Commit a725cb4d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'locks-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux 

Pull file locking fixes from Jeff Layton:
 "A fix for some undefined integer overflow behavior, a typo in a
  comment header, and a fix for a potential deadlock involving internal
  senders of SIGIO/SIGURG"

* tag 'locks-v5.11' of git://git.kernel.org/pub/scm/linux/kernel/git/jlayton/linux:
  fcntl: Fix potential deadlock in send_sig{io, urg}()
  locks: fix a typo at a kernel-doc markup
  locks: Fix UBSAN undefined behaviour in flock64_to_posix_lock
parents e87b0708 8d1ddb5e

fs/fcntl.c

+6 −4
Original line number Diff line number Diff line
@@ -781,9 +781,10 @@ void send_sigio(struct fown_struct *fown, int fd, int band) 
{

	struct task_struct *p;

	enum pid_type type;

	unsigned long flags;

	struct pid *pid;

	

	read_lock(&fown->lock);

	read_lock_irqsave(&fown->lock, flags);



	type = fown->pid_type;

	pid = fown->pid;
@@ -804,7 +805,7 @@ void send_sigio(struct fown_struct *fown, int fd, int band) 
		read_unlock(&tasklist_lock);

	}

 out_unlock_fown:

	read_unlock(&fown->lock);

	read_unlock_irqrestore(&fown->lock, flags);

}



static void send_sigurg_to_task(struct task_struct *p,
@@ -819,9 +820,10 @@ int send_sigurg(struct fown_struct *fown) 
	struct task_struct *p;

	enum pid_type type;

	struct pid *pid;

	unsigned long flags;

	int ret = 0;

	

	read_lock(&fown->lock);

	read_lock_irqsave(&fown->lock, flags);



	type = fown->pid_type;

	pid = fown->pid;
@@ -844,7 +846,7 @@ int send_sigurg(struct fown_struct *fown) 
		read_unlock(&tasklist_lock);

	}

 out_unlock_fown:

	read_unlock(&fown->lock);

	read_unlock_irqrestore(&fown->lock, flags);

	return ret;

}

fs/locks.c

+2 −2
Original line number Diff line number Diff line
@@ -542,7 +542,7 @@ static int flock64_to_posix_lock(struct file *filp, struct file_lock *fl, 
	if (l->l_len > 0) {

		if (l->l_len - 1 > OFFSET_MAX - fl->fl_start)

			return -EOVERFLOW;

		fl->fl_end = fl->fl_start + l->l_len - 1;

		fl->fl_end = fl->fl_start + (l->l_len - 1);



	} else if (l->l_len < 0) {

		if (fl->fl_start + l->l_len < 0)
@@ -750,7 +750,7 @@ static void __locks_wake_up_blocks(struct file_lock *blocker) 
}



/**

 *	locks_delete_lock - stop waiting for a file lock

 *	locks_delete_block - stop waiting for a file lock

 *	@waiter: the lock which was waiting

 *

 *	lockd/nfsd need to disconnect the lock while working on it.

CRA Git | Maintained and supported by SUSTech CRA and CCSE