Use f_lock to protect f_flags

Traditionally, changes to struct file->f_flags have been done under BKL
protection, or with no protection at all.  This patch causes all f_flags
changes after file open/creation time to be done under protection of
f_lock.  This allows the removal of some BKL usage and fixes a number of
longstanding (if microscopic) races.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>

2 files changed, 8 insertions, 4 deletions

diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index bc84e125c6bc..224f271d8cbe 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2162,13 +2162,12 @@ static int fionbio(struct file *file, int __user *p)
         if (get_user(nonblock, p))
                 return -EFAULT;
 
-        /* file->f_flags is still BKL protected in the fs layer - vomit */
-        lock_kernel();
+        spin_lock(&file->f_lock);
         if (nonblock)
                 file->f_flags |= O_NONBLOCK;
         else
                 file->f_flags &= ~O_NONBLOCK;
-        unlock_kernel();
+        spin_unlock(&file->f_lock);
         return 0;
 }
 
diff --git a/drivers/usb/gadget/file_storage.c b/drivers/usb/gadget/file_storage.c
index 1ab9dac7e12d..33bb76cef33c 100644
--- a/drivers/usb/gadget/file_storage.c
+++ b/drivers/usb/gadget/file_storage.c
@@ -1711,7 +1711,9 @@ static int do_write(struct fsg_dev *fsg)
                 curlun->sense_data = SS_WRITE_PROTECTED;
                 return -EINVAL;
         }
+        spin_lock(&curlun->filp->f_lock);
         curlun->filp->f_flags &= ~O_SYNC;       // Default is not to wait
+        spin_unlock(&curlun->filp->f_lock);
 
         /* Get the starting Logical Block Address and check that it's
          * not too big */
@@ -1728,8 +1730,11 @@ static int do_write(struct fsg_dev *fsg)
                         curlun->sense_data = SS_INVALID_FIELD_IN_CDB;
                         return -EINVAL;
                 }
-                if (fsg->cmnd[1] & 0x08)        // FUA
+                if (fsg->cmnd[1] & 0x08) {      // FUA
+                        spin_lock(&curlun->filp->f_lock);
                         curlun->filp->f_flags |= O_SYNC;
+                        spin_unlock(&curlun->filp->f_lock);
+                }
         }
         if (lba >= curlun->num_sectors) {
                 curlun->sense_data = SS_LOGICAL_BLOCK_ADDRESS_OUT_OF_RANGE;