Merge branch 'linus_origin' into hotfixes

11 files changed, 91 insertions, 87 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index c8555b180213..2eeea9a14240 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1312,26 +1312,26 @@ void audit_log_untrustedstring(struct audit_buffer *ab, const char *string)
 
 /* This is a helper-function to print the escaped d_path */
 void audit_log_d_path(struct audit_buffer *ab, const char *prefix,
-                      struct dentry *dentry, struct vfsmount *vfsmnt)
+                      struct path *path)
 {
-        char *p, *path;
+        char *p, *pathname;
 
         if (prefix)
                 audit_log_format(ab, " %s", prefix);
 
         /* We will allow 11 spaces for ' (deleted)' to be appended */
-        path = kmalloc(PATH_MAX+11, ab->gfp_mask);
-        if (!path) {
+        pathname = kmalloc(PATH_MAX+11, ab->gfp_mask);
+        if (!pathname) {
                 audit_log_format(ab, "<no memory>");
                 return;
         }
-        p = d_path(dentry, vfsmnt, path, PATH_MAX+11);
+        p = d_path(path, pathname, PATH_MAX+11);
         if (IS_ERR(p)) { /* Should never happen since we send PATH_MAX */
                 /* FIXME: can we save some information here? */
                 audit_log_format(ab, "<too long>");
         } else
                 audit_log_untrustedstring(ab, p);
-        kfree(path);
+        kfree(pathname);
 }
 
 /**
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index f4fcf58f20f8..9ef5e0aacc3c 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -549,8 +549,8 @@ void audit_trim_trees(void)
                 if (err)
                         goto skip_it;
 
-                root_mnt = collect_mounts(nd.mnt, nd.dentry);
-                path_release(&nd);
+                root_mnt = collect_mounts(nd.path.mnt, nd.path.dentry);
+                path_put(&nd.path);
                 if (!root_mnt)
                         goto skip_it;
 
@@ -583,17 +583,17 @@ skip_it:
 static int is_under(struct vfsmount *mnt, struct dentry *dentry,
                     struct nameidata *nd)
 {
-        if (mnt != nd->mnt) {
+        if (mnt != nd->path.mnt) {
                 for (;;) {
                         if (mnt->mnt_parent == mnt)
                                 return 0;
-                        if (mnt->mnt_parent == nd->mnt)
+                        if (mnt->mnt_parent == nd->path.mnt)
                                         break;
                         mnt = mnt->mnt_parent;
                 }
                 dentry = mnt->mnt_mountpoint;
         }
-        return is_subdir(dentry, nd->dentry);
+        return is_subdir(dentry, nd->path.dentry);
 }
 
 int audit_make_tree(struct audit_krule *rule, char *pathname, u32 op)
@@ -641,8 +641,8 @@ int audit_add_tree_rule(struct audit_krule *rule)
         err = path_lookup(tree->pathname, 0, &nd);
         if (err)
                 goto Err;
-        mnt = collect_mounts(nd.mnt, nd.dentry);
-        path_release(&nd);
+        mnt = collect_mounts(nd.path.mnt, nd.path.dentry);
+        path_put(&nd.path);
         if (!mnt) {
                 err = -ENOMEM;
                 goto Err;
@@ -701,8 +701,8 @@ int audit_tag_tree(char *old, char *new)
         err = path_lookup(new, 0, &nd);
         if (err)
                 return err;
-        tagged = collect_mounts(nd.mnt, nd.dentry);
-        path_release(&nd);
+        tagged = collect_mounts(nd.path.mnt, nd.path.dentry);
+        path_put(&nd.path);
         if (!tagged)
                 return -ENOMEM;
 
@@ -711,9 +711,9 @@ int audit_tag_tree(char *old, char *new)
                 drop_collected_mounts(tagged);
                 return err;
         }
-        mnt = mntget(nd.mnt);
-        dentry = dget(nd.dentry);
-        path_release(&nd);
+        mnt = mntget(nd.path.mnt);
+        dentry = dget(nd.path.dentry);
+        path_put(&nd.path);
 
         if (dentry == tagged->mnt_root && dentry == mnt->mnt_root)
                 follow_up(&mnt, &dentry);
@@ -744,13 +744,13 @@ int audit_tag_tree(char *old, char *new)
                 spin_lock(&vfsmount_lock);
                 if (!is_under(mnt, dentry, &nd)) {
                         spin_unlock(&vfsmount_lock);
-                        path_release(&nd);
+                        path_put(&nd.path);
                         put_tree(tree);
                         mutex_lock(&audit_filter_mutex);
                         continue;
                 }
                 spin_unlock(&vfsmount_lock);
-                path_release(&nd);
+                path_put(&nd.path);
 
                 list_for_each_entry(p, &list, mnt_list) {
                         failed = tag_chunk(p->mnt_root->d_inode, tree);
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 6f19fd477aac..2f2914b7cc30 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -169,8 +169,8 @@ static struct audit_parent *audit_init_parent(struct nameidata *ndp)
         inotify_init_watch(&parent->wdata);
         /* grab a ref so inotify watch hangs around until we take audit_filter_mutex */
         get_inotify_watch(&parent->wdata);
-        wd = inotify_add_watch(audit_ih, &parent->wdata, ndp->dentry->d_inode,
-                               AUDIT_IN_WATCH);
+        wd = inotify_add_watch(audit_ih, &parent->wdata,
+                               ndp->path.dentry->d_inode, AUDIT_IN_WATCH);
         if (wd < 0) {
                 audit_free_parent(&parent->wdata);
                 return ERR_PTR(wd);
@@ -1161,11 +1161,11 @@ static int audit_get_nd(char *path, struct nameidata **ndp,
 static void audit_put_nd(struct nameidata *ndp, struct nameidata *ndw)
 {
         if (ndp) {
-                path_release(ndp);
+                path_put(&ndp->path);
                 kfree(ndp);
         }
         if (ndw) {
-                path_release(ndw);
+                path_put(&ndw->path);
                 kfree(ndw);
         }
 }
@@ -1214,8 +1214,8 @@ static int audit_add_watch(struct audit_krule *krule, struct nameidata *ndp,
 
         /* update watch filter fields */
         if (ndw) {
-                watch->dev = ndw->dentry->d_inode->i_sb->s_dev;
-                watch->ino = ndw->dentry->d_inode->i_ino;
+                watch->dev = ndw->path.dentry->d_inode->i_sb->s_dev;
+                watch->ino = ndw->path.dentry->d_inode->i_ino;
         }
 
         /* The audit_filter_mutex must not be held during inotify calls because
@@ -1225,7 +1225,8 @@ static int audit_add_watch(struct audit_krule *krule, struct nameidata *ndp,
          */
         mutex_unlock(&audit_filter_mutex);
 
-        if (inotify_find_watch(audit_ih, ndp->dentry->d_inode, &i_watch) < 0) {
+        if (inotify_find_watch(audit_ih, ndp->path.dentry->d_inode,
+                               &i_watch) < 0) {
                 parent = audit_init_parent(ndp);
                 if (IS_ERR(parent)) {
                         /* caller expects mutex locked */
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 1c06ecf38d7b..ac6d9b23b018 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -208,8 +208,7 @@ struct audit_context {
         int                 name_count;
         struct audit_names  names[AUDIT_NAMES];
         char *              filterkey;  /* key for rule that triggered record */
-        struct dentry *     pwd;
-        struct vfsmount *   pwdmnt;
+        struct path         pwd;
         struct audit_context *previous; /* For nested syscalls */
         struct audit_aux_data *aux;
         struct audit_aux_data *aux_pids;
@@ -786,12 +785,9 @@ static inline void audit_free_names(struct audit_context *context)
                         __putname(context->names[i].name);
         }
         context->name_count = 0;
-        if (context->pwd)
-                dput(context->pwd);
-        if (context->pwdmnt)
-                mntput(context->pwdmnt);
-        context->pwd = NULL;
-        context->pwdmnt = NULL;
+        path_put(&context->pwd);
+        context->pwd.dentry = NULL;
+        context->pwd.mnt = NULL;
 }
 
 static inline void audit_free_aux(struct audit_context *context)
@@ -930,8 +926,7 @@ static void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk
                         if ((vma->vm_flags & VM_EXECUTABLE) &&
                             vma->vm_file) {
                                 audit_log_d_path(ab, "exe=",
-                                                 vma->vm_file->f_path.dentry,
-                                                 vma->vm_file->f_path.mnt);
+                                                 &vma->vm_file->f_path);
                                 break;
                         }
                         vma = vma->vm_next;
@@ -1341,10 +1336,10 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                                   context->target_sid, context->target_comm))
                         call_panic = 1;
 
-        if (context->pwd && context->pwdmnt) {
+        if (context->pwd.dentry && context->pwd.mnt) {
                 ab = audit_log_start(context, GFP_KERNEL, AUDIT_CWD);
                 if (ab) {
-                        audit_log_d_path(ab, "cwd=", context->pwd, context->pwdmnt);
+                        audit_log_d_path(ab, "cwd=", &context->pwd);
                         audit_log_end(ab);
                 }
         }
@@ -1367,8 +1362,7 @@ static void audit_log_exit(struct audit_context *context, struct task_struct *ts
                         case 0:
                                 /* name was specified as a relative path and the
                                  * directory component is the cwd */
-                                audit_log_d_path(ab, " name=", context->pwd,
-                                                 context->pwdmnt);
+                                audit_log_d_path(ab, " name=", &context->pwd);
                                 break;
                         default:
                                 /* log the name's directory component */
@@ -1695,10 +1689,10 @@ void __audit_getname(const char *name)
         context->names[context->name_count].ino  = (unsigned long)-1;
         context->names[context->name_count].osid = 0;
         ++context->name_count;
-        if (!context->pwd) {
+        if (!context->pwd.dentry) {
                 read_lock(&current->fs->lock);
-                context->pwd = dget(current->fs->pwd);
-                context->pwdmnt = mntget(current->fs->pwdmnt);
+                context->pwd = current->fs->pwd;
+                path_get(&current->fs->pwd);
                 read_unlock(&current->fs->lock);
         }
 
diff --git a/kernel/exit.c b/kernel/exit.c
index 3b893e78ce61..506a957b665a 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -512,14 +512,10 @@ static void __put_fs_struct(struct fs_struct *fs)
 {
         /* No need to hold fs->lock if we are killing it */
         if (atomic_dec_and_test(&fs->count)) {
-                dput(fs->root);
-                mntput(fs->rootmnt);
-                dput(fs->pwd);
-                mntput(fs->pwdmnt);
-                if (fs->altroot) {
-                        dput(fs->altroot);
-                        mntput(fs->altrootmnt);
-                }
+                path_put(&fs->root);
+                path_put(&fs->pwd);
+                if (fs->altroot.dentry)
+                        path_put(&fs->altroot);
                 kmem_cache_free(fs_cachep, fs);
         }
 }
diff --git a/kernel/fork.c b/kernel/fork.c
index 4363a4eb84e3..dd249c37b3a3 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -600,16 +600,16 @@ static struct fs_struct *__copy_fs_struct(struct fs_struct *old)
                 rwlock_init(&fs->lock);
                 fs->umask = old->umask;
                 read_lock(&old->lock);
-                fs->rootmnt = mntget(old->rootmnt);
-                fs->root = dget(old->root);
-                fs->pwdmnt = mntget(old->pwdmnt);
-                fs->pwd = dget(old->pwd);
-                if (old->altroot) {
-                        fs->altrootmnt = mntget(old->altrootmnt);
-                        fs->altroot = dget(old->altroot);
+                fs->root = old->root;
+                path_get(&old->root);
+                fs->pwd = old->pwd;
+                path_get(&old->pwd);
+                if (old->altroot.dentry) {
+                        fs->altroot = old->altroot;
+                        path_get(&old->altroot);
                 } else {
-                        fs->altrootmnt = NULL;
-                        fs->altroot = NULL;
+                        fs->altroot.mnt = NULL;
+                        fs->altroot.dentry = NULL;
                 }
                 read_unlock(&old->lock);
         }
diff --git a/kernel/futex.c b/kernel/futex.c
index a6baaec44b8f..221f2128a437 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -2116,7 +2116,7 @@ asmlinkage long sys_futex(u32 __user *uaddr, int op, u32 val,
 
                 t = timespec_to_ktime(ts);
                 if (cmd == FUTEX_WAIT)
-                        t = ktime_add(ktime_get(), t);
+                        t = ktime_add_safe(ktime_get(), t);
                 tp = &t;
         }
         /*
diff --git a/kernel/futex_compat.c b/kernel/futex_compat.c
index 133d558db452..7d5e4b016f39 100644
--- a/kernel/futex_compat.c
+++ b/kernel/futex_compat.c
@@ -176,7 +176,7 @@ asmlinkage long compat_sys_futex(u32 __user *uaddr, int op, u32 val,
 
                 t = timespec_to_ktime(ts);
                 if (cmd == FUTEX_WAIT)
-                        t = ktime_add(ktime_get(), t);
+                        t = ktime_add_safe(ktime_get(), t);
                 tp = &t;
         }
         if (cmd == FUTEX_REQUEUE || cmd == FUTEX_CMP_REQUEUE)
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 3f4a57c7895d..98bee013f71f 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -326,6 +326,23 @@ u64 ktime_divns(const ktime_t kt, s64 div)
 #endif /* BITS_PER_LONG >= 64 */
 
 /*
+ * Add two ktime values and do a safety check for overflow:
+ */
+ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs)
+{
+        ktime_t res = ktime_add(lhs, rhs);
+
+        /*
+         * We use KTIME_SEC_MAX here, the maximum timeout which we can
+         * return to user space in a timespec:
+         */
+        if (res.tv64 < 0 || res.tv64 < lhs.tv64 || res.tv64 < rhs.tv64)
+                res = ktime_set(KTIME_SEC_MAX, 0);
+
+        return res;
+}
+
+/*
  * Check, whether the timer is on the callback pending list
  */
 static inline int hrtimer_cb_pending(const struct hrtimer *timer)
@@ -425,6 +442,8 @@ static int hrtimer_reprogram(struct hrtimer *timer,
         ktime_t expires = ktime_sub(timer->expires, base->offset);
         int res;
 
+        WARN_ON_ONCE(timer->expires.tv64 < 0);
+
         /*
          * When the callback is running, we do not reprogram the clock event
          * device. The timer callback is either running on a different CPU or
@@ -435,6 +454,15 @@ static int hrtimer_reprogram(struct hrtimer *timer,
         if (hrtimer_callback_running(timer))
                 return 0;
 
+        /*
+         * CLOCK_REALTIME timer might be requested with an absolute
+         * expiry time which is less than base->offset. Nothing wrong
+         * about that, just avoid to call into the tick code, which
+         * has now objections against negative expiry values.
+         */
+        if (expires.tv64 < 0)
+                return -ETIME;
+
         if (expires.tv64 >= expires_next->tv64)
                 return 0;
 
@@ -682,13 +710,7 @@ u64 hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
                  */
                 orun++;
         }
-        timer->expires = ktime_add(timer->expires, interval);
-        /*
-         * Make sure, that the result did not wrap with a very large
-         * interval.
-         */
-        if (timer->expires.tv64 < 0)
-                timer->expires = ktime_set(KTIME_SEC_MAX, 0);
+        timer->expires = ktime_add_safe(timer->expires, interval);
 
         return orun;
 }
@@ -839,7 +861,7 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
         new_base = switch_hrtimer_base(timer, base);
 
         if (mode == HRTIMER_MODE_REL) {
-                tim = ktime_add(tim, new_base->get_time());
+                tim = ktime_add_safe(tim, new_base->get_time());
                 /*
                  * CONFIG_TIME_LOW_RES is a temporary way for architectures
                  * to signal that they simply return xtime in
@@ -848,16 +870,8 @@ hrtimer_start(struct hrtimer *timer, ktime_t tim, const enum hrtimer_mode mode)
                  * timeouts. This will go away with the GTOD framework.
                  */
 #ifdef CONFIG_TIME_LOW_RES
-                tim = ktime_add(tim, base->resolution);
+                tim = ktime_add_safe(tim, base->resolution);
 #endif
-                /*
-                 * Careful here: User space might have asked for a
-                 * very long sleep, so the add above might result in a
-                 * negative number, which enqueues the timer in front
-                 * of the queue.
-                 */
-                if (tim.tv64 < 0)
-                        tim.tv64 = KTIME_MAX;
         }
         timer->expires = tim;
 
diff --git a/kernel/kmod.c b/kernel/kmod.c
index bb7df2a28bd7..22be3ff3f363 100644
--- a/kernel/kmod.c
+++ b/kernel/kmod.c
@@ -173,10 +173,7 @@ static int ____call_usermodehelper(void *data)
          */
         set_user_nice(current, 0);
 
-        retval = -EPERM;
-        if (current->fs->root)
-                retval = kernel_execve(sub_info->path,
-                                sub_info->argv, sub_info->envp);
+        retval = kernel_execve(sub_info->path, sub_info->argv, sub_info->envp);
 
         /* Exec failed? */
         sub_info->retval = retval;
diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 022c9c3cee6f..a9b04203a66d 100644
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -767,9 +767,11 @@ common_timer_set(struct k_itimer *timr, int flags,
         /* SIGEV_NONE timers are not queued ! See common_timer_get */
         if (((timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) {
                 /* Setup correct expiry time for relative timers */
-                if (mode == HRTIMER_MODE_REL)
-                        timer->expires = ktime_add(timer->expires,
-                                                   timer->base->get_time());
+                if (mode == HRTIMER_MODE_REL) {
+                        timer->expires =
+                                ktime_add_safe(timer->expires,
+                                               timer->base->get_time());
+                }
                 return 0;
         }