Commit 6cf3c736 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull assorted fixes from Al Viro:
 "There'll be more - I'm trying to dig out from under the pile of mail
  (a couple of weeks of something flu-like ;-/) and there's several more
  things waiting for review; this is just the obvious stuff."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  zoran: racy refcount handling in vm_ops ->open()/->close()
  befs_readdir(): do not increment ->f_pos if filldir tells us to stop
  hpfs: deadlock and race in directory lseek()
  qnx6: qnx6_readdir() has a braino in pos calculation
  fix buffer leak after "scsi: saner replacements for ->proc_info()"
  vfs: Fix invalid ida_remove() call
parents f8cb2791 4ad1f70e

drivers/media/pci/zoran/zoran.h

+1 −1
Original line number Diff line number Diff line
@@ -176,7 +176,7 @@ struct zoran_fh; 


struct zoran_mapping {

	struct zoran_fh *fh;

	int count;

	atomic_t count;

};



struct zoran_buffer {

drivers/media/pci/zoran/zoran_driver.c

+8 −7
Original line number Diff line number Diff line
@@ -2803,8 +2803,7 @@ static void 
zoran_vm_open (struct vm_area_struct *vma)

{

	struct zoran_mapping *map = vma->vm_private_data;



	map->count++;

	atomic_inc(&map->count);

}



static void
@@ -2815,7 +2814,7 @@ zoran_vm_close (struct vm_area_struct *vma) 
	struct zoran *zr = fh->zr;

	int i;



	if (--map->count > 0)

	if (!atomic_dec_and_mutex_lock(&map->count, &zr->resource_lock))

		return;



	dprintk(3, KERN_INFO "%s: %s - munmap(%s)\n", ZR_DEVNAME(zr),
@@ -2828,14 +2827,16 @@ zoran_vm_close (struct vm_area_struct *vma) 
	kfree(map);



	/* Any buffers still mapped? */

	for (i = 0; i < fh->buffers.num_buffers; i++)

		if (fh->buffers.buffer[i].map)

	for (i = 0; i < fh->buffers.num_buffers; i++) {

		if (fh->buffers.buffer[i].map) {

			mutex_unlock(&zr->resource_lock);

			return;

		}

	}



	dprintk(3, KERN_INFO "%s: %s - free %s buffers\n", ZR_DEVNAME(zr),

		__func__, mode_name(fh->map_mode));



	mutex_lock(&zr->resource_lock);



	if (fh->map_mode == ZORAN_MAP_MODE_RAW) {

		if (fh->buffers.active != ZORAN_FREE) {
@@ -2939,7 +2940,7 @@ zoran_mmap (struct file *file, 
		goto mmap_unlock_and_return;

	}

	map->fh = fh;

	map->count = 1;

	atomic_set(&map->count, 1);



	vma->vm_ops = &zoran_vm_ops;

	vma->vm_flags |= VM_DONTEXPAND;

drivers/scsi/scsi_proc.c

+1 −0
Original line number Diff line number Diff line
@@ -84,6 +84,7 @@ static int proc_scsi_host_open(struct inode *inode, struct file *file) 


static const struct file_operations proc_scsi_fops = {

	.open = proc_scsi_host_open,

	.release = single_release,

	.read = seq_read,

	.llseek = seq_lseek,

	.write = proc_scsi_host_write

fs/befs/linuxvfs.c

+2 −2
Original line number Diff line number Diff line
@@ -265,7 +265,7 @@ befs_readdir(struct file *filp, void *dirent, filldir_t filldir) 
		result = filldir(dirent, keybuf, keysize, filp->f_pos,

				 (ino_t) value, d_type);

	}



	if (!result)

		filp->f_pos++;



	befs_debug(sb, "<--- befs_readdir() filp->f_pos %Ld", filp->f_pos);

fs/hpfs/dir.c

+6 −4
Original line number Diff line number Diff line
@@ -33,25 +33,27 @@ static loff_t hpfs_dir_lseek(struct file *filp, loff_t off, int whence) 
	if (whence == SEEK_DATA || whence == SEEK_HOLE)

		return -EINVAL;



	mutex_lock(&i->i_mutex);

	hpfs_lock(s);



	/*printk("dir lseek\n");*/

	if (new_off == 0 || new_off == 1 || new_off == 11 || new_off == 12 || new_off == 13) goto ok;

	mutex_lock(&i->i_mutex);

	pos = ((loff_t) hpfs_de_as_down_as_possible(s, hpfs_inode->i_dno) << 4) + 1;

	while (pos != new_off) {

		if (map_pos_dirent(i, &pos, &qbh)) hpfs_brelse4(&qbh);

		else goto fail;

		if (pos == 12) goto fail;

	}

	mutex_unlock(&i->i_mutex);

	hpfs_add_pos(i, &filp->f_pos);

ok:

	filp->f_pos = new_off;

	hpfs_unlock(s);

	return filp->f_pos = new_off;

fail:

	mutex_unlock(&i->i_mutex);

	return new_off;

fail:

	/*printk("illegal lseek: %016llx\n", new_off);*/

	hpfs_unlock(s);

	mutex_unlock(&i->i_mutex);

	return -ESPIPE;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE