Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  [PATCH] return to old errno choice in mkdir() et.al.
  [Patch] fs/binfmt_elf.c: fix wrong return values
  [PATCH] get rid of leak in compat_execve()
  [Patch] fs/binfmt_elf.c: fix a wrong free
  [PATCH] avoid multiplication overflows and signedness issues for max_fds
  [PATCH] dup_fd() part 4 - race fix
  [PATCH] dup_fd() - part 3
  [PATCH] dup_fd() part 2
  [PATCH] dup_fd() fixes, part 1
  [PATCH] take init_files to fs/file.c

5 files changed, 173 insertions, 16 deletions

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index b25707fee2cc..0fa95b198e6e 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -256,7 +256,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
                         return -EFAULT;
                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
                 if (!len || len > MAX_ARG_STRLEN)
-                        return 0;
+                        return -EINVAL;
                 p += len;
         }
         if (__put_user(0, argv))
@@ -268,7 +268,7 @@ create_elf_tables(struct linux_binprm *bprm, struct elfhdr *exec,
                         return -EFAULT;
                 len = strnlen_user((void __user *)p, MAX_ARG_STRLEN);
                 if (!len || len > MAX_ARG_STRLEN)
-                        return 0;
+                        return -EINVAL;
                 p += len;
         }
         if (__put_user(0, envp))
@@ -1900,7 +1900,7 @@ static int elf_core_dump(long signr, struct pt_regs *regs, struct file *file, un
         /* alloc memory for large data structures: too large to be on stack */
         elf = kmalloc(sizeof(*elf), GFP_KERNEL);
         if (!elf)
-                goto cleanup;
+                goto out;
         
         segs = current->mm->map_count;
 #ifdef ELF_CORE_EXTRA_PHDRS
@@ -2034,8 +2034,9 @@ end_coredump:
         set_fs(fs);
 
 cleanup:
-        kfree(elf);
         free_note_info(&info);
+        kfree(elf);
+out:
         return has_dumped;
 }
 
diff --git a/fs/compat.c b/fs/compat.c
index 332a869d2c53..ed43e17a5dc6 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1405,7 +1405,7 @@ int compat_do_execve(char * filename,
                 /* execve success */
                 security_bprm_free(bprm);
                 acct_update_integrals(current);
-                kfree(bprm);
+                free_bprm(bprm);
                 return retval;
         }
 
@@ -1424,7 +1424,7 @@ out_file:
         }
 
 out_kfree:
-        kfree(bprm);
+        free_bprm(bprm);
 
 out_ret:
         return retval;
diff --git a/fs/exec.c b/fs/exec.c
index 1f8a24aa1f8b..3c2ba7ce11d4 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1251,6 +1251,12 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs)
 
 EXPORT_SYMBOL(search_binary_handler);
 
+void free_bprm(struct linux_binprm *bprm)
+{
+        free_arg_pages(bprm);
+        kfree(bprm);
+}
+
 /*
  * sys_execve() executes a new program.
  */
@@ -1320,17 +1326,15 @@ int do_execve(char * filename,
         retval = search_binary_handler(bprm,regs);
         if (retval >= 0) {
                 /* execve success */
-                free_arg_pages(bprm);
                 security_bprm_free(bprm);
                 acct_update_integrals(current);
-                kfree(bprm);
+                free_bprm(bprm);
                 if (displaced)
                         put_files_struct(displaced);
                 return retval;
         }
 
 out:
-        free_arg_pages(bprm);
         if (bprm->security)
                 security_bprm_free(bprm);
 
@@ -1344,7 +1348,7 @@ out_file:
                 fput(bprm->file);
         }
 out_kfree:
-        kfree(bprm);
+        free_bprm(bprm);
 
 out_files:
         if (displaced)
diff --git a/fs/file.c b/fs/file.c
index 4c6f0ea12c41..7b3887e054d0 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -26,6 +26,8 @@ struct fdtable_defer {
 };
 
 int sysctl_nr_open __read_mostly = 1024*1024;
+int sysctl_nr_open_min = BITS_PER_LONG;
+int sysctl_nr_open_max = 1024 * 1024; /* raised later */
 
 /*
  * We use this list to defer free fdtables that have vmalloced
@@ -119,8 +121,6 @@ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt)
         unsigned int cpy, set;
 
         BUG_ON(nfdt->max_fds < ofdt->max_fds);
-        if (ofdt->max_fds == 0)
-                return;
 
         cpy = ofdt->max_fds * sizeof(struct file *);
         set = (nfdt->max_fds - ofdt->max_fds) * sizeof(struct file *);
@@ -261,6 +261,139 @@ int expand_files(struct files_struct *files, int nr)
         return expand_fdtable(files, nr);
 }
 
+static int count_open_files(struct fdtable *fdt)
+{
+        int size = fdt->max_fds;
+        int i;
+
+        /* Find the last open fd */
+        for (i = size/(8*sizeof(long)); i > 0; ) {
+                if (fdt->open_fds->fds_bits[--i])
+                        break;
+        }
+        i = (i+1) * 8 * sizeof(long);
+        return i;
+}
+
+/*
+ * Allocate a new files structure and copy contents from the
+ * passed in files structure.
+ * errorp will be valid only when the returned files_struct is NULL.
+ */
+struct files_struct *dup_fd(struct files_struct *oldf, int *errorp)
+{
+        struct files_struct *newf;
+        struct file **old_fds, **new_fds;
+        int open_files, size, i;
+        struct fdtable *old_fdt, *new_fdt;
+
+        *errorp = -ENOMEM;
+        newf = kmem_cache_alloc(files_cachep, GFP_KERNEL);
+        if (!newf)
+                goto out;
+
+        atomic_set(&newf->count, 1);
+
+        spin_lock_init(&newf->file_lock);
+        newf->next_fd = 0;
+        new_fdt = &newf->fdtab;
+        new_fdt->max_fds = NR_OPEN_DEFAULT;
+        new_fdt->close_on_exec = (fd_set *)&newf->close_on_exec_init;
+        new_fdt->open_fds = (fd_set *)&newf->open_fds_init;
+        new_fdt->fd = &newf->fd_array[0];
+        INIT_RCU_HEAD(&new_fdt->rcu);
+        new_fdt->next = NULL;
+
+        spin_lock(&oldf->file_lock);
+        old_fdt = files_fdtable(oldf);
+        open_files = count_open_files(old_fdt);
+
+        /*
+         * Check whether we need to allocate a larger fd array and fd set.
+         */
+        while (unlikely(open_files > new_fdt->max_fds)) {
+                spin_unlock(&oldf->file_lock);
+
+                if (new_fdt != &newf->fdtab) {
+                        free_fdarr(new_fdt);
+                        free_fdset(new_fdt);
+                        kfree(new_fdt);
+                }
+
+                new_fdt = alloc_fdtable(open_files - 1);
+                if (!new_fdt) {
+                        *errorp = -ENOMEM;
+                        goto out_release;
+                }
+
+                /* beyond sysctl_nr_open; nothing to do */
+                if (unlikely(new_fdt->max_fds < open_files)) {
+                        free_fdarr(new_fdt);
+                        free_fdset(new_fdt);
+                        kfree(new_fdt);
+                        *errorp = -EMFILE;
+                        goto out_release;
+                }
+
+                /*
+                 * Reacquire the oldf lock and a pointer to its fd table
+                 * who knows it may have a new bigger fd table. We need
+                 * the latest pointer.
+                 */
+                spin_lock(&oldf->file_lock);
+                old_fdt = files_fdtable(oldf);
+                open_files = count_open_files(old_fdt);
+        }
+
+        old_fds = old_fdt->fd;
+        new_fds = new_fdt->fd;
+
+        memcpy(new_fdt->open_fds->fds_bits,
+                old_fdt->open_fds->fds_bits, open_files/8);
+        memcpy(new_fdt->close_on_exec->fds_bits,
+                old_fdt->close_on_exec->fds_bits, open_files/8);
+
+        for (i = open_files; i != 0; i--) {
+                struct file *f = *old_fds++;
+                if (f) {
+                        get_file(f);
+                } else {
+                        /*
+                         * The fd may be claimed in the fd bitmap but not yet
+                         * instantiated in the files array if a sibling thread
+                         * is partway through open().  So make sure that this
+                         * fd is available to the new process.
+                         */
+                        FD_CLR(open_files - i, new_fdt->open_fds);
+                }
+                rcu_assign_pointer(*new_fds++, f);
+        }
+        spin_unlock(&oldf->file_lock);
+
+        /* compute the remainder to be cleared */
+        size = (new_fdt->max_fds - open_files) * sizeof(struct file *);
+
+        /* This is long word aligned thus could use a optimized version */
+        memset(new_fds, 0, size);
+
+        if (new_fdt->max_fds > open_files) {
+                int left = (new_fdt->max_fds-open_files)/8;
+                int start = open_files / (8 * sizeof(unsigned long));
+
+                memset(&new_fdt->open_fds->fds_bits[start], 0, left);
+                memset(&new_fdt->close_on_exec->fds_bits[start], 0, left);
+        }
+
+        rcu_assign_pointer(newf->fdt, new_fdt);
+
+        return newf;
+
+out_release:
+        kmem_cache_free(files_cachep, newf);
+out:
+        return NULL;
+}
+
 static void __devinit fdtable_defer_list_init(int cpu)
 {
         struct fdtable_defer *fddef = &per_cpu(fdtable_defer_list, cpu);
@@ -274,4 +407,19 @@ void __init files_defer_init(void)
         int i;
         for_each_possible_cpu(i)
                 fdtable_defer_list_init(i);
+        sysctl_nr_open_max = min((size_t)INT_MAX, ~(size_t)0/sizeof(void *)) &
+                             -BITS_PER_LONG;
 }
+
+struct files_struct init_files = {
+        .count          = ATOMIC_INIT(1),
+        .fdt            = &init_files.fdtab,
+        .fdtab          = {
+                .max_fds        = NR_OPEN_DEFAULT,
+                .fd             = &init_files.fd_array[0],
+                .close_on_exec  = (fd_set *)&init_files.close_on_exec_init,
+                .open_fds       = (fd_set *)&init_files.open_fds_init,
+                .rcu            = RCU_HEAD_INIT,
+        },
+        .file_lock      = __SPIN_LOCK_UNLOCKED(init_task.file_lock),
+};
diff --git a/fs/namei.c b/fs/namei.c
index 32fd9655485b..c7e43536c49a 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2003,18 +2003,22 @@ struct dentry *lookup_create(struct nameidata *nd, int is_dir)
         if (IS_ERR(dentry))
                 goto fail;
 
+        if (dentry->d_inode)
+                goto eexist;
         /*
          * Special case - lookup gave negative, but... we had foo/bar/
          * From the vfs_mknod() POV we just have a negative dentry -
          * all is fine. Let's be bastards - you had / on the end, you've
          * been asking for (non-existent) directory. -ENOENT for you.
          */
-        if (!is_dir && nd->last.name[nd->last.len] && !dentry->d_inode)
-                goto enoent;
+        if (unlikely(!is_dir && nd->last.name[nd->last.len])) {
+                dput(dentry);
+                dentry = ERR_PTR(-ENOENT);
+        }
         return dentry;
-enoent:
+eexist:
         dput(dentry);
-        dentry = ERR_PTR(-ENOENT);
+        dentry = ERR_PTR(-EEXIST);
 fail:
         return dentry;
 }