Commit 1f7a4c73 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag '9p-for-4.19-2' of git://github.com/martinetd/linux 

Pull 9p updates from Dominique Martinet:
 "This contains mostly fixes (6 to be backported to stable) and a few
  changes, here is the breakdown:

   - rework how fids are attributed by replacing some custom tracking in
     a list by an idr

   - for packet-based transports (virtio/rdma) validate that the packet
     length matches what the header says

   - a few race condition fixes found by syzkaller

   - missing argument check when NULL device is passed in sys_mount

   - a few virtio fixes

   - some spelling and style fixes"

* tag '9p-for-4.19-2' of git://github.com/martinetd/linux: (21 commits)
  net/9p/trans_virtio.c: add null terminal for mount tag
  9p/virtio: fix off-by-one error in sg list bounds check
  9p: fix whitespace issues
  9p: fix multiple NULL-pointer-dereferences
  fs/9p/xattr.c: catch the error of p9_client_clunk when setting xattr failed
  9p: validate PDU length
  net/9p/trans_fd.c: fix race by holding the lock
  net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()
  net/9p/virtio: Fix hard lockup in req_done
  net/9p/trans_virtio.c: fix some spell mistakes in comments
  9p/net: Fix zero-copy path in the 9p virtio transport
  9p: Embed wait_queue_head into p9_req_t
  9p: Replace the fidlist with an IDR
  9p: Change p9_fid_create calling convention
  9p: Fix comment on smp_wmb
  net/9p/client.c: version pointer uninitialized
  fs/9p/v9fs.c: fix spelling mistake "Uknown" -> "Unknown"
  net/9p: fix error path of p9_virtio_probe
  9p/net/protocol.c: return -ENOMEM when kmalloc() failed
  net/9p/client.c: add missing '\n' at the end of p9_debug()
  ...
parents 6ada4e28 edcd9d97

fs/9p/v9fs.c

+1 −1
Original line number Diff line number Diff line
@@ -343,7 +343,7 @@ static int v9fs_parse_options(struct v9fs_session_info *v9ses, char *opts) 
				v9ses->uid = make_kuid(current_user_ns(), uid);

				if (!uid_valid(v9ses->uid)) {

					ret = -EINVAL;

					pr_info("Uknown uid %s\n", s);

					pr_info("Unknown uid %s\n", s);

				}

			}

fs/9p/vfs_file.c

+1 −1
Original line number Diff line number Diff line
@@ -533,7 +533,7 @@ v9fs_mmap_file_mmap(struct file *filp, struct vm_area_struct *vma) 
	return retval;

}



static int

static vm_fault_t

v9fs_vm_page_mkwrite(struct vm_fault *vmf)

{

	struct v9fs_inode *v9inode;

fs/9p/xattr.c

+4 −2
Original line number Diff line number Diff line
@@ -105,7 +105,7 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, 
{

	struct kvec kvec = {.iov_base = (void *)value, .iov_len = value_len};

	struct iov_iter from;

	int retval;

	int retval, err;



	iov_iter_kvec(&from, WRITE | ITER_KVEC, &kvec, 1, value_len);
@@ -126,7 +126,9 @@ int v9fs_fid_xattr_set(struct p9_fid *fid, const char *name, 
			 retval);

	else

		p9_client_write(fid, 0, &from, &retval);

	p9_client_clunk(fid);

	err = p9_client_clunk(fid);

	if (!retval && err)

		retval = err;

	return retval;

}

include/net/9p/client.h

+4 −7
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ 
#define NET_9P_CLIENT_H



#include <linux/utsname.h>

#include <linux/idr.h>



/* Number of requests per row */

#define P9_ROW_MAXTAG 255
@@ -112,7 +113,7 @@ enum p9_req_status_t { 
struct p9_req_t {

	int status;

	int t_err;

	wait_queue_head_t *wq;

	wait_queue_head_t wq;

	struct p9_fcall *tc;

	struct p9_fcall *rc;

	void *aux;
@@ -128,8 +129,7 @@ struct p9_req_t { 
 * @proto_version: 9P protocol version to use

 * @trans_mod: module API instantiated with this client

 * @trans: tranport instance state and API

 * @fidpool: fid handle accounting for session

 * @fidlist: List of active fid handles

 * @fids: All active FID handles

 * @tagpool - transaction id accounting for session

 * @reqs - 2D array of requests

 * @max_tag - current maximum tag id allocated
@@ -169,8 +169,7 @@ struct p9_client { 
		} tcp;

	} trans_opts;



	struct p9_idpool *fidpool;

	struct list_head fidlist;

	struct idr fids;



	struct p9_idpool *tagpool;

	struct p9_req_t *reqs[P9_ROW_MAXTAG];
@@ -188,7 +187,6 @@ struct p9_client { 
 * @iounit: the server reported maximum transaction size for this file

 * @uid: the numeric uid of the local user who owns this handle

 * @rdir: readdir accounting structure (allocated on demand)

 * @flist: per-client-instance fid tracking

 * @dlist: per-dentry fid tracking

 *

 * TODO: This needs lots of explanation.
@@ -204,7 +202,6 @@ struct p9_fid { 


	void *rdir;



	struct list_head flist;

	struct hlist_node dlist;	/* list of all fids attached to a dentry */

};

net/9p/client.c

+50 −69
Original line number Diff line number Diff line
@@ -283,8 +283,9 @@ p9_tag_alloc(struct p9_client *c, u16 tag, unsigned int max_size) 
				return ERR_PTR(-ENOMEM);

			}

			for (col = 0; col < P9_ROW_MAXTAG; col++) {

				c->reqs[row][col].status = REQ_STATUS_IDLE;

				c->reqs[row][col].tc = NULL;

				req = &c->reqs[row][col];

				req->status = REQ_STATUS_IDLE;

				init_waitqueue_head(&req->wq);

			}

			c->max_tag += P9_ROW_MAXTAG;

		}
@@ -294,13 +295,6 @@ p9_tag_alloc(struct p9_client *c, u16 tag, unsigned int max_size) 
	col = tag % P9_ROW_MAXTAG;



	req = &c->reqs[row][col];

	if (!req->wq) {

		req->wq = kmalloc(sizeof(wait_queue_head_t), GFP_NOFS);

		if (!req->wq)

			goto grow_failed;

		init_waitqueue_head(req->wq);

	}



	if (!req->tc)

		req->tc = p9_fcall_alloc(alloc_msize);

	if (!req->rc)
@@ -320,9 +314,7 @@ grow_failed: 
	pr_err("Couldn't grow tag array\n");

	kfree(req->tc);

	kfree(req->rc);

	kfree(req->wq);

	req->tc = req->rc = NULL;

	req->wq = NULL;

	return ERR_PTR(-ENOMEM);

}
@@ -410,7 +402,6 @@ static void p9_tag_cleanup(struct p9_client *c) 
	/* free requests associated with tags */

	for (row = 0; row < (c->max_tag/P9_ROW_MAXTAG); row++) {

		for (col = 0; col < P9_ROW_MAXTAG; col++) {

			kfree(c->reqs[row][col].wq);

			kfree(c->reqs[row][col].tc);

			kfree(c->reqs[row][col].rc);

		}
@@ -448,12 +439,12 @@ void p9_client_cb(struct p9_client *c, struct p9_req_t *req, int status) 


	/*

	 * This barrier is needed to make sure any change made to req before

	 * the other thread wakes up will indeed be seen by the waiting side.

	 * the status change is visible to another thread

	 */

	smp_wmb();

	req->status = status;



	wake_up(req->wq);

	wake_up(&req->wq);

	p9_debug(P9_DEBUG_MUX, "wakeup: %d\n", req->tc->tag);

}

EXPORT_SYMBOL(p9_client_cb);
@@ -478,20 +469,11 @@ p9_parse_header(struct p9_fcall *pdu, int32_t *size, int8_t *type, int16_t *tag, 
	int err;



	pdu->offset = 0;

	if (pdu->size == 0)

		pdu->size = 7;



	err = p9pdu_readf(pdu, 0, "dbw", &r_size, &r_type, &r_tag);

	if (err)

		goto rewind_and_exit;



	pdu->size = r_size;

	pdu->id = r_type;

	pdu->tag = r_tag;



	p9_debug(P9_DEBUG_9P, "<<< size=%d type: %d tag: %d\n",

		 pdu->size, pdu->id, pdu->tag);



	if (type)

		*type = r_type;

	if (tag)
@@ -499,6 +481,16 @@ p9_parse_header(struct p9_fcall *pdu, int32_t *size, int8_t *type, int16_t *tag, 
	if (size)

		*size = r_size;



	if (pdu->size != r_size || r_size < 7) {

		err = -EINVAL;

		goto rewind_and_exit;

	}



	pdu->id = r_type;

	pdu->tag = r_tag;



	p9_debug(P9_DEBUG_9P, "<<< size=%d type: %d tag: %d\n",

		 pdu->size, pdu->id, pdu->tag);



rewind_and_exit:

	if (rewind)
@@ -525,6 +517,12 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req) 
	int ecode;



	err = p9_parse_header(req->rc, NULL, &type, NULL, 0);

	if (req->rc->size >= c->msize) {

		p9_debug(P9_DEBUG_ERROR,

			 "requested packet size too big: %d\n",

			 req->rc->size);

		return -EIO;

	}

	/*

	 * dump the response from server

	 * This should be after check errors which poplulate pdu_fcall.
@@ -774,7 +772,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...) 
	}

again:

	/* Wait for the response */

	err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD);

	err = wait_event_killable(req->wq, req->status >= REQ_STATUS_RCVD);



	/*

	 * Make sure our req is coherent with regard to updates in other
@@ -909,34 +907,31 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt) 
{

	int ret;

	struct p9_fid *fid;

	unsigned long flags;



	p9_debug(P9_DEBUG_FID, "clnt %p\n", clnt);

	fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL);

	if (!fid)

		return ERR_PTR(-ENOMEM);



	ret = p9_idpool_get(clnt->fidpool);

	if (ret < 0) {

		ret = -ENOSPC;

		goto error;

	}

	fid->fid = ret;

		return NULL;



	memset(&fid->qid, 0, sizeof(struct p9_qid));

	fid->mode = -1;

	fid->uid = current_fsuid();

	fid->clnt = clnt;

	fid->rdir = NULL;

	spin_lock_irqsave(&clnt->lock, flags);

	list_add(&fid->flist, &clnt->fidlist);

	spin_unlock_irqrestore(&clnt->lock, flags);

	fid->fid = 0;



	idr_preload(GFP_KERNEL);

	spin_lock_irq(&clnt->lock);

	ret = idr_alloc_u32(&clnt->fids, fid, &fid->fid, P9_NOFID - 1,

			    GFP_NOWAIT);

	spin_unlock_irq(&clnt->lock);

	idr_preload_end();



	if (!ret)

		return fid;



error:

	kfree(fid);

	return ERR_PTR(ret);

	return NULL;

}



static void p9_fid_destroy(struct p9_fid *fid)
@@ -946,9 +941,8 @@ static void p9_fid_destroy(struct p9_fid *fid) 


	p9_debug(P9_DEBUG_FID, "fid %d\n", fid->fid);

	clnt = fid->clnt;

	p9_idpool_put(fid->fid, clnt->fidpool);

	spin_lock_irqsave(&clnt->lock, flags);

	list_del(&fid->flist);

	idr_remove(&clnt->fids, fid->fid);

	spin_unlock_irqrestore(&clnt->lock, flags);

	kfree(fid->rdir);

	kfree(fid);
@@ -958,7 +952,7 @@ static int p9_client_version(struct p9_client *c) 
{

	int err = 0;

	struct p9_req_t *req;

	char *version;

	char *version = NULL;

	int msize;



	p9_debug(P9_DEBUG_9P, ">>> TVERSION msize %d protocol %d\n",
@@ -1031,7 +1025,7 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) 
	memcpy(clnt->name, client_id, strlen(client_id) + 1);



	spin_lock_init(&clnt->lock);

	INIT_LIST_HEAD(&clnt->fidlist);

	idr_init(&clnt->fids);



	err = p9_tag_init(clnt);

	if (err < 0)
@@ -1051,18 +1045,12 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) 
		goto destroy_tagpool;

	}



	clnt->fidpool = p9_idpool_create();

	if (IS_ERR(clnt->fidpool)) {

		err = PTR_ERR(clnt->fidpool);

		goto put_trans;

	}



	p9_debug(P9_DEBUG_MUX, "clnt %p trans %p msize %d protocol %d\n",

		 clnt, clnt->trans_mod, clnt->msize, clnt->proto_version);



	err = clnt->trans_mod->create(clnt, dev_name, options);

	if (err)

		goto destroy_fidpool;

		goto put_trans;



	if (clnt->msize > clnt->trans_mod->maxsize)

		clnt->msize = clnt->trans_mod->maxsize;
@@ -1075,8 +1063,6 @@ struct p9_client *p9_client_create(const char *dev_name, char *options) 


close_trans:

	clnt->trans_mod->close(clnt);

destroy_fidpool:

	p9_idpool_destroy(clnt->fidpool);

put_trans:

	v9fs_put_trans(clnt->trans_mod);

destroy_tagpool:
@@ -1089,7 +1075,8 @@ EXPORT_SYMBOL(p9_client_create); 


void p9_client_destroy(struct p9_client *clnt)

{

	struct p9_fid *fid, *fidptr;

	struct p9_fid *fid;

	int id;



	p9_debug(P9_DEBUG_MUX, "clnt %p\n", clnt);
@@ -1098,14 +1085,11 @@ void p9_client_destroy(struct p9_client *clnt) 


	v9fs_put_trans(clnt->trans_mod);



	list_for_each_entry_safe(fid, fidptr, &clnt->fidlist, flist) {

	idr_for_each_entry(&clnt->fids, fid, id) {

		pr_info("Found fid %d not clunked\n", fid->fid);

		p9_fid_destroy(fid);

	}



	if (clnt->fidpool)

		p9_idpool_destroy(clnt->fidpool);



	p9_tag_cleanup(clnt);



	kfree(clnt);
@@ -1138,9 +1122,8 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid, 
	p9_debug(P9_DEBUG_9P, ">>> TATTACH afid %d uname %s aname %s\n",

		 afid ? afid->fid : -1, uname, aname);

	fid = p9_fid_create(clnt);

	if (IS_ERR(fid)) {

		err = PTR_ERR(fid);

		fid = NULL;

	if (!fid) {

		err = -ENOMEM;

		goto error;

	}

	fid->uid = n_uname;
@@ -1189,9 +1172,8 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, uint16_t nwname, 
	clnt = oldfid->clnt;

	if (clone) {

		fid = p9_fid_create(clnt);

		if (IS_ERR(fid)) {

			err = PTR_ERR(fid);

			fid = NULL;

		if (!fid) {

			err = -ENOMEM;

			goto error;

		}
@@ -1790,7 +1772,7 @@ struct p9_stat_dotl *p9_client_getattr_dotl(struct p9_fid *fid, 
		"<<< st_mtime_sec=%lld st_mtime_nsec=%lld\n"

		"<<< st_ctime_sec=%lld st_ctime_nsec=%lld\n"

		"<<< st_btime_sec=%lld st_btime_nsec=%lld\n"

		"<<< st_gen=%lld st_data_version=%lld",

		"<<< st_gen=%lld st_data_version=%lld\n",

		ret->st_result_mask, ret->qid.type, ret->qid.path,

		ret->qid.version, ret->st_mode, ret->st_nlink,

		from_kuid(&init_user_ns, ret->st_uid),
@@ -2019,9 +2001,8 @@ struct p9_fid *p9_client_xattrwalk(struct p9_fid *file_fid, 
	err = 0;

	clnt = file_fid->clnt;

	attr_fid = p9_fid_create(clnt);

	if (IS_ERR(attr_fid)) {

		err = PTR_ERR(attr_fid);

		attr_fid = NULL;

	if (!attr_fid) {

		err = -ENOMEM;

		goto error;

	}

	p9_debug(P9_DEBUG_9P,

CRA Git | Maintained and supported by SUSTech CRA and CCSE