Commit 5997aab0 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull vfs fixes from Al Viro:
 "Assorted fixes all over the place"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  aio: fix io_destroy(2) vs. lookup_ioctx() race
  ext2: fix a block leak
  nfsd: vfs_mkdir() might succeed leaving dentry negative unhashed
  cachefiles: vfs_mkdir() might succeed leaving dentry negative unhashed
  unfuck sysfs_mount()
  kernfs: deal with kernfs_fill_super() failures
  cramfs: Fix IS_ENABLED typo
  befs_lookup(): use d_splice_alias()
  affs_lookup: switch to d_splice_alias()
  affs_lookup(): close a race with affs_remove_link()
  fix breakage caused by d_find_alias() semantics change
  fs: don't scan the inode cache before SB_BORN is set
  do d_instantiate/unlock_new_inode combinations safely
  iov_iter: fix memory leak in pipe_get_pages_alloc()
  iov_iter: fix return type of __pipe_get_pages()
parents 3b78ce4a baf10564

fs/affs/namei.c

+9 −6
Original line number Diff line number Diff line
@@ -201,14 +201,16 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) 
	struct super_block *sb = dir->i_sb;

	struct buffer_head *bh;

	struct inode *inode = NULL;

	struct dentry *res;



	pr_debug("%s(\"%pd\")\n", __func__, dentry);



	affs_lock_dir(dir);

	bh = affs_find_entry(dir, dentry);

	if (IS_ERR(bh)) {

		affs_unlock_dir(dir);

	if (IS_ERR(bh))

		return ERR_CAST(bh);

	}

	if (bh) {

		u32 ino = bh->b_blocknr;
@@ -222,11 +224,12 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) 
		}

		affs_brelse(bh);

		inode = affs_iget(sb, ino);

		if (IS_ERR(inode))

			return ERR_CAST(inode);

	}

	d_add(dentry, inode);

	return NULL;

	res = d_splice_alias(inode, dentry);

	if (!IS_ERR_OR_NULL(res))

		res->d_fsdata = dentry->d_fsdata;

	affs_unlock_dir(dir);

	return res;

}



int

fs/aio.c

+2 −2
Original line number Diff line number Diff line
@@ -1078,7 +1078,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) 


	ctx = rcu_dereference(table->table[id]);

	if (ctx && ctx->user_id == ctx_id) {

		percpu_ref_get(&ctx->users);

		if (percpu_ref_tryget_live(&ctx->users))

			ret = ctx;

	}

out:

fs/befs/linuxvfs.c

+5 −12
Original line number Diff line number Diff line
@@ -198,23 +198,16 @@ befs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) 


	if (ret == BEFS_BT_NOT_FOUND) {

		befs_debug(sb, "<--- %s %pd not found", __func__, dentry);

		d_add(dentry, NULL);

		return ERR_PTR(-ENOENT);



		inode = NULL;

	} else if (ret != BEFS_OK || offset == 0) {

		befs_error(sb, "<--- %s Error", __func__);

		return ERR_PTR(-ENODATA);

	}



		inode = ERR_PTR(-ENODATA);

	} else {

		inode = befs_iget(dir->i_sb, (ino_t) offset);

	if (IS_ERR(inode))

		return ERR_CAST(inode);



	d_add(dentry, inode);



	}

	befs_debug(sb, "<--- %s", __func__);



	return NULL;

	return d_splice_alias(inode, dentry);

}



static int

fs/btrfs/inode.c

+4 −12
Original line number Diff line number Diff line
@@ -6586,8 +6586,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry, 
		goto out_unlock_inode;

	} else {

		btrfs_update_inode(trans, root, inode);

		unlock_new_inode(inode);

		d_instantiate(dentry, inode);

		d_instantiate_new(dentry, inode);

	}



out_unlock:
@@ -6663,8 +6662,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry, 
		goto out_unlock_inode;



	BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops;

	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	d_instantiate_new(dentry, inode);



out_unlock:

	btrfs_end_transaction(trans);
@@ -6809,12 +6807,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) 
	if (err)

		goto out_fail_inode;



	d_instantiate(dentry, inode);

	/*

	 * mkdir is special.  We're unlocking after we call d_instantiate

	 * to avoid a race with nfsd calling d_instantiate.

	 */

	unlock_new_inode(inode);

	d_instantiate_new(dentry, inode);

	drop_on_err = 0;



out_fail:
@@ -10257,8 +10250,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry, 
		goto out_unlock_inode;

	}



	unlock_new_inode(inode);

	d_instantiate(dentry, inode);

	d_instantiate_new(dentry, inode);



out_unlock:

	btrfs_end_transaction(trans);

fs/cachefiles/namei.c

+10 −0
Original line number Diff line number Diff line
@@ -572,6 +572,11 @@ lookup_again: 
			if (ret < 0)

				goto create_error;



			if (unlikely(d_unhashed(next))) {

				dput(next);

				inode_unlock(d_inode(dir));

				goto lookup_again;

			}

			ASSERT(d_backing_inode(next));



			_debug("mkdir -> %p{%p{ino=%lu}}",
@@ -764,6 +769,7 @@ struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache, 
	/* search the current directory for the element name */

	inode_lock(d_inode(dir));



retry:

	start = jiffies;

	subdir = lookup_one_len(dirname, dir, strlen(dirname));

	cachefiles_hist(cachefiles_lookup_histogram, start);
@@ -793,6 +799,10 @@ struct dentry *cachefiles_get_directory(struct cachefiles_cache *cache, 
		if (ret < 0)

			goto mkdir_error;



		if (unlikely(d_unhashed(subdir))) {

			dput(subdir);

			goto retry;

		}

		ASSERT(d_backing_inode(subdir));



		_debug("mkdir -> %p{%p{ino=%lu}}",

CRA Git | Maintained and supported by SUSTech CRA and CCSE