Merge branch 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs update from Al Viro:
 "Part one:

   - struct filename-related cleanups

   - saner iov_iter_init() replacements (and switching the syscalls to
     use of those)

   - ntfs switch to ->write_iter() (Anton)

   - aio cleanups and splitting iocb into common and async parts
     (Christoph)

   - assorted fixes (me, bfields, Andrew Elble)

  There's a lot more, including the completion of switchover to
  ->{read,write}_iter(), d_inode/d_backing_inode annotations, f_flags
  race fixes, etc, but that goes after #for-davem merge.  David has
  pulled it, and once it's in I'll send the next vfs pull request"

* 'for-linus-1' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (35 commits)
  sg_start_req(): use import_iovec()
  sg_start_req(): make sure that there's not too many elements in iovec
  blk_rq_map_user(): use import_single_range()
  sg_io(): use import_iovec()
  process_vm_access: switch to {compat_,}import_iovec()
  switch keyctl_instantiate_key_common() to iov_iter
  switch {compat_,}do_readv_writev() to {compat_,}import_iovec()
  aio_setup_vectored_rw(): switch to {compat_,}import_iovec()
  vmsplice_to_user(): switch to import_iovec()
  kill aio_setup_single_vector()
  aio: simplify arguments of aio_setup_..._rw()
  aio: lift iov_iter_init() into aio_setup_..._rw()
  lift iov_iter into {compat_,}do_readv_writev()
  NFS: fix BUG() crash in notify_change() with patch to chown_common()
  dcache: return -ESTALE not -EBUSY on distributed fs race
  NTFS: Version 2.1.32 - Update file write from aio_write to write_iter.
  VFS: Add iov_iter_fault_in_multipages_readable()
  drop bogus check in file_open_root()
  switch security_inode_getattr() to struct path *
  constify tomoyo_realpath_from_path()
  ...

12 files changed, 64 insertions, 106 deletions

diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index 107db88b1d5f..dd56bffd6500 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -364,12 +364,12 @@ static int apparmor_path_chown(struct path *path, kuid_t uid, kgid_t gid)
         return common_perm(OP_CHOWN, path, AA_MAY_CHOWN, &cond);
 }
 
-static int apparmor_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
+static int apparmor_inode_getattr(const struct path *path)
 {
-        if (!mediated_filesystem(dentry))
+        if (!mediated_filesystem(path->dentry))
                 return 0;
 
-        return common_perm_mnt_dentry(OP_GETATTR, mnt, dentry,
+        return common_perm_mnt_dentry(OP_GETATTR, path->mnt, path->dentry,
                                       AA_MAY_META_READ);
 }
 
diff --git a/security/capability.c b/security/capability.c
index 070dd46f62f4..bdf22034a961 100644
--- a/security/capability.c
+++ b/security/capability.c
@@ -225,7 +225,7 @@ static int cap_inode_setattr(struct dentry *dentry, struct iattr *iattr)
         return 0;
 }
 
-static int cap_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
+static int cap_inode_getattr(const struct path *path)
 {
         return 0;
 }
diff --git a/security/keys/compat.c b/security/keys/compat.c
index 347896548ad3..25430a3aa7f7 100644
--- a/security/keys/compat.c
+++ b/security/keys/compat.c
@@ -31,30 +31,21 @@ static long compat_keyctl_instantiate_key_iov(
         key_serial_t ringid)
 {
         struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+        struct iov_iter from;
         long ret;
 
-        if (!_payload_iov || !ioc)
-                goto no_payload;
+        if (!_payload_iov)
+                ioc = 0;
 
-        ret = compat_rw_copy_check_uvector(WRITE, _payload_iov, ioc,
-                                           ARRAY_SIZE(iovstack),
-                                           iovstack, &iov);
+        ret = compat_import_iovec(WRITE, _payload_iov, ioc,
+                                  ARRAY_SIZE(iovstack), &iov,
+                                  &from);
         if (ret < 0)
-                goto err;
-        if (ret == 0)
-                goto no_payload_free;
-
-        ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
-err:
-        if (iov != iovstack)
-                kfree(iov);
-        return ret;
+                return ret;
 
-no_payload_free:
-        if (iov != iovstack)
-                kfree(iov);
-no_payload:
-        return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
+        ret = keyctl_instantiate_key_common(id, &from, ringid);
+        kfree(iov);
+        return ret;
 }
 
 /*
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 200e37867336..5105c2c2da75 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -243,9 +243,10 @@ extern long keyctl_instantiate_key_iov(key_serial_t,
                                        unsigned, key_serial_t);
 extern long keyctl_invalidate_key(key_serial_t);
 
+struct iov_iter;
 extern long keyctl_instantiate_key_common(key_serial_t,
-                                          const struct iovec *,
-                                          unsigned, size_t, key_serial_t);
+                                          struct iov_iter *,
+                                          key_serial_t);
 #ifdef CONFIG_PERSISTENT_KEYRINGS
 extern long keyctl_get_persistent(uid_t, key_serial_t);
 extern unsigned persistent_keyring_expiry;
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 4743d71e4aa6..0b9ec78a7a7a 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -998,21 +998,6 @@ static int keyctl_change_reqkey_auth(struct key *key)
 }
 
 /*
- * Copy the iovec data from userspace
- */
-static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
-                                 unsigned ioc)
-{
-        for (; ioc > 0; ioc--) {
-                if (copy_from_user(buffer, iov->iov_base, iov->iov_len) != 0)
-                        return -EFAULT;
-                buffer += iov->iov_len;
-                iov++;
-        }
-        return 0;
-}
-
-/*
  * Instantiate a key with the specified payload and link the key into the
  * destination keyring if one is given.
  *
@@ -1022,20 +1007,21 @@ static long copy_from_user_iovec(void *buffer, const struct iovec *iov,
  * If successful, 0 will be returned.
  */
 long keyctl_instantiate_key_common(key_serial_t id,
-                                   const struct iovec *payload_iov,
-                                   unsigned ioc,
-                                   size_t plen,
+                                   struct iov_iter *from,
                                    key_serial_t ringid)
 {
         const struct cred *cred = current_cred();
         struct request_key_auth *rka;
         struct key *instkey, *dest_keyring;
+        size_t plen = from ? iov_iter_count(from) : 0;
         void *payload;
         long ret;
-        bool vm = false;
 
         kenter("%d,,%zu,%d", id, plen, ringid);
 
+        if (!plen)
+                from = NULL;
+
         ret = -EINVAL;
         if (plen > 1024 * 1024 - 1)
                 goto error;
@@ -1054,20 +1040,19 @@ long keyctl_instantiate_key_common(key_serial_t id,
         /* pull the payload in if one was supplied */
         payload = NULL;
 
-        if (payload_iov) {
+        if (from) {
                 ret = -ENOMEM;
                 payload = kmalloc(plen, GFP_KERNEL);
                 if (!payload) {
                         if (plen <= PAGE_SIZE)
                                 goto error;
-                        vm = true;
                         payload = vmalloc(plen);
                         if (!payload)
                                 goto error;
                 }
 
-                ret = copy_from_user_iovec(payload, payload_iov, ioc);
-                if (ret < 0)
+                ret = -EFAULT;
+                if (copy_from_iter(payload, plen, from) != plen)
                         goto error2;
         }
 
@@ -1089,10 +1074,7 @@ long keyctl_instantiate_key_common(key_serial_t id,
                 keyctl_change_reqkey_auth(NULL);
 
 error2:
-        if (!vm)
-                kfree(payload);
-        else
-                vfree(payload);
+        kvfree(payload);
 error:
         return ret;
 }
@@ -1112,15 +1094,19 @@ long keyctl_instantiate_key(key_serial_t id,
                             key_serial_t ringid)
 {
         if (_payload && plen) {
-                struct iovec iov[1] = {
-                        [0].iov_base = (void __user *)_payload,
-                        [0].iov_len  = plen
-                };
+                struct iovec iov;
+                struct iov_iter from;
+                int ret;
 
-                return keyctl_instantiate_key_common(id, iov, 1, plen, ringid);
+                ret = import_single_range(WRITE, (void __user *)_payload, plen,
+                                          &iov, &from);
+                if (unlikely(ret))
+                        return ret;
+
+                return keyctl_instantiate_key_common(id, &from, ringid);
         }
 
-        return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
+        return keyctl_instantiate_key_common(id, NULL, ringid);
 }
 
 /*
@@ -1138,29 +1124,19 @@ long keyctl_instantiate_key_iov(key_serial_t id,
                                 key_serial_t ringid)
 {
         struct iovec iovstack[UIO_FASTIOV], *iov = iovstack;
+        struct iov_iter from;
         long ret;
 
-        if (!_payload_iov || !ioc)
-                goto no_payload;
+        if (!_payload_iov)
+                ioc = 0;
 
-        ret = rw_copy_check_uvector(WRITE, _payload_iov, ioc,
-                                    ARRAY_SIZE(iovstack), iovstack, &iov);
+        ret = import_iovec(WRITE, _payload_iov, ioc,
+                                    ARRAY_SIZE(iovstack), &iov, &from);
         if (ret < 0)
-                goto err;
-        if (ret == 0)
-                goto no_payload_free;
-
-        ret = keyctl_instantiate_key_common(id, iov, ioc, ret, ringid);
-err:
-        if (iov != iovstack)
-                kfree(iov);
+                return ret;
+        ret = keyctl_instantiate_key_common(id, &from, ringid);
+        kfree(iov);
         return ret;
-
-no_payload_free:
-        if (iov != iovstack)
-                kfree(iov);
-no_payload:
-        return keyctl_instantiate_key_common(id, NULL, 0, 0, ringid);
 }
 
 /*
diff --git a/security/security.c b/security/security.c
index e81d5bbe7363..ed890c6d31c5 100644
--- a/security/security.c
+++ b/security/security.c
@@ -608,11 +608,11 @@ int security_inode_setattr(struct dentry *dentry, struct iattr *attr)
 }
 EXPORT_SYMBOL_GPL(security_inode_setattr);
 
-int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
+int security_inode_getattr(const struct path *path)
 {
-        if (unlikely(IS_PRIVATE(dentry->d_inode)))
+        if (unlikely(IS_PRIVATE(path->dentry->d_inode)))
                 return 0;
-        return security_ops->inode_getattr(mnt, dentry);
+        return security_ops->inode_getattr(path);
 }
 
 int security_inode_setxattr(struct dentry *dentry, const char *name,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 4d1a54190388..e119cdcffc87 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1623,7 +1623,7 @@ static inline int dentry_has_perm(const struct cred *cred,
    the path to help the auditing code to more easily generate the
    pathname if needed. */
 static inline int path_has_perm(const struct cred *cred,
-                                struct path *path,
+                                const struct path *path,
                                 u32 av)
 {
         struct inode *inode = path->dentry->d_inode;
@@ -2954,15 +2954,9 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
         return dentry_has_perm(cred, dentry, av);
 }
 
-static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
+static int selinux_inode_getattr(const struct path *path)
 {
-        const struct cred *cred = current_cred();
-        struct path path;
-
-        path.dentry = dentry;
-        path.mnt = mnt;
-
-        return path_has_perm(cred, &path, FILE__GETATTR);
+        return path_has_perm(current_cred(), path, FILE__GETATTR);
 }
 
 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index c934311812f1..1511965549b8 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -1034,19 +1034,16 @@ static int smack_inode_setattr(struct dentry *dentry, struct iattr *iattr)
  *
  * Returns 0 if access is permitted, an error code otherwise
  */
-static int smack_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
+static int smack_inode_getattr(const struct path *path)
 {
         struct smk_audit_info ad;
-        struct path path;
+        struct inode *inode = path->dentry->d_inode;
         int rc;
 
-        path.dentry = dentry;
-        path.mnt = mnt;
-
         smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
-        smk_ad_setfield_u_fs_path(&ad, path);
-        rc = smk_curacc(smk_of_inode(dentry->d_inode), MAY_READ, &ad);
-        rc = smk_bu_inode(dentry->d_inode, MAY_READ, rc);
+        smk_ad_setfield_u_fs_path(&ad, *path);
+        rc = smk_curacc(smk_of_inode(inode), MAY_READ, &ad);
+        rc = smk_bu_inode(inode, MAY_READ, rc);
         return rc;
 }
 
diff --git a/security/tomoyo/common.h b/security/tomoyo/common.h
index b897d4862016..f9c9fb1d56b4 100644
--- a/security/tomoyo/common.h
+++ b/security/tomoyo/common.h
@@ -945,7 +945,7 @@ char *tomoyo_encode2(const char *str, int str_len);
 char *tomoyo_init_log(struct tomoyo_request_info *r, int len, const char *fmt,
                       va_list args);
 char *tomoyo_read_token(struct tomoyo_acl_param *param);
-char *tomoyo_realpath_from_path(struct path *path);
+char *tomoyo_realpath_from_path(const struct path *path);
 char *tomoyo_realpath_nofollow(const char *pathname);
 const char *tomoyo_get_exe(void);
 const char *tomoyo_yesno(const unsigned int value);
@@ -978,7 +978,7 @@ int tomoyo_path2_perm(const u8 operation, struct path *path1,
                       struct path *path2);
 int tomoyo_path_number_perm(const u8 operation, struct path *path,
                             unsigned long number);
-int tomoyo_path_perm(const u8 operation, struct path *path,
+int tomoyo_path_perm(const u8 operation, const struct path *path,
                      const char *target);
 unsigned int tomoyo_poll_control(struct file *file, poll_table *wait);
 unsigned int tomoyo_poll_log(struct file *file, poll_table *wait);
diff --git a/security/tomoyo/file.c b/security/tomoyo/file.c
index c151a1869597..2367b100cc62 100644
--- a/security/tomoyo/file.c
+++ b/security/tomoyo/file.c
@@ -145,7 +145,7 @@ static void tomoyo_add_slash(struct tomoyo_path_info *buf)
  *
  * Returns true on success, false otherwise.
  */
-static bool tomoyo_get_realpath(struct tomoyo_path_info *buf, struct path *path)
+static bool tomoyo_get_realpath(struct tomoyo_path_info *buf, const struct path *path)
 {
         buf->name = tomoyo_realpath_from_path(path);
         if (buf->name) {
@@ -782,7 +782,7 @@ int tomoyo_check_open_permission(struct tomoyo_domain_info *domain,
  *
  * Returns 0 on success, negative value otherwise.
  */
-int tomoyo_path_perm(const u8 operation, struct path *path, const char *target)
+int tomoyo_path_perm(const u8 operation, const struct path *path, const char *target)
 {
         struct tomoyo_request_info r;
         struct tomoyo_obj_info obj = {
diff --git a/security/tomoyo/realpath.c b/security/tomoyo/realpath.c
index bed745c8b1a3..1e0d480ff6a6 100644
--- a/security/tomoyo/realpath.c
+++ b/security/tomoyo/realpath.c
@@ -89,7 +89,7 @@ char *tomoyo_encode(const char *str)
  *
  * If dentry is a directory, trailing '/' is appended.
  */
-static char *tomoyo_get_absolute_path(struct path *path, char * const buffer,
+static char *tomoyo_get_absolute_path(const struct path *path, char * const buffer,
                                       const int buflen)
 {
         char *pos = ERR_PTR(-ENOMEM);
@@ -216,7 +216,7 @@ out:
  *
  * Returns the buffer.
  */
-static char *tomoyo_get_socket_name(struct path *path, char * const buffer,
+static char *tomoyo_get_socket_name(const struct path *path, char * const buffer,
                                     const int buflen)
 {
         struct inode *inode = path->dentry->d_inode;
@@ -247,7 +247,7 @@ static char *tomoyo_get_socket_name(struct path *path, char * const buffer,
  * These functions use kzalloc(), so the caller must call kfree()
  * if these functions didn't return NULL.
  */
-char *tomoyo_realpath_from_path(struct path *path)
+char *tomoyo_realpath_from_path(const struct path *path)
 {
         char *buf = NULL;
         char *name = NULL;
diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c
index f0b756e27fed..57c88d52ffa5 100644
--- a/security/tomoyo/tomoyo.c
+++ b/security/tomoyo/tomoyo.c
@@ -144,10 +144,9 @@ static int tomoyo_bprm_check_security(struct linux_binprm *bprm)
  *
  * Returns 0 on success, negative value otherwise.
  */
-static int tomoyo_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
+static int tomoyo_inode_getattr(const struct path *path)
 {
-        struct path path = { mnt, dentry };
-        return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, &path, NULL);
+        return tomoyo_path_perm(TOMOYO_TYPE_GETATTR, path, NULL);
 }
 
 /**