 59 | ||
diff --git a/fs/pnode.c b/fs/pnode.c index 3d2a7141b87a..9af0df15256e 100644 --- a/fs/pnode.c +++ b/fs/pnode.c | |||
@@ -83,7 +83,8 @@ static int do_make_slave(struct mount *mnt) | |||
83 | if (peer_mnt == mnt) | 83 | if (peer_mnt == mnt) |
84 | peer_mnt = NULL; | 84 | peer_mnt = NULL; |
85 | } | 85 | } |
86 | if (IS_MNT_SHARED(mnt) && list_empty(&mnt->mnt_share)) | 86 | if (mnt->mnt_group_id && IS_MNT_SHARED(mnt) && |
87 | list_empty(&mnt->mnt_share)) | ||
87 | mnt_release_group_id(mnt); | 88 | mnt_release_group_id(mnt); |
88 | 89 | ||
89 | list_del_init(&mnt->mnt_share); | 90 | list_del_init(&mnt->mnt_share); |
diff --git a/fs/qnx6/dir.c b/fs/qnx6/dir.c index 8798d065e400..afa6be6fc397 100644 --- a/fs/qnx6/dir.c +++ b/fs/qnx6/dir.c | |||
@@ -120,7 +120,7 @@ static int qnx6_readdir(struct file *filp, void *dirent, filldir_t filldir) | |||
120 | struct inode *inode = file_inode(filp); | 120 | struct inode *inode = file_inode(filp); |
121 | struct super_block *s = inode->i_sb; | 121 | struct super_block *s = inode->i_sb; |
122 | struct qnx6_sb_info *sbi = QNX6_SB(s); | 122 | struct qnx6_sb_info *sbi = QNX6_SB(s); |
123 | loff_t pos = filp->f_pos & (QNX6_DIR_ENTRY_SIZE - 1); | 123 | loff_t pos = filp->f_pos & ~(QNX6_DIR_ENTRY_SIZE - 1); |
124 | unsigned long npages = dir_pages(inode); | 124 | unsigned long npages = dir_pages(inode); |
125 | unsigned long n = pos >> PAGE_CACHE_SHIFT; | 125 | unsigned long n = pos >> PAGE_CACHE_SHIFT; |
126 | unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE; | 126 | unsigned start = (pos & ~PAGE_CACHE_MASK) / QNX6_DIR_ENTRY_SIZE; |