[PATCH] r/o bind mounts: elevate write count for ioctls()

Some ioctl()s can cause writes to the filesystem.  Take these, and make them
use mnt_want/drop_write() instead.

[AV: updated]

Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 41 insertions, 22 deletions

diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
index e0f0f098a523..74363a7aacbc 100644
--- a/fs/reiserfs/ioctl.c
+++ b/fs/reiserfs/ioctl.c
@@ -4,6 +4,7 @@
 
 #include <linux/capability.h>
 #include <linux/fs.h>
+#include <linux/mount.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/time.h>
 #include <asm/uaccess.h>
@@ -25,6 +26,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                    unsigned long arg)
 {
         unsigned int flags;
+        int err = 0;
 
         switch (cmd) {
         case REISERFS_IOC_UNPACK:
@@ -48,50 +50,67 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                         if (!reiserfs_attrs(inode->i_sb))
                                 return -ENOTTY;
 
-                        if (IS_RDONLY(inode))
-                                return -EROFS;
+                        err = mnt_want_write(filp->f_path.mnt);
+                        if (err)
+                                return err;
 
-                        if (!is_owner_or_cap(inode))
-                                return -EPERM;
-
-                        if (get_user(flags, (int __user *)arg))
-                                return -EFAULT;
-
-                        /* Is it quota file? Do not allow user to mess with it. */
-                        if (IS_NOQUOTA(inode))
-                                return -EPERM;
+                        if (!is_owner_or_cap(inode)) {
+                                err = -EPERM;
+                                goto setflags_out;
+                        }
+                        if (get_user(flags, (int __user *)arg)) {
+                                err = -EFAULT;
+                                goto setflags_out;
+                        }
+                        /*
+                         * Is it quota file? Do not allow user to mess with it
+                         */
+                        if (IS_NOQUOTA(inode)) {
+                                err = -EPERM;
+                                goto setflags_out;
+                        }
                         if (((flags ^ REISERFS_I(inode)->
                               i_attrs) & (REISERFS_IMMUTABLE_FL |
                                           REISERFS_APPEND_FL))
-                            && !capable(CAP_LINUX_IMMUTABLE))
-                                return -EPERM;
-
+                            && !capable(CAP_LINUX_IMMUTABLE)) {
+                                err = -EPERM;
+                                goto setflags_out;
+                        }
                         if ((flags & REISERFS_NOTAIL_FL) &&
                             S_ISREG(inode->i_mode)) {
                                 int result;
 
                                 result = reiserfs_unpack(inode, filp);
-                                if (result)
-                                        return result;
+                                if (result) {
+                                        err = result;
+                                        goto setflags_out;
+                                }
                         }
                         sd_attrs_to_i_attrs(flags, inode);
                         REISERFS_I(inode)->i_attrs = flags;
                         inode->i_ctime = CURRENT_TIME_SEC;
                         mark_inode_dirty(inode);
-                        return 0;
+setflags_out:
+                        mnt_drop_write(filp->f_path.mnt);
+                        return err;
                 }
         case REISERFS_IOC_GETVERSION:
                 return put_user(inode->i_generation, (int __user *)arg);
         case REISERFS_IOC_SETVERSION:
                 if (!is_owner_or_cap(inode))
                         return -EPERM;
-                if (IS_RDONLY(inode))
-                        return -EROFS;
-                if (get_user(inode->i_generation, (int __user *)arg))
-                        return -EFAULT;
+                err = mnt_want_write(filp->f_path.mnt);
+                if (err)
+                        return err;
+                if (get_user(inode->i_generation, (int __user *)arg)) {
+                        err = -EFAULT;
+                        goto setversion_out;
+                }
                 inode->i_ctime = CURRENT_TIME_SEC;
                 mark_inode_dirty(inode);
-                return 0;
+setversion_out:
+                mnt_drop_write(filp->f_path.mnt);
+                return err;
         default:
                 return -ENOTTY;
         }