Commit 19dfc1f5 authored by Al Viro's avatar Al Viro
Browse files

cifs: fix the race in cifs_writev() 



O_APPEND handling there hadn't been completely fixed by Pavel's
patch; it checks the right value, but it's racy - we can't really
do that until i_mutex has been taken.

Fix by switching to __generic_file_aio_write() (open-coding
generic_file_aio_write(), actually) and pulling mutex_lock() above
inode_size_read().

Cc: stable@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent eab87235

fs/cifs/file.c

+18 −5
Original line number Diff line number Diff line
@@ -2579,19 +2579,32 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov, 
	struct cifsInodeInfo *cinode = CIFS_I(inode);

	struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;

	ssize_t rc = -EACCES;

	loff_t lock_pos = pos;

	loff_t lock_pos = iocb->ki_pos;



	if (file->f_flags & O_APPEND)

		lock_pos = i_size_read(inode);

	/*

	 * We need to hold the sem to be sure nobody modifies lock list

	 * with a brlock that prevents writing.

	 */

	down_read(&cinode->lock_sem);

	mutex_lock(&inode->i_mutex);

	if (file->f_flags & O_APPEND)

		lock_pos = i_size_read(inode);

	if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),

				     server->vals->exclusive_lock_type, NULL,

				     CIFS_WRITE_OP))

		rc = generic_file_aio_write(iocb, iov, nr_segs, pos);

				     CIFS_WRITE_OP)) {

		rc = __generic_file_aio_write(iocb, iov, nr_segs);

		mutex_unlock(&inode->i_mutex);



		if (rc > 0) {

			ssize_t err;



			err = generic_write_sync(file, iocb->ki_pos - rc, rc);

			if (rc < 0)

				rc = err;

		}

	} else {

		mutex_unlock(&inode->i_mutex);

	}

	up_read(&cinode->lock_sem);

	return rc;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE