1 files changed, 109 insertions, 60 deletions

diff --git a/fs/open.c b/fs/open.c
index 54198538b67e..b70e7666bb2c 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -244,21 +244,21 @@ static long do_sys_truncate(const char __user * path, loff_t length)
         if (!S_ISREG(inode->i_mode))
                 goto dput_and_out;
 
-        error = vfs_permission(&nd, MAY_WRITE);
+        error = mnt_want_write(nd.path.mnt);
         if (error)
                 goto dput_and_out;
 
-        error = -EROFS;
-        if (IS_RDONLY(inode))
-                goto dput_and_out;
+        error = vfs_permission(&nd, MAY_WRITE);
+        if (error)
+                goto mnt_drop_write_and_out;
 
         error = -EPERM;
         if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-                goto dput_and_out;
+                goto mnt_drop_write_and_out;
 
         error = get_write_access(inode);
         if (error)
-                goto dput_and_out;
+                goto mnt_drop_write_and_out;
 
         /*
          * Make sure that there are no leases.  get_write_access() protects
@@ -276,6 +276,8 @@ static long do_sys_truncate(const char __user * path, loff_t length)
 
 put_write_and_out:
         put_write_access(inode);
+mnt_drop_write_and_out:
+        mnt_drop_write(nd.path.mnt);
 dput_and_out:
         path_put(&nd.path);
 out:
@@ -335,7 +337,7 @@ asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
 {
         long ret = do_sys_ftruncate(fd, length, 1);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(2, ret, fd, length);
         return ret;
 }
 
@@ -350,7 +352,7 @@ asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
 {
         long ret = do_sys_ftruncate(fd, length, 0);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(2, ret, fd, length);
         return ret;
 }
 #endif
@@ -457,8 +459,17 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
         if(res || !(mode & S_IWOTH) ||
            special_file(nd.path.dentry->d_inode->i_mode))
                 goto out_path_release;
-
-        if(IS_RDONLY(nd.path.dentry->d_inode))
+        /*
+         * This is a rare case where using __mnt_is_readonly()
+         * is OK without a mnt_want/drop_write() pair.  Since
+         * no actual write to the fs is performed here, we do
+         * not need to telegraph to that to anyone.
+         *
+         * By doing this, we accept that this access is
+         * inherently racy and know that the fs may change
+         * state before we even see this result.
+         */
+        if (__mnt_is_readonly(nd.path.mnt))
                 res = -EROFS;
 
 out_path_release:
@@ -567,12 +578,12 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
 
         audit_inode(NULL, dentry);
 
-        err = -EROFS;
-        if (IS_RDONLY(inode))
+        err = mnt_want_write(file->f_path.mnt);
+        if (err)
                 goto out_putf;
         err = -EPERM;
         if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-                goto out_putf;
+                goto out_drop_write;
         mutex_lock(&inode->i_mutex);
         if (mode == (mode_t) -1)
                 mode = inode->i_mode;
@@ -581,6 +592,8 @@ asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
         err = notify_change(dentry, &newattrs);
         mutex_unlock(&inode->i_mutex);
 
+out_drop_write:
+        mnt_drop_write(file->f_path.mnt);
 out_putf:
         fput(file);
 out:
@@ -600,13 +613,13 @@ asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
                 goto out;
         inode = nd.path.dentry->d_inode;
 
-        error = -EROFS;
-        if (IS_RDONLY(inode))
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
                 goto dput_and_out;
 
         error = -EPERM;
         if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-                goto dput_and_out;
+                goto out_drop_write;
 
         mutex_lock(&inode->i_mutex);
         if (mode == (mode_t) -1)
@@ -616,6 +629,8 @@ asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
         error = notify_change(nd.path.dentry, &newattrs);
         mutex_unlock(&inode->i_mutex);
 
+out_drop_write:
+        mnt_drop_write(nd.path.mnt);
 dput_and_out:
         path_put(&nd.path);
 out:
@@ -638,9 +653,6 @@ static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
                 printk(KERN_ERR "chown_common: NULL inode\n");
                 goto out;
         }
-        error = -EROFS;
-        if (IS_RDONLY(inode))
-                goto out;
         error = -EPERM;
         if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
                 goto out;
@@ -671,7 +683,12 @@ asmlinkage long sys_chown(const char __user * filename, uid_t user, gid_t group)
         error = user_path_walk(filename, &nd);
         if (error)
                 goto out;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_release;
         error = chown_common(nd.path.dentry, user, group);
+        mnt_drop_write(nd.path.mnt);
+out_release:
         path_put(&nd.path);
 out:
         return error;
@@ -691,7 +708,12 @@ asmlinkage long sys_fchownat(int dfd, const char __user *filename, uid_t user,
         error = __user_walk_fd(dfd, filename, follow, &nd);
         if (error)
                 goto out;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_release;
         error = chown_common(nd.path.dentry, user, group);
+        mnt_drop_write(nd.path.mnt);
+out_release:
         path_put(&nd.path);
 out:
         return error;
@@ -705,7 +727,12 @@ asmlinkage long sys_lchown(const char __user * filename, uid_t user, gid_t group
         error = user_path_walk_link(filename, &nd);
         if (error)
                 goto out;
+        error = mnt_want_write(nd.path.mnt);
+        if (error)
+                goto out_release;
         error = chown_common(nd.path.dentry, user, group);
+        mnt_drop_write(nd.path.mnt);
+out_release:
         path_put(&nd.path);
 out:
         return error;
@@ -722,14 +749,48 @@ asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
         if (!file)
                 goto out;
 
+        error = mnt_want_write(file->f_path.mnt);
+        if (error)
+                goto out_fput;
         dentry = file->f_path.dentry;
         audit_inode(NULL, dentry);
         error = chown_common(dentry, user, group);
+        mnt_drop_write(file->f_path.mnt);
+out_fput:
         fput(file);
 out:
         return error;
 }
 
+/*
+ * You have to be very careful that these write
+ * counts get cleaned up in error cases and
+ * upon __fput().  This should probably never
+ * be called outside of __dentry_open().
+ */
+static inline int __get_file_write_access(struct inode *inode,
+                                          struct vfsmount *mnt)
+{
+        int error;
+        error = get_write_access(inode);
+        if (error)
+                return error;
+        /*
+         * Do not take mount writer counts on
+         * special files since no writes to
+         * the mount itself will occur.
+         */
+        if (!special_file(inode->i_mode)) {
+                /*
+                 * Balanced in __fput()
+                 */
+                error = mnt_want_write(mnt);
+                if (error)
+                        put_write_access(inode);
+        }
+        return error;
+}
+
 static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
                                         int flags, struct file *f,
                                         int (*open)(struct inode *, struct file *))
@@ -742,9 +803,11 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
                                 FMODE_PREAD | FMODE_PWRITE;
         inode = dentry->d_inode;
         if (f->f_mode & FMODE_WRITE) {
-                error = get_write_access(inode);
+                error = __get_file_write_access(inode, mnt);
                 if (error)
                         goto cleanup_file;
+                if (!special_file(inode->i_mode))
+                        file_take_write(f);
         }
 
         f->f_mapping = inode->i_mapping;
@@ -784,8 +847,19 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
 
 cleanup_all:
         fops_put(f->f_op);
-        if (f->f_mode & FMODE_WRITE)
+        if (f->f_mode & FMODE_WRITE) {
                 put_write_access(inode);
+                if (!special_file(inode->i_mode)) {
+                        /*
+                         * We don't consider this a real
+                         * mnt_want/drop_write() pair
+                         * because it all happenend right
+                         * here, so just reset the state.
+                         */
+                        file_reset_write(f);
+                        mnt_drop_write(mnt);
+                }
+        }
         file_kill(f);
         f->f_path.dentry = NULL;
         f->f_path.mnt = NULL;
@@ -796,43 +870,6 @@ cleanup_file:
         return ERR_PTR(error);
 }
 
-/*
- * Note that while the flag value (low two bits) for sys_open means:
- *      00 - read-only
- *      01 - write-only
- *      10 - read-write
- *      11 - special
- * it is changed into
- *      00 - no permissions needed
- *      01 - read-permission
- *      10 - write-permission
- *      11 - read-write
- * for the internal routines (ie open_namei()/follow_link() etc). 00 is
- * used by symlinks.
- */
-static struct file *do_filp_open(int dfd, const char *filename, int flags,
-                                 int mode)
-{
-        int namei_flags, error;
-        struct nameidata nd;
-
-        namei_flags = flags;
-        if ((namei_flags+1) & O_ACCMODE)
-                namei_flags++;
-
-        error = open_namei(dfd, filename, namei_flags, mode, &nd);
-        if (!error)
-                return nameidata_to_filp(&nd, flags);
-
-        return ERR_PTR(error);
-}
-
-struct file *filp_open(const char *filename, int flags, int mode)
-{
-        return do_filp_open(AT_FDCWD, filename, flags, mode);
-}
-EXPORT_SYMBOL(filp_open);
-
 /**
  * lookup_instantiate_filp - instantiates the open intent filp
  * @nd: pointer to nameidata
@@ -903,6 +940,18 @@ struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
         int error;
         struct file *f;
 
+        /*
+         * We must always pass in a valid mount pointer.   Historically
+         * callers got away with not passing it, but we must enforce this at
+         * the earliest possible point now to avoid strange problems deep in the
+         * filesystem stack.
+         */
+        if (!mnt) {
+                printk(KERN_WARNING "%s called with NULL vfsmount\n", __func__);
+                dump_stack();
+                return ERR_PTR(-EINVAL);
+        }
+
         error = -ENFILE;
         f = get_empty_filp();
         if (f == NULL) {
@@ -1055,7 +1104,7 @@ asmlinkage long sys_open(const char __user *filename, int flags, int mode)
 
         ret = do_sys_open(AT_FDCWD, filename, flags, mode);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(3, ret, filename, flags, mode);
         return ret;
 }
 
@@ -1069,7 +1118,7 @@ asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
 
         ret = do_sys_open(dfd, filename, flags, mode);
         /* avoid REGPARM breakage on x86: */
-        prevent_tail_call(ret);
+        asmlinkage_protect(4, ret, dfd, filename, flags, mode);
         return ret;
 }