Commit 23281c80 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs 

Pull fsnotify updates from Jan Kara:

 - fixes of use-after-tree issues when handling fanotify permission
   events from Miklos

 - refcount_t conversions from Elena

 - fixes of ENOMEM handling in dnotify and fsnotify from me

* 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fsnotify: convert fsnotify_mark.refcnt from atomic_t to refcount_t
  fanotify: clean up CONFIG_FANOTIFY_ACCESS_PERMISSIONS ifdefs
  fsnotify: clean up fsnotify()
  fanotify: fix fsnotify_prepare_user_wait() failure
  fsnotify: fix pinning group in fsnotify_prepare_user_wait()
  fsnotify: pin both inode and vfsmount mark
  fsnotify: clean up fsnotify_prepare/finish_user_wait()
  fsnotify: convert fsnotify_group.refcnt from atomic_t to refcount_t
  fsnotify: Protect bail out path of fsnotify_add_mark_locked() properly
  dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()
parents f0b60bfa ab97f873

fs/notify/dnotify/dnotify.c

+6 −1
Original line number Diff line number Diff line
@@ -319,7 +319,11 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) 
		dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark);

		spin_lock(&fsn_mark->lock);

	} else {

		fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);

		error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);

		if (error) {

			mutex_unlock(&dnotify_group->mark_mutex);

			goto out_err;

		}

		spin_lock(&new_fsn_mark->lock);

		fsn_mark = new_fsn_mark;

		dn_mark = new_dn_mark;
@@ -345,6 +349,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg) 
		 */

		if (dn_mark == new_dn_mark)

			destroy = 1;

		error = 0;

		goto out;

	}

fs/notify/fanotify/fanotify.c

+20 −29
Original line number Diff line number Diff line
@@ -36,15 +36,13 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event) 


	pr_debug("%s: list=%p event=%p\n", __func__, list, event);



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	/*

	 * Don't merge a permission event with any other event so that we know

	 * the event structure we have created in fanotify_handle_event() is the

	 * one we should check for permission response.

	 */

	if (event->mask & FAN_ALL_PERM_EVENTS)

	if (fanotify_is_perm_event(event->mask))

		return 0;

#endif



	list_for_each_entry_reverse(test_event, list, list) {

		if (should_merge(test_event, event)) {
@@ -56,7 +54,6 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event) 
	return 0;

}



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

static int fanotify_get_response(struct fsnotify_group *group,

				 struct fanotify_perm_event_info *event,

				 struct fsnotify_iter_info *iter_info)
@@ -65,19 +62,8 @@ static int fanotify_get_response(struct fsnotify_group *group, 


	pr_debug("%s: group=%p event=%p\n", __func__, group, event);



	/*

	 * fsnotify_prepare_user_wait() fails if we race with mark deletion.

	 * Just let the operation pass in that case.

	 */

	if (!fsnotify_prepare_user_wait(iter_info)) {

		event->response = FAN_ALLOW;

		goto out;

	}



	wait_event(group->fanotify_data.access_waitq, event->response);



	fsnotify_finish_user_wait(iter_info);

out:

	/* userspace responded, convert to something usable */

	switch (event->response) {

	case FAN_ALLOW:
@@ -94,7 +80,6 @@ out: 
	

	return ret;

}

#endif



static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,

				       struct fsnotify_mark *vfsmnt_mark,
@@ -153,8 +138,7 @@ struct fanotify_event_info *fanotify_alloc_event(struct inode *inode, u32 mask, 
{

	struct fanotify_event_info *event;



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	if (mask & FAN_ALL_PERM_EVENTS) {

	if (fanotify_is_perm_event(mask)) {

		struct fanotify_perm_event_info *pevent;



		pevent = kmem_cache_alloc(fanotify_perm_event_cachep,
@@ -165,7 +149,6 @@ struct fanotify_event_info *fanotify_alloc_event(struct inode *inode, u32 mask, 
		pevent->response = 0;

		goto init;

	}

#endif

	event = kmem_cache_alloc(fanotify_event_cachep, GFP_KERNEL);

	if (!event)

		return NULL;
@@ -212,9 +195,19 @@ static int fanotify_handle_event(struct fsnotify_group *group, 
	pr_debug("%s: group=%p inode=%p mask=%x\n", __func__, group, inode,

		 mask);



	if (fanotify_is_perm_event(mask)) {

		/*

		 * fsnotify_prepare_user_wait() fails if we race with mark

		 * deletion.  Just let the operation pass in that case.

		 */

		if (!fsnotify_prepare_user_wait(iter_info))

			return 0;

	}



	event = fanotify_alloc_event(inode, mask, data);

	ret = -ENOMEM;

	if (unlikely(!event))

		return -ENOMEM;

		goto finish;



	fsn_event = &event->fse;

	ret = fsnotify_add_event(group, fsn_event, fanotify_merge);
@@ -224,16 +217,16 @@ static int fanotify_handle_event(struct fsnotify_group *group, 
		/* Our event wasn't used in the end. Free it. */

		fsnotify_destroy_event(group, fsn_event);



		return 0;

	}



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	if (mask & FAN_ALL_PERM_EVENTS) {

		ret = 0;

	} else if (fanotify_is_perm_event(mask)) {

		ret = fanotify_get_response(group, FANOTIFY_PE(fsn_event),

					    iter_info);

		fsnotify_destroy_event(group, fsn_event);

	}

#endif

finish:

	if (fanotify_is_perm_event(mask))

		fsnotify_finish_user_wait(iter_info);



	return ret;

}
@@ -253,13 +246,11 @@ static void fanotify_free_event(struct fsnotify_event *fsn_event) 
	event = FANOTIFY_E(fsn_event);

	path_put(&event->path);

	put_pid(event->tgid);

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	if (fsn_event->mask & FAN_ALL_PERM_EVENTS) {

	if (fanotify_is_perm_event(fsn_event->mask)) {

		kmem_cache_free(fanotify_perm_event_cachep,

				FANOTIFY_PE(fsn_event));

		return;

	}

#endif

	kmem_cache_free(fanotify_event_cachep, event);

}

fs/notify/fanotify/fanotify.h

+6 −2
Original line number Diff line number Diff line
@@ -22,7 +22,6 @@ struct fanotify_event_info { 
	struct pid *tgid;

};



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

/*

 * Structure for permission fanotify events. It gets allocated and freed in

 * fanotify_handle_event() since we wait there for user response. When the
@@ -41,7 +40,12 @@ FANOTIFY_PE(struct fsnotify_event *fse) 
{

	return container_of(fse, struct fanotify_perm_event_info, fae.fse);

}

#endif



static inline bool fanotify_is_perm_event(u32 mask)

{

	return IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS) &&

		mask & FAN_ALL_PERM_EVENTS;

}



static inline struct fanotify_event_info *FANOTIFY_E(struct fsnotify_event *fse)

{

fs/notify/fanotify/fanotify_user.c

+16 −27
Original line number Diff line number Diff line
@@ -143,7 +143,6 @@ static int fill_event_metadata(struct fsnotify_group *group, 
	return ret;

}



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

static struct fanotify_perm_event_info *dequeue_event(

				struct fsnotify_group *group, int fd)

{
@@ -200,7 +199,6 @@ static int process_access_response(struct fsnotify_group *group, 


	return 0;

}

#endif



static ssize_t copy_event_to_user(struct fsnotify_group *group,

				  struct fsnotify_event *event,
@@ -222,10 +220,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group, 
			 fanotify_event_metadata.event_len))

		goto out_close_fd;



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	if (event->mask & FAN_ALL_PERM_EVENTS)

	if (fanotify_is_perm_event(event->mask))

		FANOTIFY_PE(event)->fd = fd;

#endif



	if (fd != FAN_NOFD)

		fd_install(fd, f);
@@ -310,10 +306,9 @@ static ssize_t fanotify_read(struct file *file, char __user *buf, 
		 * Permission events get queued to wait for response.  Other

		 * events can be destroyed now.

		 */

		if (!(kevent->mask & FAN_ALL_PERM_EVENTS)) {

		if (!fanotify_is_perm_event(kevent->mask)) {

			fsnotify_destroy_event(group, kevent);

		} else {

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

			if (ret <= 0) {

				FANOTIFY_PE(kevent)->response = FAN_DENY;

				wake_up(&group->fanotify_data.access_waitq);
@@ -323,7 +318,6 @@ static ssize_t fanotify_read(struct file *file, char __user *buf, 
					&group->fanotify_data.access_list);

				spin_unlock(&group->notification_lock);

			}

#endif

		}

		if (ret < 0)

			break;
@@ -339,11 +333,13 @@ static ssize_t fanotify_read(struct file *file, char __user *buf, 


static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)

{

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	struct fanotify_response response = { .fd = -1, .response = -1 };

	struct fsnotify_group *group;

	int ret;



	if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS))

		return -EINVAL;



	group = file->private_data;



	if (count > sizeof(response))
@@ -359,16 +355,11 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t 
		count = ret;



	return count;

#else

	return -EINVAL;

#endif

}



static int fanotify_release(struct inode *ignored, struct file *file)

{

	struct fsnotify_group *group = file->private_data;



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	struct fanotify_perm_event_info *event, *next;

	struct fsnotify_event *fsn_event;
@@ -404,14 +395,14 @@ static int fanotify_release(struct inode *ignored, struct file *file) 
			spin_unlock(&group->notification_lock);

			fsnotify_destroy_event(group, fsn_event);

			spin_lock(&group->notification_lock);

		} else

		} else {

			FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;

		}

	}

	spin_unlock(&group->notification_lock);



	/* Response for all permission events it set, wakeup waiters */

	wake_up(&group->fanotify_data.access_waitq);

#endif



	/* matches the fanotify_init->fsnotify_alloc_group */

	fsnotify_destroy_group(group);
@@ -769,10 +760,8 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 
	if (force_o_largefile())

		event_f_flags |= O_LARGEFILE;

	group->fanotify_data.f_flags = event_f_flags;

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	init_waitqueue_head(&group->fanotify_data.access_waitq);

	INIT_LIST_HEAD(&group->fanotify_data.access_list);

#endif

	switch (flags & FAN_ALL_CLASS_BITS) {

	case FAN_CLASS_NOTIF:

		group->priority = FS_PRIO_0;
@@ -826,6 +815,7 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 
	struct fsnotify_group *group;

	struct fd f;

	struct path path;

	u32 valid_mask = FAN_ALL_EVENTS | FAN_EVENT_ON_CHILD;

	int ret;



	pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n",
@@ -856,11 +846,10 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 
		mask &= ~FAN_ONDIR;

	}



#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	if (mask & ~(FAN_ALL_EVENTS | FAN_ALL_PERM_EVENTS | FAN_EVENT_ON_CHILD))

#else

	if (mask & ~(FAN_ALL_EVENTS | FAN_EVENT_ON_CHILD))

#endif

	if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS))

		valid_mask |= FAN_ALL_PERM_EVENTS;



	if (mask & ~valid_mask)

		return -EINVAL;



	f = fdget(fanotify_fd);
@@ -950,10 +939,10 @@ static int __init fanotify_user_setup(void) 
{

	fanotify_mark_cache = KMEM_CACHE(fsnotify_mark, SLAB_PANIC);

	fanotify_event_cachep = KMEM_CACHE(fanotify_event_info, SLAB_PANIC);

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS

	fanotify_perm_event_cachep = KMEM_CACHE(fanotify_perm_event_info,

						SLAB_PANIC);

#endif

	if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) {

		fanotify_perm_event_cachep =

			KMEM_CACHE(fanotify_perm_event_info, SLAB_PANIC);

	}



	return 0;

}

fs/notify/fsnotify.c

+45 −56
Original line number Diff line number Diff line
@@ -243,6 +243,29 @@ static int send_to_group(struct inode *to_tell, 
					file_name, cookie, iter_info);

}



static struct fsnotify_mark *fsnotify_first_mark(struct fsnotify_mark_connector **connp)

{

	struct fsnotify_mark_connector *conn;

	struct hlist_node *node = NULL;



	conn = srcu_dereference(*connp, &fsnotify_mark_srcu);

	if (conn)

		node = srcu_dereference(conn->list.first, &fsnotify_mark_srcu);



	return hlist_entry_safe(node, struct fsnotify_mark, obj_list);

}



static struct fsnotify_mark *fsnotify_next_mark(struct fsnotify_mark *mark)

{

	struct hlist_node *node = NULL;



	if (mark)

		node = srcu_dereference(mark->obj_list.next,

					&fsnotify_mark_srcu);



	return hlist_entry_safe(node, struct fsnotify_mark, obj_list);

}



/*

 * This is the main call to fsnotify.  The VFS calls into hook specific functions

 * in linux/fsnotify.h.  Those functions then in turn call here.  Here will call
@@ -252,11 +275,7 @@ static int send_to_group(struct inode *to_tell, 
int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is,

	     const unsigned char *file_name, u32 cookie)

{

	struct hlist_node *inode_node = NULL, *vfsmount_node = NULL;

	struct fsnotify_mark *inode_mark = NULL, *vfsmount_mark = NULL;

	struct fsnotify_group *inode_group, *vfsmount_group;

	struct fsnotify_mark_connector *inode_conn, *vfsmount_conn;

	struct fsnotify_iter_info iter_info;

	struct fsnotify_iter_info iter_info = {};

	struct mount *mnt;

	int ret = 0;

	/* global tests shouldn't care about events on child only the specific event */
@@ -291,26 +310,16 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is, 


	if ((mask & FS_MODIFY) ||

	    (test_mask & to_tell->i_fsnotify_mask)) {

		inode_conn = srcu_dereference(to_tell->i_fsnotify_marks,

					      &fsnotify_mark_srcu);

		if (inode_conn)

			inode_node = srcu_dereference(inode_conn->list.first,

						      &fsnotify_mark_srcu);

		iter_info.inode_mark =

			fsnotify_first_mark(&to_tell->i_fsnotify_marks);

	}



	if (mnt && ((mask & FS_MODIFY) ||

		    (test_mask & mnt->mnt_fsnotify_mask))) {

		inode_conn = srcu_dereference(to_tell->i_fsnotify_marks,

					      &fsnotify_mark_srcu);

		if (inode_conn)

			inode_node = srcu_dereference(inode_conn->list.first,

						      &fsnotify_mark_srcu);

		vfsmount_conn = srcu_dereference(mnt->mnt_fsnotify_marks,

					         &fsnotify_mark_srcu);

		if (vfsmount_conn)

			vfsmount_node = srcu_dereference(

						vfsmount_conn->list.first,

						&fsnotify_mark_srcu);

		iter_info.inode_mark =

			fsnotify_first_mark(&to_tell->i_fsnotify_marks);

		iter_info.vfsmount_mark =

			fsnotify_first_mark(&mnt->mnt_fsnotify_marks);

	}



	/*
@@ -318,38 +327,18 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is, 
	 * ignore masks are properly reflected for mount mark notifications.

	 * That's why this traversal is so complicated...

	 */

	while (inode_node || vfsmount_node) {

		inode_group = NULL;

		inode_mark = NULL;

		vfsmount_group = NULL;

		vfsmount_mark = NULL;



		if (inode_node) {

			inode_mark = hlist_entry(srcu_dereference(inode_node, &fsnotify_mark_srcu),

						 struct fsnotify_mark, obj_list);

			inode_group = inode_mark->group;

		}



		if (vfsmount_node) {

			vfsmount_mark = hlist_entry(srcu_dereference(vfsmount_node, &fsnotify_mark_srcu),

						    struct fsnotify_mark, obj_list);

			vfsmount_group = vfsmount_mark->group;

		}



		if (inode_group && vfsmount_group) {

			int cmp = fsnotify_compare_groups(inode_group,

							  vfsmount_group);

			if (cmp > 0) {

				inode_group = NULL;

	while (iter_info.inode_mark || iter_info.vfsmount_mark) {

		struct fsnotify_mark *inode_mark = iter_info.inode_mark;

		struct fsnotify_mark *vfsmount_mark = iter_info.vfsmount_mark;



		if (inode_mark && vfsmount_mark) {

			int cmp = fsnotify_compare_groups(inode_mark->group,

							  vfsmount_mark->group);

			if (cmp > 0)

				inode_mark = NULL;

			} else if (cmp < 0) {

				vfsmount_group = NULL;

			else if (cmp < 0)

				vfsmount_mark = NULL;

		}

		}



		iter_info.inode_mark = inode_mark;

		iter_info.vfsmount_mark = vfsmount_mark;



		ret = send_to_group(to_tell, inode_mark, vfsmount_mark, mask,

				    data, data_is, cookie, file_name,
@@ -358,12 +347,12 @@ int fsnotify(struct inode *to_tell, __u32 mask, const void *data, int data_is, 
		if (ret && (mask & ALL_FSNOTIFY_PERM_EVENTS))

			goto out;



		if (inode_group)

			inode_node = srcu_dereference(inode_node->next,

						      &fsnotify_mark_srcu);

		if (vfsmount_group)

			vfsmount_node = srcu_dereference(vfsmount_node->next,

							 &fsnotify_mark_srcu);

		if (inode_mark)

			iter_info.inode_mark =

				fsnotify_next_mark(iter_info.inode_mark);

		if (vfsmount_mark)

			iter_info.vfsmount_mark =

				fsnotify_next_mark(iter_info.vfsmount_mark);

	}

	ret = 0;

out:

CRA Git | Maintained and supported by SUSTech CRA and CCSE