Commit 337c6ba2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'akpm' (patches from Andrew) 

Merge misc fixes from Andrew Morton:
 "8 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  fs/exec.c: account for argv/envp pointers
  ocfs2: fix deadlock caused by recursive locking in xattr
  slub: make sysfs file removal asynchronous
  lib/cmdline.c: fix get_options() overflow while parsing ranges
  fs/dax.c: fix inefficiency in dax_writeback_mapping_range()
  autofs: sanity check status reported with AUTOFS_DEV_IOCTL_FAIL
  mm/vmalloc.c: huge-vmap: fail gracefully on unexpected huge vmap mappings
  mm, thp: remove cond_resched from __collapse_huge_page_copy
parents 2592d2ef 98da7d08

fs/autofs4/dev-ioctl.c

+1 −1
Original line number Diff line number Diff line
@@ -344,7 +344,7 @@ static int autofs_dev_ioctl_fail(struct file *fp, 
	int status;



	token = (autofs_wqt_t) param->fail.token;

	status = param->fail.status ? param->fail.status : -ENOENT;

	status = param->fail.status < 0 ? param->fail.status : -ENOENT;

	return autofs4_wait_release(sbi, token, status);

}

fs/dax.c

+1 −0
Original line number Diff line number Diff line
@@ -859,6 +859,7 @@ int dax_writeback_mapping_range(struct address_space *mapping, 
			if (ret < 0)

				goto out;

		}

		start_index = indices[pvec.nr - 1] + 1;

	}

out:

	put_dax(dax_dev);

fs/exec.c

+24 −4
Original line number Diff line number Diff line
@@ -220,8 +220,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, 


	if (write) {

		unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start;

		unsigned long ptr_size;

		struct rlimit *rlim;



		/*

		 * Since the stack will hold pointers to the strings, we

		 * must account for them as well.

		 *

		 * The size calculation is the entire vma while each arg page is

		 * built, so each time we get here it's calculating how far it

		 * is currently (rather than each call being just the newly

		 * added size from the arg page).  As a result, we need to

		 * always add the entire size of the pointers, so that on the

		 * last call to get_arg_page() we'll actually have the entire

		 * correct size.

		 */

		ptr_size = (bprm->argc + bprm->envc) * sizeof(void *);

		if (ptr_size > ULONG_MAX - size)

			goto fail;

		size += ptr_size;



		acct_arg_size(bprm, size / PAGE_SIZE);



		/*
@@ -239,13 +257,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, 
		 *    to work from.

		 */

		rlim = current->signal->rlim;

		if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) {

			put_page(page);

			return NULL;

		}

		if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4)

			goto fail;

	}



	return page;



fail:

	put_page(page);

	return NULL;

}



static void put_arg_page(struct page *page)

fs/ocfs2/dlmglue.c

+4 −0
Original line number Diff line number Diff line
@@ -2591,6 +2591,10 @@ void ocfs2_inode_unlock_tracker(struct inode *inode, 
	struct ocfs2_lock_res *lockres;



	lockres = &OCFS2_I(inode)->ip_inode_lockres;

	/* had_lock means that the currect process already takes the cluster

	 * lock previously. If had_lock is 1, we have nothing to do here, and

	 * it will get unlocked where we got the lock.

	 */

	if (!had_lock) {

		ocfs2_remove_holder(lockres, oh);

		ocfs2_inode_unlock(inode, ex);

fs/ocfs2/xattr.c

+13 −10
Original line number Diff line number Diff line
@@ -1328,20 +1328,21 @@ static int ocfs2_xattr_get(struct inode *inode, 
			   void *buffer,

			   size_t buffer_size)

{

	int ret;

	int ret, had_lock;

	struct buffer_head *di_bh = NULL;

	struct ocfs2_lock_holder oh;



	ret = ocfs2_inode_lock(inode, &di_bh, 0);

	if (ret < 0) {

		mlog_errno(ret);

		return ret;

	had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh);

	if (had_lock < 0) {

		mlog_errno(had_lock);

		return had_lock;

	}

	down_read(&OCFS2_I(inode)->ip_xattr_sem);

	ret = ocfs2_xattr_get_nolock(inode, di_bh, name_index,

				     name, buffer, buffer_size);

	up_read(&OCFS2_I(inode)->ip_xattr_sem);



	ocfs2_inode_unlock(inode, 0);

	ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock);



	brelse(di_bh);
@@ -3537,11 +3538,12 @@ int ocfs2_xattr_set(struct inode *inode, 
{

	struct buffer_head *di_bh = NULL;

	struct ocfs2_dinode *di;

	int ret, credits, ref_meta = 0, ref_credits = 0;

	int ret, credits, had_lock, ref_meta = 0, ref_credits = 0;

	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);

	struct inode *tl_inode = osb->osb_tl_inode;

	struct ocfs2_xattr_set_ctxt ctxt = { NULL, NULL, NULL, };

	struct ocfs2_refcount_tree *ref_tree = NULL;

	struct ocfs2_lock_holder oh;



	struct ocfs2_xattr_info xi = {

		.xi_name_index = name_index,
@@ -3572,8 +3574,9 @@ int ocfs2_xattr_set(struct inode *inode, 
		return -ENOMEM;

	}



	ret = ocfs2_inode_lock(inode, &di_bh, 1);

	if (ret < 0) {

	had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 1, &oh);

	if (had_lock < 0) {

		ret = had_lock;

		mlog_errno(ret);

		goto cleanup_nolock;

	}
@@ -3670,7 +3673,7 @@ cleanup: 
		if (ret)

			mlog_errno(ret);

	}

	ocfs2_inode_unlock(inode, 1);

	ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock);

cleanup_nolock:

	brelse(di_bh);

	brelse(xbs.xattr_bh);

CRA Git | Maintained and supported by SUSTech CRA and CCSE