History

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull second vfs pile from Al Viro: "The stuff in there: fsfreeze deadlock fixes by Jan (essentially, the deadlock reproduced by xfstests 068), symlink and hardlink restriction patches, plus assorted cleanups and fixes. Note that another fsfreeze deadlock (emergency thaw one) is *not* dealt with - the series by Fernando conflicts a lot with Jan's, breaks userland ABI (FIFREEZE semantics gets changed) and trades the deadlock for massive vfsmount leak; this is going to be handled next cycle. There probably will be another pull request, but that stuff won't be in it." Fix up trivial conflicts due to unrelated changes next to each other in drivers/{staging/gdm72xx/usb_boot.c, usb/gadget/storage_common.c} * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (54 commits) delousing target_core_file a bit Documentation: Correct s_umount state for freeze_fs/unfreeze_fs fs: Remove old freezing mechanism ext2: Implement freezing btrfs: Convert to new freezing mechanism nilfs2: Convert to new freezing mechanism ntfs: Convert to new freezing mechanism fuse: Convert to new freezing mechanism gfs2: Convert to new freezing mechanism ocfs2: Convert to new freezing mechanism xfs: Convert to new freezing code ext4: Convert to new freezing mechanism fs: Protect write paths by sb_start_write - sb_end_write fs: Skip atime update on frozen filesystem fs: Add freezing handling to mnt_want_write() / mnt_drop_write() fs: Improve filesystem freezing handling switch the protection of percpu_counter list to spinlock nfsd: Push mnt_want_write() outside of i_mutex btrfs: Push mnt_want_write() outside of i_mutex fat: Push mnt_want_write() outside of i_mutex ...

Linus Torvalds committed 14 years ago

Commit a0e881b2 parents eff0d13 dbc6e0284 files · +1326 −639Browse files

Unified · Split

84 files
  1. Documentation/filesystems/Locking +2 −2
  2. Documentation/sysctl/fs.txt +42 −0
  3. arch/powerpc/platforms/cell/spufs/inode.c +25 −52
  4. arch/powerpc/platforms/cell/spufs/syscalls.c +1 −1
  5. drivers/base/devtmpfs.c +2 −7
  6. drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c +1 −1
  7. drivers/staging/bcm/Misc.c +5 −26
  8. drivers/staging/gdm72xx/sdio_boot.c +3 −4
  9. drivers/staging/gdm72xx/usb_boot.c +9 −13
  10. drivers/target/target_core_file.c +5 −27
  11. drivers/usb/gadget/storage_common.c +5 −7
  12. drivers/usb/gadget/u_uac1.c +3 −3
  13. drivers/video/fb_defio.c +2 −0
  14. fs/9p/vfs_file.c +3 −0
  15. fs/btrfs/disk-io.c +0 −3
  16. fs/btrfs/file.c +2 −1
  17. fs/btrfs/inode.c +5 −1
  18. fs/btrfs/ioctl.c +10 −5
  19. fs/btrfs/transaction.c +7 −0
  20. fs/buffer.c +10 −18
  21. fs/ceph/addr.c +3 −0
  22. fs/ecryptfs/inode.c +10 −20
  23. fs/exec.c +6 −13
  24. fs/ext2/inode.c +4 −1
  25. fs/ext2/super.c +33 −0
  26. fs/ext4/inode.c +10 −5
  27. fs/ext4/mmp.c +6 −0
  28. fs/ext4/super.c +7 −24
  29. fs/fat/file.c +7 −8
  30. fs/file_table.c +2 −2
  31. fs/fuse/file.c +2 −2
  32. fs/gfs2/file.c +6 −12
  33. fs/gfs2/trans.c +4 −0
  34. fs/inode.c +8 −4
  35. fs/internal.h +4 −0
  36. fs/lockd/clntproc.c +7 −7
  37. fs/lockd/svc4proc.c +1 −0
  38. fs/lockd/svclock.c +0 −1
  39. fs/lockd/svcproc.c +1 −0
  40. fs/namei.c +213 −100
  41. fs/namespace.c +77 −20
  42. fs/nfsd/nfs4recover.c +5 −4
  43. fs/nfsd/nfsfh.c +1 −0
  44. fs/nfsd/nfsproc.c +8 −1
  45. fs/nfsd/vfs.c +40 −39
  46. fs/nfsd/vfs.h +9 −2
  47. fs/nilfs2/file.c +11 −7
  48. fs/nilfs2/ioctl.c +0 −2
  49. fs/nilfs2/segment.c +4 −1
  50. fs/ntfs/file.c +2 −1
  51. fs/ocfs2/file.c +9 −2
  52. fs/ocfs2/ioctl.c +12 −2
  53. fs/ocfs2/journal.c +6 −1
  54. fs/ocfs2/mmap.c +2 −0
  55. fs/ocfs2/refcounttree.c +1 −10
  56. fs/open.c +9 −6
  57. fs/pipe.c +26 −49
  58. fs/splice.c +3 −0
  59. fs/super.c +230 −22
  60. fs/sysfs/bin.c +2 −0
  61. fs/xfs/xfs_aops.c +18 −0
  62. fs/xfs/xfs_file.c +7 −3
  63. fs/xfs/xfs_ioctl.c +52 −3
  64. fs/xfs/xfs_ioctl32.c +12 −0
  65. fs/xfs/xfs_iomap.c +2 −2
  66. fs/xfs/xfs_mount.c +1 −1
  67. fs/xfs/xfs_mount.h +0 −3
  68. fs/xfs/xfs_sync.c +1 −1
  69. fs/xfs/xfs_trans.c +14 −3
  70. fs/xfs/xfs_trans.h +2 −0
  71. include/linux/audit.h +4 −0
  72. include/linux/fs.h +142 −12
  73. include/linux/mm.h +1 −0
  74. include/linux/namei.h +1 −0
  75. include/linux/nfsd/nfsfh.h +1 −0
  76. include/linux/pipe_fs_i.h +2 −0
  77. kernel/audit.c +21 −0
  78. kernel/sysctl.c +18 −0
  79. lib/percpu_counter.c +7 −7
  80. mm/filemap.c +29 −2
  81. mm/filemap_xip.c +4 −2
  82. mm/memory.c +7 −7
  83. net/unix/af_unix.c +43 −50
  84. sound/sound_firmware.c +4 −4
Documentation/filesystems/Locking+2−2
@@ -138,8 +138,8 @@ evict_inode: · 137 unmodified lines
138138 put_super: write
139139 write_super: read
140140 sync_fs: read
141−freeze_fs: read
142−unfreeze_fs: read
141+freeze_fs: write
142+unfreeze_fs: write
143143 statfs: maybe(read) (see below)
144144 remount_fs: write
145145 umount_begin: no
Documentation/sysctl/fs.txt+42−0
@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs: · 31 unmodified lines
3232 - nr_open
3333 - overflowuid
3434 - overflowgid
35+- protected_hardlinks
36+- protected_symlinks
3537 - suid_dumpable
3638 - super-max
3739 - super-nr
@@ -157,6 +159,46 @@ The default is 65534. · 119 unmodified lines
157159
158160 ==============================================================
159161
162+protected_hardlinks:
163+
164+A long-standing class of security issues is the hardlink-based
165+time-of-check-time-of-use race, most commonly seen in world-writable
166+directories like /tmp. The common method of exploitation of this flaw
167+is to cross privilege boundaries when following a given hardlink (i.e. a
168+root process follows a hardlink created by another user). Additionally,
169+on systems without separated partitions, this stops unauthorized users
170+from "pinning" vulnerable setuid/setgid files against being upgraded by
171+the administrator, or linking to special files.
172+
173+When set to "0", hardlink creation behavior is unrestricted.
174+
175+When set to "1" hardlinks cannot be created by users if they do not
176+already own the source file, or do not have read/write access to it.
177+
178+This protection is based on the restrictions in Openwall and grsecurity.
179+
180+==============================================================
181+
182+protected_symlinks:
183+
184+A long-standing class of security issues is the symlink-based
185+time-of-check-time-of-use race, most commonly seen in world-writable
186+directories like /tmp. The common method of exploitation of this flaw
187+is to cross privilege boundaries when following a given symlink (i.e. a
188+root process follows a symlink belonging to another user). For a likely
189+incomplete list of hundreds of examples across the years, please see:
190+http://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=/tmp
191+
192+When set to "0", symlink following behavior is unrestricted.
193+
194+When set to "1" symlinks are permitted to be followed only when outside
195+a sticky world-writable directory, or when the uid of the symlink and
196+follower match, or when the directory owner matches the symlink's owner.
197+
198+This protection is based on the restrictions in Openwall and grsecurity.
199+
200+==============================================================
201+
160202 suid_dumpable:
161203
162204 This value can be used to query and set the core dump mode for setuid
arch/powerpc/platforms/cell/spufs/inode.c+25−52
@@ -186,10 +186,13 @@ static void spufs_prune_dir(struct dentry *dir) · 185 unmodified lines
186186 static int spufs_rmdir(struct inode *parent, struct dentry *dir)
187187 {
188188 /* remove all entries */
189+ int res;
189190 spufs_prune_dir(dir);
190191 d_drop(dir);
191−
192− return simple_rmdir(parent, dir);
192+ res = simple_rmdir(parent, dir);
193+ /* We have to give up the mm_struct */
194+ spu_forget(SPUFS_I(dir->d_inode)->i_ctx);
195+ return res;
193196 }
194197
195198 static int spufs_fill_dir(struct dentry *dir,
@@ -245,9 +248,6 @@ static int spufs_dir_close(struct inode *inode, struct file *file) · 49 unmodified lines
245248 mutex_unlock(&parent->i_mutex);
246249 WARN_ON(ret);
247250
248− /* We have to give up the mm_struct */
249− spu_forget(ctx);
250−
251251 return dcache_dir_close(inode, file);
252252 }
253253
@@ -450,28 +450,24 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, · 196 unmodified lines
450450 struct spu_context *neighbor;
451451 struct path path = {.mnt = mnt, .dentry = dentry};
452452
453− ret = -EPERM;
454453 if ((flags & SPU_CREATE_NOSCHED) &&
455454 !capable(CAP_SYS_NICE))
456− goto out_unlock;
455+ return -EPERM;
457456
458− ret = -EINVAL;
459457 if ((flags & (SPU_CREATE_NOSCHED | SPU_CREATE_ISOLATE))
460458 == SPU_CREATE_ISOLATE)
461− goto out_unlock;
459+ return -EINVAL;
462460
463− ret = -ENODEV;
464461 if ((flags & SPU_CREATE_ISOLATE) && !isolated_loader)
465− goto out_unlock;
462+ return -ENODEV;
466463
467464 gang = NULL;
468465 neighbor = NULL;
469466 affinity = flags & (SPU_CREATE_AFFINITY_MEM | SPU_CREATE_AFFINITY_SPU);
470467 if (affinity) {
471468 gang = SPUFS_I(inode)->i_gang;
472− ret = -EINVAL;
473469 if (!gang)
474− goto out_unlock;
470+ return -EINVAL;
475471 mutex_lock(&gang->aff_mutex);
476472 neighbor = spufs_assert_affinity(flags, gang, aff_filp);
477473 if (IS_ERR(neighbor)) {
@@ -492,22 +488,12 @@ spufs_create_context(struct inode *inode, struct dentry *dentry, · 14 unmodified lines
492488 }
493489
494490 ret = spufs_context_open(&path);
495− if (ret < 0) {
491+ if (ret < 0)
496492 WARN_ON(spufs_rmdir(inode, dentry));
497− if (affinity)
498− mutex_unlock(&gang->aff_mutex);
499− mutex_unlock(&inode->i_mutex);
500− spu_forget(SPUFS_I(dentry->d_inode)->i_ctx);
501− goto out;
502− }
503493
504494 out_aff_unlock:
505495 if (affinity)
506496 mutex_unlock(&gang->aff_mutex);
507−out_unlock:
508− mutex_unlock(&inode->i_mutex);
509−out:
510− dput(dentry);
511497 return ret;
512498 }
513499
@@ -580,18 +566,13 @@ static int spufs_create_gang(struct inode *inode, · 66 unmodified lines
580566 int ret;
581567
582568 ret = spufs_mkgang(inode, dentry, mode & S_IRWXUGO);
583− if (ret)
584− goto out;
585−
586− ret = spufs_gang_open(&path);
587− if (ret < 0) {
588− int err = simple_rmdir(inode, dentry);
589− WARN_ON(err);
569+ if (!ret) {
570+ ret = spufs_gang_open(&path);
571+ if (ret < 0) {
572+ int err = simple_rmdir(inode, dentry);
573+ WARN_ON(err);
574+ }
590575 }
591−
592−out:
593− mutex_unlock(&inode->i_mutex);
594− dput(dentry);
595576 return ret;
596577 }
597578
@@ -601,40 +582,32 @@ static struct file_system_type spufs_type; · 3 unmodified lines
601582 long spufs_create(struct path *path, struct dentry *dentry,
602583 unsigned int flags, umode_t mode, struct file *filp)
603584 {
585+ struct inode *dir = path->dentry->d_inode;
604586 int ret;
605587
606− ret = -EINVAL;
607588 /* check if we are on spufs */
608589 if (path->dentry->d_sb->s_type != &spufs_type)
609− goto out;
590+ return -EINVAL;
610591
611592 /* don't accept undefined flags */
612593 if (flags & (~SPU_CREATE_FLAG_ALL))
613− goto out;
594+ return -EINVAL;
614595
615596 /* only threads can be underneath a gang */
616− if (path->dentry != path->dentry->d_sb->s_root) {
617− if ((flags & SPU_CREATE_GANG) ||
618− !SPUFS_I(path->dentry->d_inode)->i_gang)
619− goto out;
620− }
597+ if (path->dentry != path->dentry->d_sb->s_root)
598+ if ((flags & SPU_CREATE_GANG) || !SPUFS_I(dir)->i_gang)
599+ return -EINVAL;
621600
622601 mode &= ~current_umask();
623602
624603 if (flags & SPU_CREATE_GANG)
625− ret = spufs_create_gang(path->dentry->d_inode,
626− dentry, path->mnt, mode);
604+ ret = spufs_create_gang(dir, dentry, path->mnt, mode);
627605 else
628− ret = spufs_create_context(path->dentry->d_inode,
629− dentry, path->mnt, flags, mode,
606+ ret = spufs_create_context(dir, dentry, path->mnt, flags, mode,
630607 filp);
631608 if (ret >= 0)
632− fsnotify_mkdir(path->dentry->d_inode, dentry);
633− return ret;
609+ fsnotify_mkdir(dir, dentry);
634610
635−out:
636− mutex_unlock(&path->dentry->d_inode->i_mutex);
637− dput(dentry);
638611 return ret;
639612 }
640613
arch/powerpc/platforms/cell/spufs/syscalls.c+1−1
@@ -70,7 +70,7 @@ static long do_spu_create(const char __user *pathname, unsigned int flags, · 69 unmodified lines
7070 ret = PTR_ERR(dentry);
7171 if (!IS_ERR(dentry)) {
7272 ret = spufs_create(&path, dentry, flags, mode, neighbor);
73− path_put(&path);
73+ done_path_create(&path, dentry);
7474 }
7575
7676 return ret;
drivers/base/devtmpfs.c+2−7
@@ -156,9 +156,7 @@ static int dev_mkdir(const char *name, umode_t mode) · 155 unmodified lines
156156 if (!err)
157157 /* mark as kernel-created inode */
158158 dentry->d_inode->i_private = &thread;
159− dput(dentry);
160− mutex_unlock(&path.dentry->d_inode->i_mutex);
161− path_put(&path);
159+ done_path_create(&path, dentry);
162160 return err;
163161 }
164162
@@ -218,10 +216,7 @@ static int handle_create(const char *nodename, umode_t mode, struct device *dev) · 53 unmodified lines
218216 /* mark as kernel-created inode */
219217 dentry->d_inode->i_private = &thread;
220218 }
221− dput(dentry);
222−
223− mutex_unlock(&path.dentry->d_inode->i_mutex);
224− path_put(&path);
219+ done_path_create(&path, dentry);
225220 return err;
226221 }
227222
drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c+1−1
@@ -1188,7 +1188,7 @@ exit: · 1187 unmodified lines
11881188 kfree(buf);
11891189 /* close file before return */
11901190 if (fp)
1191− filp_close(fp, current->files);
1191+ filp_close(fp, NULL);
11921192 /* restore previous address limit */
11931193 set_fs(old_fs);
11941194
drivers/staging/bcm/Misc.c+5−26
@@ -157,12 +157,7 @@ static int create_worker_threads(struct bcm_mini_adapter *psAdapter) · 156 unmodified lines
157157
158158 static struct file *open_firmware_file(struct bcm_mini_adapter *Adapter, const char *path)
159159 {
160− struct file *flp = NULL;
161− mm_segment_t oldfs;
162− oldfs = get_fs();
163− set_fs(get_ds());
164− flp = filp_open(path, O_RDONLY, S_IRWXU);
165− set_fs(oldfs);
160+ struct file *flp = filp_open(path, O_RDONLY, S_IRWXU);
166161 if (IS_ERR(flp)) {
167162 pr_err(DRV_NAME "Unable To Open File %s, err %ld", path, PTR_ERR(flp));
168163 flp = NULL;
@@ -183,14 +178,12 @@ static int BcmFileDownload(struct bcm_mini_adapter *Adapter, const char *path, u · 14 unmodified lines
183178 {
184179 int errorno = 0;
185180 struct file *flp = NULL;
186− mm_segment_t oldfs;
187181 struct timeval tv = {0};
188182
189183 flp = open_firmware_file(Adapter, path);
190184 if (!flp) {
191− errorno = -ENOENT;
192185 BCM_DEBUG_PRINT(Adapter, DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL, "Unable to Open %s\n", path);
193− goto exit_download;
186+ return -ENOENT;
194187 }
195188 BCM_DEBUG_PRINT(Adapter, DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL, "Opened file is = %s and length =0x%lx to be downloaded at =0x%x", path, (unsigned long)flp->f_dentry->d_inode->i_size, loc);
196189 do_gettimeofday(&tv);
@@ -201,10 +194,7 @@ static int BcmFileDownload(struct bcm_mini_adapter *Adapter, const char *path, u · 4 unmodified lines
201194 errorno = -EIO;
202195 goto exit_download;
203196 }
204− oldfs = get_fs();
205− set_fs(get_ds());
206197 vfs_llseek(flp, 0, 0);
207− set_fs(oldfs);
208198 if (Adapter->bcm_file_readback_from_chip(Adapter->pvInterfaceAdapter, flp, loc)) {
209199 BCM_DEBUG_PRINT(Adapter, DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL, "Failed to read back firmware!");
210200 errorno = -EIO;
@@ -212,12 +202,7 @@ static int BcmFileDownload(struct bcm_mini_adapter *Adapter, const char *path, u · 1 unmodified line
212202 }
213203
214204 exit_download:
215− oldfs = get_fs();
216− set_fs(get_ds());
217− if (flp && !(IS_ERR(flp)))
218− filp_close(flp, current->files);
219− set_fs(oldfs);
220−
205+ filp_close(flp, NULL);
221206 return errorno;
222207 }
223208
@@ -1056,10 +1041,8 @@ OUT: · 832 unmodified lines
10561041 static int bcm_parse_target_params(struct bcm_mini_adapter *Adapter)
10571042 {
10581043 struct file *flp = NULL;
1059− mm_segment_t oldfs = {0};
10601044 char *buff;
10611045 int len = 0;
1062− loff_t pos = 0;
10631046
10641047 buff = kmalloc(BUFFER_1K, GFP_KERNEL);
10651048 if (!buff)
@@ -1079,20 +1062,16 @@ static int bcm_parse_target_params(struct bcm_mini_adapter *Adapter) · 13 unmodified lines
10791062 Adapter->pstargetparams = NULL;
10801063 return -ENOENT;
10811064 }
1082− oldfs = get_fs();
1083− set_fs(get_ds());
1084− len = vfs_read(flp, (void __user __force *)buff, BUFFER_1K, &pos);
1085− set_fs(oldfs);
1065+ len = kernel_read(flp, 0, buff, BUFFER_1K);
1066+ filp_close(flp, NULL);
10861067
10871068 if (len != sizeof(STARGETPARAMS)) {
10881069 BCM_DEBUG_PRINT(Adapter, DBG_TYPE_INITEXIT, MP_INIT, DBG_LVL_ALL, "Mismatch in Target Param Structure!\n");
10891070 kfree(buff);
10901071 kfree(Adapter->pstargetparams);
10911072 Adapter->pstargetparams = NULL;
1092− filp_close(flp, current->files);
10931073 return -ENOENT;
10941074 }
1095− filp_close(flp, current->files);
10961075
10971076 /* Check for autolink in config params */
10981077 /*
drivers/staging/gdm72xx/sdio_boot.c+3−4
@@ -66,9 +66,8 @@ static int download_image(struct sdio_func *func, char *img_name) · 65 unmodified lines
6666 return -ENOENT;
6767 }
6868
69− if (filp->f_dentry)
70− inode = filp->f_dentry->d_inode;
71− if (!inode || !S_ISREG(inode->i_mode)) {
69+ inode = filp->f_dentry->d_inode;
70+ if (!S_ISREG(inode->i_mode)) {
7271 printk(KERN_ERR "Invalid file type: %s\n", img_name);
7372 ret = -EINVAL;
7473 goto out;
@@ -123,7 +122,7 @@ static int download_image(struct sdio_func *func, char *img_name) · 48 unmodified lines
123122 pno++;
124123 }
125124 out:
126− filp_close(filp, current->files);
125+ filp_close(filp, NULL);
127126 return ret;
128127 }
129128
drivers/staging/gdm72xx/usb_boot.c+9−13
@@ -173,14 +173,12 @@ int usb_boot(struct usb_device *usbdev, u16 pid) · 172 unmodified lines
173173 filp = filp_open(img_name, O_RDONLY | O_LARGEFILE, 0);
174174 if (IS_ERR(filp)) {
175175 printk(KERN_ERR "Can't find %s.\n", img_name);
176− set_fs(fs);
177176 ret = PTR_ERR(filp);
178177 goto restore_fs;
179178 }
180179
181− if (filp->f_dentry)
182− inode = filp->f_dentry->d_inode;
183− if (!inode || !S_ISREG(inode->i_mode)) {
180+ inode = filp->f_dentry->d_inode;
181+ if (!S_ISREG(inode->i_mode)) {
184182 printk(KERN_ERR "Invalid file type: %s\n", img_name);
185183 ret = -EINVAL;
186184 goto out;
@@ -262,7 +260,7 @@ int usb_boot(struct usb_device *usbdev, u16 pid) · 75 unmodified lines
262260 ret = -EINVAL;
263261 }
264262 out:
265− filp_close(filp, current->files);
263+ filp_close(filp, NULL);
266264
267265 restore_fs:
268266 set_fs(fs);
@@ -322,13 +320,11 @@ static int em_download_image(struct usb_device *usbdev, char *path, · 53 unmodified lines
322320 goto restore_fs;
323321 }
324322
325− if (filp->f_dentry) {
326− inode = filp->f_dentry->d_inode;
327− if (!inode || !S_ISREG(inode->i_mode)) {
328− printk(KERN_ERR "Invalid file type: %s\n", path);
329− ret = -EINVAL;
330− goto out;
331− }
323+ inode = filp->f_dentry->d_inode;
324+ if (!S_ISREG(inode->i_mode)) {
325+ printk(KERN_ERR "Invalid file type: %s\n", path);
326+ ret = -EINVAL;
327+ goto out;
332328 }
333329
334330 buf = kmalloc(DOWNLOAD_CHUCK + pad_size, GFP_KERNEL);
@@ -364,7 +360,7 @@ static int em_download_image(struct usb_device *usbdev, char *path, · 29 unmodified lines
364360 goto out;
365361
366362 out:
367− filp_close(filp, current->files);
363+ filp_close(filp, NULL);
368364
369365 restore_fs:
370366 set_fs(fs);
drivers/target/target_core_file.c+5−27
@@ -109,46 +109,29 @@ static struct se_device *fd_create_virtdevice( · 108 unmodified lines
109109 struct se_subsystem_dev *se_dev,
110110 void *p)
111111 {
112− char *dev_p = NULL;
113112 struct se_device *dev;
114113 struct se_dev_limits dev_limits;
115114 struct queue_limits *limits;
116115 struct fd_dev *fd_dev = p;
117116 struct fd_host *fd_host = hba->hba_ptr;
118− mm_segment_t old_fs;
119117 struct file *file;
120118 struct inode *inode = NULL;
121119 int dev_flags = 0, flags, ret = -EINVAL;
122120
123121 memset(&dev_limits, 0, sizeof(struct se_dev_limits));
124122
125− old_fs = get_fs();
126− set_fs(get_ds());
127− dev_p = getname(fd_dev->fd_dev_name);
128− set_fs(old_fs);
129−
130− if (IS_ERR(dev_p)) {
131− pr_err("getname(%s) failed: %lu\n",
132− fd_dev->fd_dev_name, IS_ERR(dev_p));
133− ret = PTR_ERR(dev_p);
134− goto fail;
135− }
136123 /*
137124 * Use O_DSYNC by default instead of O_SYNC to forgo syncing
138125 * of pure timestamp updates.
139126 */
140127 flags = O_RDWR | O_CREAT | O_LARGEFILE | O_DSYNC;
141128
142− file = filp_open(dev_p, flags, 0600);
129+ file = filp_open(fd_dev->fd_dev_name, flags, 0600);
143130 if (IS_ERR(file)) {
144− pr_err("filp_open(%s) failed\n", dev_p);
131+ pr_err("filp_open(%s) failed\n", fd_dev->fd_dev_name);
145132 ret = PTR_ERR(file);
146133 goto fail;
147134 }
148− if (!file || !file->f_dentry) {
149− pr_err("filp_open(%s) failed\n", dev_p);
150− goto fail;
151− }
152135 fd_dev->fd_file = file;
153136 /*
154137 * If using a block backend with this struct file, we extract
@@ -212,14 +195,12 @@ static struct se_device *fd_create_virtdevice( · 57 unmodified lines
212195 " %llu total bytes\n", fd_host->fd_host_id, fd_dev->fd_dev_id,
213196 fd_dev->fd_dev_name, fd_dev->fd_dev_size);
214197
215− putname(dev_p);
216198 return dev;
217199 fail:
218200 if (fd_dev->fd_file) {
219201 filp_close(fd_dev->fd_file, NULL);
220202 fd_dev->fd_file = NULL;
221203 }
222− putname(dev_p);
223204 return ERR_PTR(ret);
224205 }
225206
@@ -452,14 +433,11 @@ static ssize_t fd_set_configfs_dev_params( · 226 unmodified lines
452433 token = match_token(ptr, tokens, args);
453434 switch (token) {
454435 case Opt_fd_dev_name:
455− arg_p = match_strdup(&args[0]);
456− if (!arg_p) {
457− ret = -ENOMEM;
436+ if (match_strlcpy(fd_dev->fd_dev_name, &args[0],
437+ FD_MAX_DEV_NAME) == 0) {
438+ ret = -EINVAL;
458439 break;
459440 }
460− snprintf(fd_dev->fd_dev_name, FD_MAX_DEV_NAME,
461− "%s", arg_p);
462− kfree(arg_p);
463441 pr_debug("FILEIO: Referencing Path: %s\n",
464442 fd_dev->fd_dev_name);
465443 fd_dev->fbd_flags |= FBDF_HAS_PATH;
drivers/usb/gadget/storage_common.c+5−7
@@ -656,9 +656,8 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename) · 655 unmodified lines
656656 if (!(filp->f_mode & FMODE_WRITE))
657657 ro = 1;
658658
659− if (filp->f_path.dentry)
660− inode = filp->f_path.dentry->d_inode;
661− if (!inode || (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))) {
659+ inode = filp->f_path.dentry->d_inode;
660+ if ((!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))) {
662661 LINFO(curlun, "invalid file type: %s\n", filename);
663662 goto out;
664663 }
@@ -667,7 +666,7 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename) · 2 unmodified lines
667666 * If we can't read the file, it's no good.
668667 * If we can't write the file, use it read-only.
669668 */
670− if (!filp->f_op || !(filp->f_op->read || filp->f_op->aio_read)) {
669+ if (!(filp->f_op->read || filp->f_op->aio_read)) {
671670 LINFO(curlun, "file not readable: %s\n", filename);
672671 goto out;
673672 }
@@ -712,7 +711,6 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename) · 38 unmodified lines
712711 if (fsg_lun_is_open(curlun))
713712 fsg_lun_close(curlun);
714713
715− get_file(filp);
716714 curlun->blksize = blksize;
717715 curlun->blkbits = blkbits;
718716 curlun->ro = ro;
@@ -720,10 +718,10 @@ static int fsg_lun_open(struct fsg_lun *curlun, const char *filename) · 1 unmodified line
720718 curlun->file_length = size;
721719 curlun->num_sectors = num_sectors;
722720 LDBG(curlun, "open backing file: %s\n", filename);
723− rc = 0;
721+ return 0;
724722
725723 out:
726− filp_close(filp, current->files);
724+ fput(filp);
727725 return rc;
728726 }
729727
drivers/usb/gadget/u_uac1.c+3−3
@@ -275,17 +275,17 @@ static int gaudio_close_snd_dev(struct gaudio *gau) · 274 unmodified lines
275275 /* Close control device */
276276 snd = &gau->control;
277277 if (snd->filp)
278− filp_close(snd->filp, current->files);
278+ filp_close(snd->filp, NULL);
279279
280280 /* Close PCM playback device and setup substream */
281281 snd = &gau->playback;
282282 if (snd->filp)
283− filp_close(snd->filp, current->files);
283+ filp_close(snd->filp, NULL);
284284
285285 /* Close PCM capture device and setup substream */
286286 snd = &gau->capture;
287287 if (snd->filp)
288− filp_close(snd->filp, current->files);
288+ filp_close(snd->filp, NULL);
289289
290290 return 0;
291291 }
drivers/video/fb_defio.c+2−0
@@ -104,6 +104,8 @@ static int fb_deferred_io_mkwrite(struct vm_area_struct *vma, · 103 unmodified lines
104104 deferred framebuffer IO. then if userspace touches a page
105105 again, we repeat the same scheme */
106106
107+ file_update_time(vma->vm_file);
108+
107109 /* protect against the workqueue changing the page list */
108110 mutex_lock(&fbdefio->lock);
109111
fs/9p/vfs_file.c+3−0
@@ -610,6 +610,9 @@ v9fs_vm_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 609 unmodified lines
610610 p9_debug(P9_DEBUG_VFS, "page %p fid %lx\n",
611611 page, (unsigned long)filp->private_data);
612612
613+ /* Update file times before taking page lock */
614+ file_update_time(filp);
615+
613616 v9inode = V9FS_I(inode);
614617 /* make sure the cache has finished storing the page */
615618 v9fs_fscache_wait_on_page_write(inode, page);
fs/btrfs/disk-io.c+0−3
@@ -1614,8 +1614,6 @@ static int cleaner_kthread(void *arg) · 1613 unmodified lines
16141614 struct btrfs_root *root = arg;
16151615
16161616 do {
1617− vfs_check_frozen(root->fs_info->sb, SB_FREEZE_WRITE);
1618−
16191617 if (!(root->fs_info->sb->s_flags & MS_RDONLY) &&
16201618 mutex_trylock(&root->fs_info->cleaner_mutex)) {
16211619 btrfs_run_delayed_iputs(root);
@@ -1647,7 +1645,6 @@ static int transaction_kthread(void *arg) · 25 unmodified lines
16471645 do {
16481646 cannot_commit = false;
16491647 delay = HZ * 30;
1650− vfs_check_frozen(root->fs_info->sb, SB_FREEZE_WRITE);
16511648 mutex_lock(&root->fs_info->transaction_kthread_mutex);
16521649
16531650 spin_lock(&root->fs_info->trans_lock);
fs/btrfs/file.c+2−1
@@ -1379,7 +1379,7 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb, · 1378 unmodified lines
13791379 ssize_t err = 0;
13801380 size_t count, ocount;
13811381
1382− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
1382+ sb_start_write(inode->i_sb);
13831383
13841384 mutex_lock(&inode->i_mutex);
13851385
@@ -1469,6 +1469,7 @@ static ssize_t btrfs_file_aio_write(struct kiocb *iocb, · 83 unmodified lines
14691469 num_written = err;
14701470 }
14711471 out:
1472+ sb_end_write(inode->i_sb);
14721473 current->backing_dev_info = NULL;
14731474 return num_written ? num_written : err;
14741475 }
fs/btrfs/inode.c+5−1
@@ -6629,6 +6629,7 @@ int btrfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 6628 unmodified lines
66296629 u64 page_start;
66306630 u64 page_end;
66316631
6632+ sb_start_pagefault(inode->i_sb);
66326633 ret = btrfs_delalloc_reserve_space(inode, PAGE_CACHE_SIZE);
66336634 if (!ret) {
66346635 ret = file_update_time(vma->vm_file);
@@ -6718,12 +6719,15 @@ again: · 83 unmodified lines
67186719 unlock_extent_cached(io_tree, page_start, page_end, &cached_state, GFP_NOFS);
67196720
67206721 out_unlock:
6721− if (!ret)
6722+ if (!ret) {
6723+ sb_end_pagefault(inode->i_sb);
67226724 return VM_FAULT_LOCKED;
6725+ }
67236726 unlock_page(page);
67246727 out:
67256728 btrfs_delalloc_release_space(inode, PAGE_CACHE_SIZE);
67266729 out_noreserve:
6730+ sb_end_pagefault(inode->i_sb);
67276731 return ret;
67286732 }
67296733
fs/btrfs/ioctl.c+10−5
@@ -195,6 +195,10 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) · 194 unmodified lines
195195 if (!inode_owner_or_capable(inode))
196196 return -EACCES;
197197
198+ ret = mnt_want_write_file(file);
199+ if (ret)
200+ return ret;
201+
198202 mutex_lock(&inode->i_mutex);
199203
200204 ip_oldflags = ip->flags;
@@ -209,10 +213,6 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) · 8 unmodified lines
209213 }
210214 }
211215
212− ret = mnt_want_write_file(file);
213− if (ret)
214− goto out_unlock;
215−
216216 if (flags & FS_SYNC_FL)
217217 ip->flags |= BTRFS_INODE_SYNC;
218218 else
@@ -275,9 +275,9 @@ static int btrfs_ioctl_setflags(struct file *file, void __user *arg) · 56 unmodified lines
275275 inode->i_flags = i_oldflags;
276276 }
277277
278− mnt_drop_write_file(file);
279278 out_unlock:
280279 mutex_unlock(&inode->i_mutex);
280+ mnt_drop_write_file(file);
281281 return ret;
282282 }
283283
@@ -664,6 +664,10 @@ static noinline int btrfs_mksubvol(struct path *parent, · 380 unmodified lines
664664 struct dentry *dentry;
665665 int error;
666666
667+ error = mnt_want_write(parent->mnt);
668+ if (error)
669+ return error;
670+
667671 mutex_lock_nested(&dir->i_mutex, I_MUTEX_PARENT);
668672
669673 dentry = lookup_one_len(name, parent->dentry, namelen);
@@ -699,6 +703,7 @@ out_dput: · 29 unmodified lines
699703 dput(dentry);
700704 out_unlock:
701705 mutex_unlock(&dir->i_mutex);
706+ mnt_drop_write(parent->mnt);
702707 return error;
703708 }
704709
fs/btrfs/transaction.c+7−0
@@ -335,6 +335,8 @@ again: · 334 unmodified lines
335335 if (!h)
336336 return ERR_PTR(-ENOMEM);
337337
338+ sb_start_intwrite(root->fs_info->sb);
339+
338340 if (may_wait_transaction(root, type))
339341 wait_current_trans(root);
340342
@@ -345,6 +347,7 @@ again: · 4 unmodified lines
345347 } while (ret == -EBUSY);
346348
347349 if (ret < 0) {
350+ sb_end_intwrite(root->fs_info->sb);
348351 kmem_cache_free(btrfs_trans_handle_cachep, h);
349352 return ERR_PTR(ret);
350353 }
@@ -548,6 +551,8 @@ static int __btrfs_end_transaction(struct btrfs_trans_handle *trans, · 197 unmodified lines
548551 btrfs_trans_release_metadata(trans, root);
549552 trans->block_rsv = NULL;
550553
554+ sb_end_intwrite(root->fs_info->sb);
555+
551556 if (lock && !atomic_read(&root->fs_info->open_ioctl_trans) &&
552557 should_end_transaction(trans, root)) {
553558 trans->transaction->blocked = 1;
@@ -1578,6 +1583,8 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, · 1024 unmodified lines
15781583 put_transaction(cur_trans);
15791584 put_transaction(cur_trans);
15801585
1586+ sb_end_intwrite(root->fs_info->sb);
1587+
15811588 trace_btrfs_transaction_commit(root);
15821589
15831590 btrfs_scrub_continue(root);
fs/buffer.c+10−18
@@ -2306,8 +2306,8 @@ EXPORT_SYMBOL(block_commit_write); · 2305 unmodified lines
23062306 * beyond EOF, then the page is guaranteed safe against truncation until we
23072307 * unlock the page.
23082308 *
2309− * Direct callers of this function should call vfs_check_frozen() so that page
2310− * fault does not busyloop until the fs is thawed.
2309+ * Direct callers of this function should protect against filesystem freezing
2310+ * using sb_start_write() - sb_end_write() functions.
23112311 */
23122312 int __block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf,
23132313 get_block_t get_block)
@@ -2318,6 +2318,12 @@ int __block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf, · 4 unmodified lines
23182318 loff_t size;
23192319 int ret;
23202320
2321+ /*
2322+ * Update file times before taking page lock. We may end up failing the
2323+ * fault so this update may be superfluous but who really cares...
2324+ */
2325+ file_update_time(vma->vm_file);
2326+
23212327 lock_page(page);
23222328 size = i_size_read(inode);
23232329 if ((page->mapping != inode->i_mapping) ||
@@ -2339,18 +2345,7 @@ int __block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf, · 15 unmodified lines
23392345
23402346 if (unlikely(ret < 0))
23412347 goto out_unlock;
2342− /*
2343− * Freezing in progress? We check after the page is marked dirty and
2344− * with page lock held so if the test here fails, we are sure freezing
2345− * code will wait during syncing until the page fault is done - at that
2346− * point page will be dirty and unlocked so freezing code will write it
2347− * and writeprotect it again.
2348− */
23492348 set_page_dirty(page);
2350− if (inode->i_sb->s_frozen != SB_UNFROZEN) {
2351− ret = -EAGAIN;
2352− goto out_unlock;
2353− }
23542349 wait_on_page_writeback(page);
23552350 return 0;
23562351 out_unlock:
@@ -2365,12 +2360,9 @@ int block_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf, · 8 unmodified lines
23652360 int ret;
23662361 struct super_block *sb = vma->vm_file->f_path.dentry->d_inode->i_sb;
23672362
2368− /*
2369− * This check is racy but catches the common case. The check in
2370− * __block_page_mkwrite() is reliable.
2371− */
2372− vfs_check_frozen(sb, SB_FREEZE_WRITE);
2363+ sb_start_pagefault(sb);
23732364 ret = __block_page_mkwrite(vma, vmf, get_block);
2365+ sb_end_pagefault(sb);
23742366 return block_page_mkwrite_return(ret);
23752367 }
23762368 EXPORT_SYMBOL(block_page_mkwrite);
fs/ceph/addr.c+3−0
@@ -1184,6 +1184,9 @@ static int ceph_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 1183 unmodified lines
11841184 loff_t size, len;
11851185 int ret;
11861186
1187+ /* Update time before taking page lock */
1188+ file_update_time(vma->vm_file);
1189+
11871190 size = i_size_read(inode);
11881191 if (off + PAGE_CACHE_SIZE <= size)
11891192 len = PAGE_CACHE_SIZE;
fs/ecryptfs/inode.c+10−20
@@ -318,21 +318,20 @@ static int ecryptfs_lookup_interpose(struct dentry *dentry, · 317 unmodified lines
318318 struct vfsmount *lower_mnt;
319319 int rc = 0;
320320
321− lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
322− fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
323− BUG_ON(!lower_dentry->d_count);
324−
325321 dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
326− ecryptfs_set_dentry_private(dentry, dentry_info);
327322 if (!dentry_info) {
328323 printk(KERN_ERR "%s: Out of memory whilst attempting "
329324 "to allocate ecryptfs_dentry_info struct\n",
330325 __func__);
331326 dput(lower_dentry);
332− mntput(lower_mnt);
333− d_drop(dentry);
334327 return -ENOMEM;
335328 }
329+
330+ lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
331+ fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
332+ BUG_ON(!lower_dentry->d_count);
333+
334+ ecryptfs_set_dentry_private(dentry, dentry_info);
336335 ecryptfs_set_dentry_lower(dentry, lower_dentry);
337336 ecryptfs_set_dentry_lower_mnt(dentry, lower_mnt);
338337
@@ -381,12 +380,6 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, · 42 unmodified lines
381380 struct dentry *lower_dir_dentry, *lower_dentry;
382381 int rc = 0;
383382
384− if ((ecryptfs_dentry->d_name.len == 1
385− && !strcmp(ecryptfs_dentry->d_name.name, "."))
386− || (ecryptfs_dentry->d_name.len == 2
387− && !strcmp(ecryptfs_dentry->d_name.name, ".."))) {
388− goto out_d_drop;
389− }
390383 lower_dir_dentry = ecryptfs_dentry_to_lower(ecryptfs_dentry->d_parent);
391384 mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
392385 lower_dentry = lookup_one_len(ecryptfs_dentry->d_name.name,
@@ -397,8 +390,8 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, · 4 unmodified lines
397390 rc = PTR_ERR(lower_dentry);
398391 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
399392 "[%d] on lower_dentry = [%s]\n", __func__, rc,
400− encrypted_and_encoded_name);
401− goto out_d_drop;
393+ ecryptfs_dentry->d_name.name);
394+ goto out;
402395 }
403396 if (lower_dentry->d_inode)
404397 goto interpose;
@@ -415,7 +408,7 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, · 10 unmodified lines
415408 if (rc) {
416409 printk(KERN_ERR "%s: Error attempting to encrypt and encode "
417410 "filename; rc = [%d]\n", __func__, rc);
418− goto out_d_drop;
411+ goto out;
419412 }
420413 mutex_lock(&lower_dir_dentry->d_inode->i_mutex);
421414 lower_dentry = lookup_one_len(encrypted_and_encoded_name,
@@ -427,14 +420,11 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode, · 5 unmodified lines
427420 ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
428421 "[%d] on lower_dentry = [%s]\n", __func__, rc,
429422 encrypted_and_encoded_name);
430− goto out_d_drop;
423+ goto out;
431424 }
432425 interpose:
433426 rc = ecryptfs_lookup_interpose(ecryptfs_dentry, lower_dentry,
434427 ecryptfs_dir_inode);
435− goto out;
436−out_d_drop:
437− d_drop(ecryptfs_dentry);
438428 out:
439429 kfree(encrypted_and_encoded_name);
440430 return ERR_PTR(rc);
fs/exec.c+6−13
@@ -2069,25 +2069,18 @@ static void wait_for_dump_helpers(struct file *file) · 2068 unmodified lines
20692069 */
20702070 static int umh_pipe_setup(struct subprocess_info *info, struct cred *new)
20712071 {
2072− struct file *rp, *wp;
2072+ struct file *files[2];
20732073 struct fdtable *fdt;
20742074 struct coredump_params *cp = (struct coredump_params *)info->data;
20752075 struct files_struct *cf = current->files;
2076+ int err = create_pipe_files(files, 0);
2077+ if (err)
2078+ return err;
20762079
2077− wp = create_write_pipe(0);
2078− if (IS_ERR(wp))
2079− return PTR_ERR(wp);
2080−
2081− rp = create_read_pipe(wp, 0);
2082− if (IS_ERR(rp)) {
2083− free_write_pipe(wp);
2084− return PTR_ERR(rp);
2085− }
2086−
2087− cp->file = wp;
2080+ cp->file = files[1];
20882081
20892082 sys_close(0);
2090− fd_install(0, rp);
2083+ fd_install(0, files[0]);
20912084 spin_lock(&cf->file_lock);
20922085 fdt = files_fdtable(cf);
20932086 __set_open_fd(0, fdt);
fs/ext2/inode.c+4−1
@@ -79,6 +79,7 @@ void ext2_evict_inode(struct inode * inode) · 78 unmodified lines
7979 truncate_inode_pages(&inode->i_data, 0);
8080
8181 if (want_delete) {
82+ sb_start_intwrite(inode->i_sb);
8283 /* set dtime */
8384 EXT2_I(inode)->i_dtime = get_seconds();
8485 mark_inode_dirty(inode);
@@ -98,8 +99,10 @@ void ext2_evict_inode(struct inode * inode) · 13 unmodified lines
9899 if (unlikely(rsv))
99100 kfree(rsv);
100101
101− if (want_delete)
102+ if (want_delete) {
102103 ext2_free_inode(inode);
104+ sb_end_intwrite(inode->i_sb);
105+ }
103106 }
104107
105108 typedef struct {
fs/ext2/super.c+33−0
@@ -42,6 +42,8 @@ static void ext2_sync_super(struct super_block *sb, · 41 unmodified lines
4242 static int ext2_remount (struct super_block * sb, int * flags, char * data);
4343 static int ext2_statfs (struct dentry * dentry, struct kstatfs * buf);
4444 static int ext2_sync_fs(struct super_block *sb, int wait);
45+static int ext2_freeze(struct super_block *sb);
46+static int ext2_unfreeze(struct super_block *sb);
4547
4648 void ext2_error(struct super_block *sb, const char *function,
4749 const char *fmt, ...)
@@ -305,6 +307,8 @@ static const struct super_operations ext2_sops = { · 257 unmodified lines
305307 .evict_inode = ext2_evict_inode,
306308 .put_super = ext2_put_super,
307309 .sync_fs = ext2_sync_fs,
310+ .freeze_fs = ext2_freeze,
311+ .unfreeze_fs = ext2_unfreeze,
308312 .statfs = ext2_statfs,
309313 .remount_fs = ext2_remount,
310314 .show_options = ext2_show_options,
@@ -1200,6 +1204,35 @@ static int ext2_sync_fs(struct super_block *sb, int wait) · 889 unmodified lines
12001204 return 0;
12011205 }
12021206
1207+static int ext2_freeze(struct super_block *sb)
1208+{
1209+ struct ext2_sb_info *sbi = EXT2_SB(sb);
1210+
1211+ /*
1212+ * Open but unlinked files present? Keep EXT2_VALID_FS flag cleared
1213+ * because we have unattached inodes and thus filesystem is not fully
1214+ * consistent.
1215+ */
1216+ if (atomic_long_read(&sb->s_remove_count)) {
1217+ ext2_sync_fs(sb, 1);
1218+ return 0;
1219+ }
1220+ /* Set EXT2_FS_VALID flag */
1221+ spin_lock(&sbi->s_lock);
1222+ sbi->s_es->s_state = cpu_to_le16(sbi->s_mount_state);
1223+ spin_unlock(&sbi->s_lock);
1224+ ext2_sync_super(sb, sbi->s_es, 1);
1225+
1226+ return 0;
1227+}
1228+
1229+static int ext2_unfreeze(struct super_block *sb)
1230+{
1231+ /* Just write sb to clear EXT2_VALID_FS flag */
1232+ ext2_write_super(sb);
1233+
1234+ return 0;
1235+}
12031236
12041237 void ext2_write_super(struct super_block *sb)
12051238 {
fs/ext4/inode.c+10−5
@@ -233,6 +233,11 @@ void ext4_evict_inode(struct inode *inode) · 232 unmodified lines
233233 if (is_bad_inode(inode))
234234 goto no_delete;
235235
236+ /*
237+ * Protect us against freezing - iput() caller didn't have to have any
238+ * protection against it
239+ */
240+ sb_start_intwrite(inode->i_sb);
236241 handle = ext4_journal_start(inode, ext4_blocks_for_truncate(inode)+3);
237242 if (IS_ERR(handle)) {
238243 ext4_std_error(inode->i_sb, PTR_ERR(handle));
@@ -242,6 +247,7 @@ void ext4_evict_inode(struct inode *inode) · 3 unmodified lines
242247 * cleaned up.
243248 */
244249 ext4_orphan_del(NULL, inode);
250+ sb_end_intwrite(inode->i_sb);
245251 goto no_delete;
246252 }
247253
@@ -273,6 +279,7 @@ void ext4_evict_inode(struct inode *inode) · 25 unmodified lines
273279 stop_handle:
274280 ext4_journal_stop(handle);
275281 ext4_orphan_del(NULL, inode);
282+ sb_end_intwrite(inode->i_sb);
276283 goto no_delete;
277284 }
278285 }
@@ -301,6 +308,7 @@ void ext4_evict_inode(struct inode *inode) · 22 unmodified lines
301308 else
302309 ext4_free_inode(handle, inode);
303310 ext4_journal_stop(handle);
311+ sb_end_intwrite(inode->i_sb);
304312 return;
305313 no_delete:
306314 ext4_clear_inode(inode); /* We must guarantee clearing of inode... */
@@ -4779,11 +4787,7 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 4472 unmodified lines
47794787 get_block_t *get_block;
47804788 int retries = 0;
47814789
4782− /*
4783− * This check is racy but catches the common case. We rely on
4784− * __block_page_mkwrite() to do a reliable check.
4785− */
4786− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
4790+ sb_start_pagefault(inode->i_sb);
47874791 /* Delalloc case is easy... */
47884792 if (test_opt(inode->i_sb, DELALLOC) &&
47894793 !ext4_should_journal_data(inode) &&
@@ -4851,5 +4855,6 @@ retry_alloc: · 61 unmodified lines
48514855 out_ret:
48524856 ret = block_page_mkwrite_return(ret);
48534857 out:
4858+ sb_end_pagefault(inode->i_sb);
48544859 return ret;
48554860 }
fs/ext4/mmp.c+6−0
@@ -44,6 +44,11 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) · 43 unmodified lines
4444 {
4545 struct mmp_struct *mmp = (struct mmp_struct *)(bh->b_data);
4646
47+ /*
48+ * We protect against freezing so that we don't create dirty buffers
49+ * on frozen filesystem.
50+ */
51+ sb_start_write(sb);
4752 ext4_mmp_csum_set(sb, mmp);
4853 mark_buffer_dirty(bh);
4954 lock_buffer(bh);
@@ -51,6 +56,7 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) · 1 unmodified line
5156 get_bh(bh);
5257 submit_bh(WRITE_SYNC, bh);
5358 wait_on_buffer(bh);
59+ sb_end_write(sb);
5460 if (unlikely(!buffer_uptodate(bh)))
5561 return 1;
5662
fs/ext4/super.c+7−24
@@ -331,33 +331,17 @@ static void ext4_put_nojournal(handle_t *handle) · 330 unmodified lines
331331 * journal_end calls result in the superblock being marked dirty, so
332332 * that sync() will call the filesystem's write_super callback if
333333 * appropriate.
334− *
335− * To avoid j_barrier hold in userspace when a user calls freeze(),
336− * ext4 prevents a new handle from being started by s_frozen, which
337− * is in an upper layer.
338334 */
339335 handle_t *ext4_journal_start_sb(struct super_block *sb, int nblocks)
340336 {
341337 journal_t *journal;
342− handle_t *handle;
343338
344339 trace_ext4_journal_start(sb, nblocks, _RET_IP_);
345340 if (sb->s_flags & MS_RDONLY)
346341 return ERR_PTR(-EROFS);
347342
343+ WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE);
348344 journal = EXT4_SB(sb)->s_journal;
349− handle = ext4_journal_current_handle();
350−
351− /*
352− * If a handle has been started, it should be allowed to
353− * finish, otherwise deadlock could happen between freeze
354− * and others(e.g. truncate) due to the restart of the
355− * journal handle if the filesystem is forzen and active
356− * handles are not stopped.
357− */
358− if (!handle)
359− vfs_check_frozen(sb, SB_FREEZE_TRANS);
360−
361345 if (!journal)
362346 return ext4_get_nojournal();
363347 /*
@@ -2747,6 +2731,7 @@ static int ext4_run_li_request(struct ext4_li_request *elr) · 2383 unmodified lines
27472731 sb = elr->lr_super;
27482732 ngroups = EXT4_SB(sb)->s_groups_count;
27492733
2734+ sb_start_write(sb);
27502735 for (group = elr->lr_next_group; group < ngroups; group++) {
27512736 gdp = ext4_get_group_desc(sb, group, NULL);
27522737 if (!gdp) {
@@ -2773,6 +2758,7 @@ static int ext4_run_li_request(struct ext4_li_request *elr) · 20 unmodified lines
27732758 elr->lr_next_sched = jiffies + elr->lr_timeout;
27742759 elr->lr_next_group = group + 1;
27752760 }
2761+ sb_end_write(sb);
27762762
27772763 return ret;
27782764 }
@@ -4460,10 +4446,8 @@ int ext4_force_commit(struct super_block *sb) · 1681 unmodified lines
44604446 return 0;
44614447
44624448 journal = EXT4_SB(sb)->s_journal;
4463− if (journal) {
4464− vfs_check_frozen(sb, SB_FREEZE_TRANS);
4449+ if (journal)
44654450 ret = ext4_journal_force_commit(journal);
4466− }
44674451
44684452 return ret;
44694453 }
@@ -4493,9 +4477,8 @@ static int ext4_sync_fs(struct super_block *sb, int wait) · 23 unmodified lines
44934477 * gives us a chance to flush the journal completely and mark the fs clean.
44944478 *
44954479 * Note that only this function cannot bring a filesystem to be in a clean
4496− * state independently, because ext4 prevents a new handle from being started
4497− * by @sb->s_frozen, which stays in an upper layer. It thus needs help from
4498− * the upper layer.
4480+ * state independently. It relies on upper layer to stop all data & metadata
4481+ * modifications.
44994482 */
45004483 static int ext4_freeze(struct super_block *sb)
45014484 {
@@ -4522,7 +4505,7 @@ static int ext4_freeze(struct super_block *sb) · 20 unmodified lines
45224505 EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER);
45234506 error = ext4_commit_super(sb, 1);
45244507 out:
4525− /* we rely on s_frozen to stop further updates */
4508+ /* we rely on upper layer to stop further updates */
45264509 jbd2_journal_unlock_updates(EXT4_SB(sb)->s_journal);
45274510 return error;
45284511 }
fs/fat/file.c+7−8
@@ -43,10 +43,10 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr) · 42 unmodified lines
4343 if (err)
4444 goto out;
4545
46− mutex_lock(&inode->i_mutex);
4746 err = mnt_want_write_file(file);
4847 if (err)
49− goto out_unlock_inode;
48+ goto out;
49+ mutex_lock(&inode->i_mutex);
5050
5151 /*
5252 * ATTR_VOLUME and ATTR_DIR cannot be changed; this also
@@ -73,14 +73,14 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr) · 20 unmodified lines
7373 /* The root directory has no attributes */
7474 if (inode->i_ino == MSDOS_ROOT_INO && attr != ATTR_DIR) {
7575 err = -EINVAL;
76− goto out_drop_write;
76+ goto out_unlock_inode;
7777 }
7878
7979 if (sbi->options.sys_immutable &&
8080 ((attr | oldattr) & ATTR_SYS) &&
8181 !capable(CAP_LINUX_IMMUTABLE)) {
8282 err = -EPERM;
83− goto out_drop_write;
83+ goto out_unlock_inode;
8484 }
8585
8686 /*
@@ -90,12 +90,12 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr) · 3 unmodified lines
9090 */
9191 err = security_inode_setattr(file->f_path.dentry, &ia);
9292 if (err)
93− goto out_drop_write;
93+ goto out_unlock_inode;
9494
9595 /* This MUST be done before doing anything irreversible... */
9696 err = fat_setattr(file->f_path.dentry, &ia);
9797 if (err)
98− goto out_drop_write;
98+ goto out_unlock_inode;
9999
100100 fsnotify_change(file->f_path.dentry, ia.ia_valid);
101101 if (sbi->options.sys_immutable) {
@@ -107,10 +107,9 @@ static int fat_ioctl_set_attributes(struct file *file, u32 __user *user_attr) · 5 unmodified lines
107107
108108 fat_save_attrs(inode, attr);
109109 mark_inode_dirty(inode);
110−out_drop_write:
111− mnt_drop_write_file(file);
112110 out_unlock_inode:
113111 mutex_unlock(&inode->i_mutex);
112+ mnt_drop_write_file(file);
114113 out:
115114 return err;
116115 }
fs/file_table.c+2−2
@@ -43,7 +43,7 @@ static struct kmem_cache *filp_cachep __read_mostly; · 42 unmodified lines
4343
4444 static struct percpu_counter nr_files __cacheline_aligned_in_smp;
4545
46−static inline void file_free_rcu(struct rcu_head *head)
46+static void file_free_rcu(struct rcu_head *head)
4747 {
4848 struct file *f = container_of(head, struct file, f_u.fu_rcuhead);
4949
@@ -217,7 +217,7 @@ static void drop_file_write_access(struct file *file) · 167 unmodified lines
217217 return;
218218 if (file_check_writeable(file) != 0)
219219 return;
220− mnt_drop_write(mnt);
220+ __mnt_drop_write(mnt);
221221 file_release_write(file);
222222 }
223223
fs/fuse/file.c+2−2
@@ -944,9 +944,8 @@ static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 943 unmodified lines
944944 return err;
945945
946946 count = ocount;
947−
947+ sb_start_write(inode->i_sb);
948948 mutex_lock(&inode->i_mutex);
949− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
950949
951950 /* We can write back this queue in page reclaim */
952951 current->backing_dev_info = mapping->backing_dev_info;
@@ -1004,6 +1003,7 @@ static ssize_t fuse_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 51 unmodified lines
10041003 out:
10051004 current->backing_dev_info = NULL;
10061005 mutex_unlock(&inode->i_mutex);
1006+ sb_end_write(inode->i_sb);
10071007
10081008 return written ? written : err;
10091009 }
fs/gfs2/file.c+6−12
@@ -373,11 +373,10 @@ static int gfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 372 unmodified lines
373373 loff_t size;
374374 int ret;
375375
376− /* Wait if fs is frozen. This is racy so we check again later on
377− * and retry if the fs has been frozen after the page lock has
378− * been acquired
379− */
380− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
376+ sb_start_pagefault(inode->i_sb);
377+
378+ /* Update file times before taking page lock */
379+ file_update_time(vma->vm_file);
381380
382381 ret = gfs2_rs_alloc(ip);
383382 if (ret)
@@ -462,14 +461,9 @@ out: · 78 unmodified lines
462461 gfs2_holder_uninit(&gh);
463462 if (ret == 0) {
464463 set_page_dirty(page);
465− /* This check must be post dropping of transaction lock */
466− if (inode->i_sb->s_frozen == SB_UNFROZEN) {
467− wait_on_page_writeback(page);
468− } else {
469− ret = -EAGAIN;
470− unlock_page(page);
471− }
464+ wait_on_page_writeback(page);
472465 }
466+ sb_end_pagefault(inode->i_sb);
473467 return block_page_mkwrite_return(ret);
474468 }
475469
fs/gfs2/trans.c+4−0
@@ -50,6 +50,7 @@ int gfs2_trans_begin(struct gfs2_sbd *sdp, unsigned int blocks, · 49 unmodified lines
5050 if (revokes)
5151 tr->tr_reserved += gfs2_struct2blk(sdp, revokes,
5252 sizeof(u64));
53+ sb_start_intwrite(sdp->sd_vfs);
5354 gfs2_holder_init(sdp->sd_trans_gl, LM_ST_SHARED, 0, &tr->tr_t_gh);
5455
5556 error = gfs2_glock_nq(&tr->tr_t_gh);
@@ -68,6 +69,7 @@ fail_gunlock: · 12 unmodified lines
6869 gfs2_glock_dq(&tr->tr_t_gh);
6970
7071 fail_holder_uninit:
72+ sb_end_intwrite(sdp->sd_vfs);
7173 gfs2_holder_uninit(&tr->tr_t_gh);
7274 kfree(tr);
7375
@@ -116,6 +118,7 @@ void gfs2_trans_end(struct gfs2_sbd *sdp) · 42 unmodified lines
116118 gfs2_holder_uninit(&tr->tr_t_gh);
117119 kfree(tr);
118120 }
121+ sb_end_intwrite(sdp->sd_vfs);
119122 return;
120123 }
121124
@@ -136,6 +139,7 @@ void gfs2_trans_end(struct gfs2_sbd *sdp) · 14 unmodified lines
136139
137140 if (sdp->sd_vfs->s_flags & MS_SYNCHRONOUS)
138141 gfs2_log_flush(sdp, NULL);
142+ sb_end_intwrite(sdp->sd_vfs);
139143 }
140144
141145 /**
fs/inode.c+8−4
@@ -1542,9 +1542,11 @@ void touch_atime(struct path *path) · 1541 unmodified lines
15421542 if (timespec_equal(&inode->i_atime, &now))
15431543 return;
15441544
1545− if (mnt_want_write(mnt))
1545+ if (!sb_start_write_trylock(inode->i_sb))
15461546 return;
15471547
1548+ if (__mnt_want_write(mnt))
1549+ goto skip_update;
15481550 /*
15491551 * File systems can error out when updating inodes if they need to
15501552 * allocate new space to modify an inode (such is the case for
@@ -1555,7 +1557,9 @@ void touch_atime(struct path *path) · 4 unmodified lines
15551557 * of the fs read only, e.g. subvolumes in Btrfs.
15561558 */
15571559 update_time(inode, &now, S_ATIME);
1558− mnt_drop_write(mnt);
1560+ __mnt_drop_write(mnt);
1561+skip_update:
1562+ sb_end_write(inode->i_sb);
15591563 }
15601564 EXPORT_SYMBOL(touch_atime);
15611565
@@ -1662,11 +1666,11 @@ int file_update_time(struct file *file) · 100 unmodified lines
16621666 return 0;
16631667
16641668 /* Finally allowed to write? Takes lock. */
1665− if (mnt_want_write_file(file))
1669+ if (__mnt_want_write_file(file))
16661670 return 0;
16671671
16681672 ret = update_time(inode, &now, sync_it);
1669− mnt_drop_write_file(file);
1673+ __mnt_drop_write_file(file);
16701674
16711675 return ret;
16721676 }
fs/internal.h+4−0
@@ -61,6 +61,10 @@ extern void __init mnt_init(void); · 60 unmodified lines
6161
6262 extern struct lglock vfsmount_lock;
6363
64+extern int __mnt_want_write(struct vfsmount *);
65+extern int __mnt_want_write_file(struct file *);
66+extern void __mnt_drop_write(struct vfsmount *);
67+extern void __mnt_drop_write_file(struct file *);
6468
6569 /*
6670 * fs_struct.c
fs/lockd/clntproc.c+7−7
@@ -156,12 +156,16 @@ int nlmclnt_proc(struct nlm_host *host, int cmd, struct file_lock *fl) · 155 unmodified lines
156156 struct nlm_rqst *call;
157157 int status;
158158
159− nlm_get_host(host);
160159 call = nlm_alloc_call(host);
161160 if (call == NULL)
162161 return -ENOMEM;
163162
164163 nlmclnt_locks_init_private(fl, host);
164+ if (!fl->fl_u.nfs_fl.owner) {
165+ /* lockowner allocation has failed */
166+ nlmclnt_release_call(call);
167+ return -ENOMEM;
168+ }
165169 /* Set up the argument struct */
166170 nlmclnt_setlockargs(call, fl);
167171
@@ -185,9 +189,6 @@ EXPORT_SYMBOL_GPL(nlmclnt_proc); · 17 unmodified lines
185189
186190 /*
187191 * Allocate an NLM RPC call struct
188− *
189− * Note: the caller must hold a reference to host. In case of failure,
190− * this reference will be released.
191192 */
192193 struct nlm_rqst *nlm_alloc_call(struct nlm_host *host)
193194 {
@@ -199,7 +200,7 @@ struct nlm_rqst *nlm_alloc_call(struct nlm_host *host) · 5 unmodified lines
199200 atomic_set(&call->a_count, 1);
200201 locks_init_lock(&call->a_args.lock.fl);
201202 locks_init_lock(&call->a_res.lock.fl);
202− call->a_host = host;
203+ call->a_host = nlm_get_host(host);
203204 return call;
204205 }
205206 if (signalled())
@@ -207,7 +208,6 @@ struct nlm_rqst *nlm_alloc_call(struct nlm_host *host) · 1 unmodified line
207208 printk("nlm_alloc_call: failed, waiting for memory\n");
208209 schedule_timeout_interruptible(5*HZ);
209210 }
210− nlmclnt_release_host(host);
211211 return NULL;
212212 }
213213
@@ -750,7 +750,7 @@ static int nlmclnt_cancel(struct nlm_host *host, int block, struct file_lock *fl · 536 unmodified lines
750750 dprintk("lockd: blocking lock attempt was interrupted by a signal.\n"
751751 " Attempting to cancel lock.\n");
752752
753− req = nlm_alloc_call(nlm_get_host(host));
753+ req = nlm_alloc_call(host);
754754 if (!req)
755755 return -ENOMEM;
756756 req->a_flags = RPC_TASK_ASYNC;
fs/lockd/svc4proc.c+1−0
@@ -257,6 +257,7 @@ static __be32 nlm4svc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args · 256 unmodified lines
257257 return rpc_system_err;
258258
259259 call = nlm_alloc_call(host);
260+ nlmsvc_release_host(host);
260261 if (call == NULL)
261262 return rpc_system_err;
262263
fs/lockd/svclock.c+0−1
@@ -219,7 +219,6 @@ nlmsvc_create_block(struct svc_rqst *rqstp, struct nlm_host *host, · 218 unmodified lines
219219 struct nlm_block *block;
220220 struct nlm_rqst *call = NULL;
221221
222− nlm_get_host(host);
223222 call = nlm_alloc_call(host);
224223 if (call == NULL)
225224 return NULL;
fs/lockd/svcproc.c+1−0
@@ -297,6 +297,7 @@ static __be32 nlmsvc_callback(struct svc_rqst *rqstp, u32 proc, struct nlm_args · 296 unmodified lines
297297 return rpc_system_err;
298298
299299 call = nlm_alloc_call(host);
300+ nlmsvc_release_host(host);
300301 if (call == NULL)
301302 return rpc_system_err;
302303
fs/namei.c+213−100
@@ -650,6 +650,121 @@ static inline void put_link(struct nameidata *nd, struct path *link, void *cooki · 649 unmodified lines
650650 path_put(link);
651651 }
652652
653+int sysctl_protected_symlinks __read_mostly = 1;
654+int sysctl_protected_hardlinks __read_mostly = 1;
655+
656+/**
657+ * may_follow_link - Check symlink following for unsafe situations
658+ * @link: The path of the symlink
659+ *
660+ * In the case of the sysctl_protected_symlinks sysctl being enabled,
661+ * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is
662+ * in a sticky world-writable directory. This is to protect privileged
663+ * processes from failing races against path names that may change out
664+ * from under them by way of other users creating malicious symlinks.
665+ * It will permit symlinks to be followed only when outside a sticky
666+ * world-writable directory, or when the uid of the symlink and follower
667+ * match, or when the directory owner matches the symlink's owner.
668+ *
669+ * Returns 0 if following the symlink is allowed, -ve on error.
670+ */
671+static inline int may_follow_link(struct path *link, struct nameidata *nd)
672+{
673+ const struct inode *inode;
674+ const struct inode *parent;
675+
676+ if (!sysctl_protected_symlinks)
677+ return 0;
678+
679+ /* Allowed if owner and follower match. */
680+ inode = link->dentry->d_inode;
681+ if (current_cred()->fsuid == inode->i_uid)
682+ return 0;
683+
684+ /* Allowed if parent directory not sticky and world-writable. */
685+ parent = nd->path.dentry->d_inode;
686+ if ((parent->i_mode & (S_ISVTX|S_IWOTH)) != (S_ISVTX|S_IWOTH))
687+ return 0;
688+
689+ /* Allowed if parent directory and link owner match. */
690+ if (parent->i_uid == inode->i_uid)
691+ return 0;
692+
693+ path_put_conditional(link, nd);
694+ path_put(&nd->path);
695+ audit_log_link_denied("follow_link", link);
696+ return -EACCES;
697+}
698+
699+/**
700+ * safe_hardlink_source - Check for safe hardlink conditions
701+ * @inode: the source inode to hardlink from
702+ *
703+ * Return false if at least one of the following conditions:
704+ * - inode is not a regular file
705+ * - inode is setuid
706+ * - inode is setgid and group-exec
707+ * - access failure for read and write
708+ *
709+ * Otherwise returns true.
710+ */
711+static bool safe_hardlink_source(struct inode *inode)
712+{
713+ umode_t mode = inode->i_mode;
714+
715+ /* Special files should not get pinned to the filesystem. */
716+ if (!S_ISREG(mode))
717+ return false;
718+
719+ /* Setuid files should not get pinned to the filesystem. */
720+ if (mode & S_ISUID)
721+ return false;
722+
723+ /* Executable setgid files should not get pinned to the filesystem. */
724+ if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))
725+ return false;
726+
727+ /* Hardlinking to unreadable or unwritable sources is dangerous. */
728+ if (inode_permission(inode, MAY_READ | MAY_WRITE))
729+ return false;
730+
731+ return true;
732+}
733+
734+/**
735+ * may_linkat - Check permissions for creating a hardlink
736+ * @link: the source to hardlink from
737+ *
738+ * Block hardlink when all of:
739+ * - sysctl_protected_hardlinks enabled
740+ * - fsuid does not match inode
741+ * - hardlink source is unsafe (see safe_hardlink_source() above)
742+ * - not CAP_FOWNER
743+ *
744+ * Returns 0 if successful, -ve on error.
745+ */
746+static int may_linkat(struct path *link)
747+{
748+ const struct cred *cred;
749+ struct inode *inode;
750+
751+ if (!sysctl_protected_hardlinks)
752+ return 0;
753+
754+ cred = current_cred();
755+ inode = link->dentry->d_inode;
756+
757+ /* Source inode owner (or CAP_FOWNER) can hardlink all they like,
758+ * otherwise, it must be a safe source.
759+ */
760+ if (cred->fsuid == inode->i_uid || safe_hardlink_source(inode) ||
761+ capable(CAP_FOWNER))
762+ return 0;
763+
764+ audit_log_link_denied("linkat", link);
765+ return -EPERM;
766+}
767+
653768 static __always_inline int
654769 follow_link(struct path *link, struct nameidata *nd, void **p)
655770 {
@@ -1818,6 +1933,9 @@ static int path_lookupat(int dfd, const char *name, · 1162 unmodified lines
18181933 while (err > 0) {
18191934 void *cookie;
18201935 struct path link = path;
1936+ err = may_follow_link(&link, nd);
1937+ if (unlikely(err))
1938+ break;
18211939 nd->flags |= LOOKUP_PARENT;
18221940 err = follow_link(&link, nd, &cookie);
18231941 if (err)
@@ -2277,7 +2395,7 @@ static int may_o_create(struct path *dir, struct dentry *dentry, umode_t mode) · 453 unmodified lines
22772395 static int atomic_open(struct nameidata *nd, struct dentry *dentry,
22782396 struct path *path, struct file *file,
22792397 const struct open_flags *op,
2280− bool *want_write, bool need_lookup,
2398+ bool got_write, bool need_lookup,
22812399 int *opened)
22822400 {
22832401 struct inode *dir = nd->path.dentry->d_inode;
@@ -2300,7 +2418,7 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry, · 16 unmodified lines
23002418 if ((open_flag & O_CREAT) && !IS_POSIXACL(dir))
23012419 mode &= ~current_umask();
23022420
2303− if (open_flag & O_EXCL) {
2421+ if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT)) {
23042422 open_flag &= ~O_TRUNC;
23052423 *opened |= FILE_CREATED;
23062424 }
@@ -2314,12 +2432,9 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry, · 7 unmodified lines
23142432 * Another problem is returing the "right" error value (e.g. for an
23152433 * O_EXCL open we want to return EEXIST not EROFS).
23162434 */
2317− if ((open_flag & (O_CREAT | O_TRUNC)) ||
2318− (open_flag & O_ACCMODE) != O_RDONLY) {
2319− error = mnt_want_write(nd->path.mnt);
2320− if (!error) {
2321− *want_write = true;
2322− } else if (!(open_flag & O_CREAT)) {
2435+ if (((open_flag & (O_CREAT | O_TRUNC)) ||
2436+ (open_flag & O_ACCMODE) != O_RDONLY) && unlikely(!got_write)) {
2437+ if (!(open_flag & O_CREAT)) {
23232438 /*
23242439 * No O_CREATE -> atomicity not a requirement -> fall
23252440 * back to lookup + open
@@ -2327,11 +2442,11 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry, · 1 unmodified line
23272442 goto no_open;
23282443 } else if (open_flag & (O_EXCL | O_TRUNC)) {
23292444 /* Fall back and fail with the right error */
2330− create_error = error;
2445+ create_error = -EROFS;
23312446 goto no_open;
23322447 } else {
23332448 /* No side effects, safe to clear O_CREAT */
2334− create_error = error;
2449+ create_error = -EROFS;
23352450 open_flag &= ~O_CREAT;
23362451 }
23372452 }
@@ -2438,7 +2553,7 @@ looked_up: · 100 unmodified lines
24382553 static int lookup_open(struct nameidata *nd, struct path *path,
24392554 struct file *file,
24402555 const struct open_flags *op,
2441− bool *want_write, int *opened)
2556+ bool got_write, int *opened)
24422557 {
24432558 struct dentry *dir = nd->path.dentry;
24442559 struct inode *dir_inode = dir->d_inode;
@@ -2456,7 +2571,7 @@ static int lookup_open(struct nameidata *nd, struct path *path, · 11 unmodified lines
24562571 goto out_no_open;
24572572
24582573 if ((nd->flags & LOOKUP_OPEN) && dir_inode->i_op->atomic_open) {
2459− return atomic_open(nd, dentry, path, file, op, want_write,
2574+ return atomic_open(nd, dentry, path, file, op, got_write,
24602575 need_lookup, opened);
24612576 }
24622577
@@ -2480,10 +2595,10 @@ static int lookup_open(struct nameidata *nd, struct path *path, · 17 unmodified lines
24802595 * a permanent write count is taken through
24812596 * the 'struct file' in finish_open().
24822597 */
2483− error = mnt_want_write(nd->path.mnt);
2484− if (error)
2598+ if (!got_write) {
2599+ error = -EROFS;
24852600 goto out_dput;
2486− *want_write = true;
2601+ }
24872602 *opened |= FILE_CREATED;
24882603 error = security_path_mknod(&nd->path, dentry, mode, 0);
24892604 if (error)
@@ -2513,7 +2628,7 @@ static int do_last(struct nameidata *nd, struct path *path, · 23 unmodified lines
25132628 struct dentry *dir = nd->path.dentry;
25142629 int open_flag = op->open_flag;
25152630 bool will_truncate = (open_flag & O_TRUNC) != 0;
2516− bool want_write = false;
2631+ bool got_write = false;
25172632 int acc_mode = op->acc_mode;
25182633 struct inode *inode;
25192634 bool symlink_ok = false;
@@ -2582,8 +2697,18 @@ static int do_last(struct nameidata *nd, struct path *path, · 62 unmodified lines
25822697 }
25832698
25842699 retry_lookup:
2700+ if (op->open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
2701+ error = mnt_want_write(nd->path.mnt);
2702+ if (!error)
2703+ got_write = true;
2704+ /*
2705+ * do _not_ fail yet - we might not need that or fail with
2706+ * a different error; let lookup_open() decide; we'll be
2707+ * dropping this one anyway.
2708+ */
2709+ }
25852710 mutex_lock(&dir->d_inode->i_mutex);
2586− error = lookup_open(nd, path, file, op, &want_write, opened);
2711+ error = lookup_open(nd, path, file, op, got_write, opened);
25872712 mutex_unlock(&dir->d_inode->i_mutex);
25882713
25892714 if (error <= 0) {
@@ -2608,22 +2733,23 @@ retry_lookup: · 18 unmodified lines
26082733 }
26092734
26102735 /*
2611− * It already exists.
2736+ * create/update audit record if it already exists.
26122737 */
2613− audit_inode(pathname, path->dentry);
2738+ if (path->dentry->d_inode)
2739+ audit_inode(pathname, path->dentry);
26142740
26152741 /*
26162742 * If atomic_open() acquired write access it is dropped now due to
26172743 * possible mount and symlink following (this might be optimized away if
26182744 * necessary...)
26192745 */
2620− if (want_write) {
2746+ if (got_write) {
26212747 mnt_drop_write(nd->path.mnt);
2622− want_write = false;
2748+ got_write = false;
26232749 }
26242750
26252751 error = -EEXIST;
2626− if (open_flag & O_EXCL)
2752+ if ((open_flag & (O_EXCL | O_CREAT)) == (O_EXCL | O_CREAT))
26272753 goto exit_dput;
26282754
26292755 error = follow_managed(path, nd->flags);
@@ -2684,7 +2810,7 @@ finish_open: · 54 unmodified lines
26842810 error = mnt_want_write(nd->path.mnt);
26852811 if (error)
26862812 goto out;
2687− want_write = true;
2813+ got_write = true;
26882814 }
26892815 finish_open_created:
26902816 error = may_open(&nd->path, acc_mode, open_flag);
@@ -2711,7 +2837,7 @@ opened: · 20 unmodified lines
27112837 goto exit_fput;
27122838 }
27132839 out:
2714− if (want_write)
2840+ if (got_write)
27152841 mnt_drop_write(nd->path.mnt);
27162842 path_put(&save_parent);
27172843 terminate_walk(nd);
@@ -2735,9 +2861,9 @@ stale_open: · 17 unmodified lines
27352861 nd->inode = dir->d_inode;
27362862 save_parent.mnt = NULL;
27372863 save_parent.dentry = NULL;
2738− if (want_write) {
2864+ if (got_write) {
27392865 mnt_drop_write(nd->path.mnt);
2740− want_write = false;
2866+ got_write = false;
27412867 }
27422868 retried = true;
27432869 goto retry_lookup;
@@ -2777,6 +2903,9 @@ static struct file *path_openat(int dfd, const char *pathname, · 33 unmodified lines
27772903 error = -ELOOP;
27782904 break;
27792905 }
2906+ error = may_follow_link(&link, nd);
2907+ if (unlikely(error))
2908+ break;
27802909 nd->flags |= LOOKUP_PARENT;
27812910 nd->flags &= ~(LOOKUP_OPEN|LOOKUP_CREATE|LOOKUP_EXCL);
27822911 error = follow_link(&link, nd, &cookie);
@@ -2846,6 +2975,7 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path · 63 unmodified lines
28462975 {
28472976 struct dentry *dentry = ERR_PTR(-EEXIST);
28482977 struct nameidata nd;
2978+ int err2;
28492979 int error = do_path_lookup(dfd, pathname, LOOKUP_PARENT, &nd);
28502980 if (error)
28512981 return ERR_PTR(error);
@@ -2859,16 +2989,19 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path · 7 unmodified lines
28592989 nd.flags &= ~LOOKUP_PARENT;
28602990 nd.flags |= LOOKUP_CREATE | LOOKUP_EXCL;
28612991
2992+ /* don't fail immediately if it's r/o, at least try to report other errors */
2993+ err2 = mnt_want_write(nd.path.mnt);
28622994 /*
28632995 * Do the final lookup.
28642996 */
28652997 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
28662998 dentry = lookup_hash(&nd);
28672999 if (IS_ERR(dentry))
2868− goto fail;
3000+ goto unlock;
28693001
3002+ error = -EEXIST;
28703003 if (dentry->d_inode)
2871− goto eexist;
3004+ goto fail;
28723005 /*
28733006 * Special case - lookup gave negative, but... we had foo/bar/
28743007 * From the vfs_mknod() POV we just have a negative dentry -
@@ -2876,23 +3009,37 @@ struct dentry *kern_path_create(int dfd, const char *pathname, struct path *path · 1 unmodified line
28763009 * been asking for (non-existent) directory. -ENOENT for you.
28773010 */
28783011 if (unlikely(!is_dir && nd.last.name[nd.last.len])) {
2879− dput(dentry);
2880− dentry = ERR_PTR(-ENOENT);
3012+ error = -ENOENT;
3013+ goto fail;
3014+ }
3015+ if (unlikely(err2)) {
3016+ error = err2;
28813017 goto fail;
28823018 }
28833019 *path = nd.path;
28843020 return dentry;
2885−eexist:
2886− dput(dentry);
2887− dentry = ERR_PTR(-EEXIST);
28883021 fail:
3022+ dput(dentry);
3023+ dentry = ERR_PTR(error);
3024+unlock:
28893025 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3026+ if (!err2)
3027+ mnt_drop_write(nd.path.mnt);
28903028 out:
28913029 path_put(&nd.path);
28923030 return dentry;
28933031 }
28943032 EXPORT_SYMBOL(kern_path_create);
28953033
3034+void done_path_create(struct path *path, struct dentry *dentry)
3035+{
3036+ dput(dentry);
3037+ mutex_unlock(&path->dentry->d_inode->i_mutex);
3038+ mnt_drop_write(path->mnt);
3039+ path_put(path);
3040+}
3041+EXPORT_SYMBOL(done_path_create);
3042+
28963043 struct dentry *user_path_create(int dfd, const char __user *pathname, struct path *path, int is_dir)
28973044 {
28983045 char *tmp = getname(pathname);
@@ -2956,8 +3103,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, · 57 unmodified lines
29563103 struct path path;
29573104 int error;
29583105
2959− if (S_ISDIR(mode))
2960− return -EPERM;
3106+ error = may_mknod(mode);
3107+ if (error)
3108+ return error;
29613109
29623110 dentry = user_path_create(dfd, filename, &path, 0);
29633111 if (IS_ERR(dentry))
@@ -2965,15 +3113,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, · 1 unmodified line
29653113
29663114 if (!IS_POSIXACL(path.dentry->d_inode))
29673115 mode &= ~current_umask();
2968− error = may_mknod(mode);
2969− if (error)
2970− goto out_dput;
2971− error = mnt_want_write(path.mnt);
2972− if (error)
2973− goto out_dput;
29743116 error = security_path_mknod(&path, dentry, mode, dev);
29753117 if (error)
2976− goto out_drop_write;
3118+ goto out;
29773119 switch (mode & S_IFMT) {
29783120 case 0: case S_IFREG:
29793121 error = vfs_create(path.dentry->d_inode,dentry,mode,true);
@@ -2986,13 +3128,8 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const char __user *, filename, umode_t, mode, · 6 unmodified lines
29863128 error = vfs_mknod(path.dentry->d_inode,dentry,mode,0);
29873129 break;
29883130 }
2989−out_drop_write:
2990− mnt_drop_write(path.mnt);
2991−out_dput:
2992− dput(dentry);
2993− mutex_unlock(&path.dentry->d_inode->i_mutex);
2994− path_put(&path);
2995−
3131+out:
3132+ done_path_create(&path, dentry);
29963133 return error;
29973134 }
29983135
@@ -3038,19 +3175,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const char __user *, pathname, umode_t, mode) · 39 unmodified lines
30383175
30393176 if (!IS_POSIXACL(path.dentry->d_inode))
30403177 mode &= ~current_umask();
3041− error = mnt_want_write(path.mnt);
3042− if (error)
3043− goto out_dput;
30443178 error = security_path_mkdir(&path, dentry, mode);
3045− if (error)
3046− goto out_drop_write;
3047− error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3048−out_drop_write:
3049− mnt_drop_write(path.mnt);
3050−out_dput:
3051− dput(dentry);
3052− mutex_unlock(&path.dentry->d_inode->i_mutex);
3053− path_put(&path);
3179+ if (!error)
3180+ error = vfs_mkdir(path.dentry->d_inode, dentry, mode);
3181+ done_path_create(&path, dentry);
30543182 return error;
30553183 }
30563184
@@ -3144,6 +3272,9 @@ static long do_rmdir(int dfd, const char __user *pathname) · 87 unmodified lines
31443272 }
31453273
31463274 nd.flags &= ~LOOKUP_PARENT;
3275+ error = mnt_want_write(nd.path.mnt);
3276+ if (error)
3277+ goto exit1;
31473278
31483279 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
31493280 dentry = lookup_hash(&nd);
@@ -3154,19 +3285,15 @@ static long do_rmdir(int dfd, const char __user *pathname) · 4 unmodified lines
31543285 error = -ENOENT;
31553286 goto exit3;
31563287 }
3157− error = mnt_want_write(nd.path.mnt);
3158− if (error)
3159− goto exit3;
31603288 error = security_path_rmdir(&nd.path, dentry);
31613289 if (error)
3162− goto exit4;
3290+ goto exit3;
31633291 error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
3164−exit4:
3165− mnt_drop_write(nd.path.mnt);
31663292 exit3:
31673293 dput(dentry);
31683294 exit2:
31693295 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
3296+ mnt_drop_write(nd.path.mnt);
31703297 exit1:
31713298 path_put(&nd.path);
31723299 putname(name);
@@ -3233,6 +3360,9 @@ static long do_unlinkat(int dfd, const char __user *pathname) · 60 unmodified lines
32333360 goto exit1;
32343361
32353362 nd.flags &= ~LOOKUP_PARENT;
3363+ error = mnt_want_write(nd.path.mnt);
3364+ if (error)
3365+ goto exit1;
32363366
32373367 mutex_lock_nested(&nd.path.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
32383368 dentry = lookup_hash(&nd);
@@ -3245,21 +3375,17 @@ static long do_unlinkat(int dfd, const char __user *pathname) · 6 unmodified lines
32453375 if (!inode)
32463376 goto slashes;
32473377 ihold(inode);
3248− error = mnt_want_write(nd.path.mnt);
3249− if (error)
3250− goto exit2;
32513378 error = security_path_unlink(&nd.path, dentry);
32523379 if (error)
3253− goto exit3;
3380+ goto exit2;
32543381 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
3255−exit3:
3256− mnt_drop_write(nd.path.mnt);
3257− exit2:
3382+exit2:
32583383 dput(dentry);
32593384 }
32603385 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
32613386 if (inode)
32623387 iput(inode); /* truncate the inode here */
3388+ mnt_drop_write(nd.path.mnt);
32633389 exit1:
32643390 path_put(&nd.path);
32653391 putname(name);
@@ -3324,19 +3450,10 @@ SYSCALL_DEFINE3(symlinkat, const char __user *, oldname, · 58 unmodified lines
33243450 if (IS_ERR(dentry))
33253451 goto out_putname;
33263452
3327− error = mnt_want_write(path.mnt);
3328− if (error)
3329− goto out_dput;
33303453 error = security_path_symlink(&path, dentry, from);
3331− if (error)
3332− goto out_drop_write;
3333− error = vfs_symlink(path.dentry->d_inode, dentry, from);
3334−out_drop_write:
3335− mnt_drop_write(path.mnt);
3336−out_dput:
3337− dput(dentry);
3338− mutex_unlock(&path.dentry->d_inode->i_mutex);
3339− path_put(&path);
3454+ if (!error)
3455+ error = vfs_symlink(path.dentry->d_inode, dentry, from);
3456+ done_path_create(&path, dentry);
33403457 out_putname:
33413458 putname(from);
33423459 return error;
@@ -3436,19 +3553,15 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname, · 93 unmodified lines
34363553 error = -EXDEV;
34373554 if (old_path.mnt != new_path.mnt)
34383555 goto out_dput;
3439− error = mnt_want_write(new_path.mnt);
3440− if (error)
3556+ error = may_linkat(&old_path);
3557+ if (unlikely(error))
34413558 goto out_dput;
34423559 error = security_path_link(old_path.dentry, &new_path, new_dentry);
34433560 if (error)
3444− goto out_drop_write;
3561+ goto out_dput;
34453562 error = vfs_link(old_path.dentry, new_path.dentry->d_inode, new_dentry);
3446−out_drop_write:
3447− mnt_drop_write(new_path.mnt);
34483563 out_dput:
3449− dput(new_dentry);
3450− mutex_unlock(&new_path.dentry->d_inode->i_mutex);
3451− path_put(&new_path);
3564+ done_path_create(&new_path, new_dentry);
34523565 out:
34533566 path_put(&old_path);
34543567
@@ -3644,6 +3757,10 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, · 189 unmodified lines
36443757 if (newnd.last_type != LAST_NORM)
36453758 goto exit2;
36463759
3760+ error = mnt_want_write(oldnd.path.mnt);
3761+ if (error)
3762+ goto exit2;
3763+
36473764 oldnd.flags &= ~LOOKUP_PARENT;
36483765 newnd.flags &= ~LOOKUP_PARENT;
36493766 newnd.flags |= LOOKUP_RENAME_TARGET;
@@ -3679,23 +3796,19 @@ SYSCALL_DEFINE4(renameat, int, olddfd, const char __user *, oldname, · 29 unmodified lines
36793796 if (new_dentry == trap)
36803797 goto exit5;
36813798
3682− error = mnt_want_write(oldnd.path.mnt);
3683− if (error)
3684− goto exit5;
36853799 error = security_path_rename(&oldnd.path, old_dentry,
36863800 &newnd.path, new_dentry);
36873801 if (error)
3688− goto exit6;
3802+ goto exit5;
36893803 error = vfs_rename(old_dir->d_inode, old_dentry,
36903804 new_dir->d_inode, new_dentry);
3691−exit6:
3692− mnt_drop_write(oldnd.path.mnt);
36933805 exit5:
36943806 dput(new_dentry);
36953807 exit4:
36963808 dput(old_dentry);
36973809 exit3:
36983810 unlock_rename(new_dir, old_dir);
3811+ mnt_drop_write(oldnd.path.mnt);
36993812 exit2:
37003813 path_put(&newnd.path);
37013814 putname(to);
fs/namespace.c+77−20
@@ -283,24 +283,22 @@ static int mnt_is_readonly(struct vfsmount *mnt) · 282 unmodified lines
283283 }
284284
285285 /*
286− * Most r/o checks on a fs are for operations that take
287− * discrete amounts of time, like a write() or unlink().
288− * We must keep track of when those operations start
289− * (for permission checks) and when they end, so that
290− * we can determine when writes are able to occur to
291− * a filesystem.
286+ * Most r/o & frozen checks on a fs are for operations that take discrete
287+ * amounts of time, like a write() or unlink(). We must keep track of when
288+ * those operations start (for permission checks) and when they end, so that we
289+ * can determine when writes are able to occur to a filesystem.
292290 */
293291 /**
294− * mnt_want_write - get write access to a mount
292+ * __mnt_want_write - get write access to a mount without freeze protection
295293 * @m: the mount on which to take a write
296294 *
297− * This tells the low-level filesystem that a write is
298− * about to be performed to it, and makes sure that
299− * writes are allowed before returning success. When
300− * the write operation is finished, mnt_drop_write()
301− * must be called. This is effectively a refcount.
295+ * This tells the low-level filesystem that a write is about to be performed to
296+ * it, and makes sure that writes are allowed (mnt it read-write) before
297+ * returning success. This operation does not protect against filesystem being
298+ * frozen. When the write operation is finished, __mnt_drop_write() must be
299+ * called. This is effectively a refcount.
302300 */
303−int mnt_want_write(struct vfsmount *m)
301+int __mnt_want_write(struct vfsmount *m)
304302 {
305303 struct mount *mnt = real_mount(m);
306304 int ret = 0;
@@ -326,6 +324,27 @@ int mnt_want_write(struct vfsmount *m) · 19 unmodified lines
326324 ret = -EROFS;
327325 }
328326 preempt_enable();
327+
328+ return ret;
329+}
330+
331+/**
332+ * mnt_want_write - get write access to a mount
333+ * @m: the mount on which to take a write
334+ *
335+ * This tells the low-level filesystem that a write is about to be performed to
336+ * it, and makes sure that writes are allowed (mount is read-write, filesystem
337+ * is not frozen) before returning success. When the write operation is
338+ * finished, mnt_drop_write() must be called. This is effectively a refcount.
339+ */
340+int mnt_want_write(struct vfsmount *m)
341+{
342+ int ret;
343+
344+ sb_start_write(m->mnt_sb);
345+ ret = __mnt_want_write(m);
346+ if (ret)
347+ sb_end_write(m->mnt_sb);
329348 return ret;
330349 }
331350 EXPORT_SYMBOL_GPL(mnt_want_write);
@@ -355,38 +374,76 @@ int mnt_clone_write(struct vfsmount *mnt) · 23 unmodified lines
355374 EXPORT_SYMBOL_GPL(mnt_clone_write);
356375
357376 /**
358− * mnt_want_write_file - get write access to a file's mount
377+ * __mnt_want_write_file - get write access to a file's mount
359378 * @file: the file who's mount on which to take a write
360379 *
361− * This is like mnt_want_write, but it takes a file and can
380+ * This is like __mnt_want_write, but it takes a file and can
362381 * do some optimisations if the file is open for write already
363382 */
364−int mnt_want_write_file(struct file *file)
383+int __mnt_want_write_file(struct file *file)
365384 {
366385 struct inode *inode = file->f_dentry->d_inode;
386+
367387 if (!(file->f_mode & FMODE_WRITE) || special_file(inode->i_mode))
368− return mnt_want_write(file->f_path.mnt);
388+ return __mnt_want_write(file->f_path.mnt);
369389 else
370390 return mnt_clone_write(file->f_path.mnt);
371391 }
392+
393+/**
394+ * mnt_want_write_file - get write access to a file's mount
395+ * @file: the file who's mount on which to take a write
396+ *
397+ * This is like mnt_want_write, but it takes a file and can
398+ * do some optimisations if the file is open for write already
399+ */
400+int mnt_want_write_file(struct file *file)
401+{
402+ int ret;
403+
404+ sb_start_write(file->f_path.mnt->mnt_sb);
405+ ret = __mnt_want_write_file(file);
406+ if (ret)
407+ sb_end_write(file->f_path.mnt->mnt_sb);
408+ return ret;
409+}
372410 EXPORT_SYMBOL_GPL(mnt_want_write_file);
373411
374412 /**
375− * mnt_drop_write - give up write access to a mount
413+ * __mnt_drop_write - give up write access to a mount
376414 * @mnt: the mount on which to give up write access
377415 *
378416 * Tells the low-level filesystem that we are done
379417 * performing writes to it. Must be matched with
380− * mnt_want_write() call above.
418+ * __mnt_want_write() call above.
381419 */
382−void mnt_drop_write(struct vfsmount *mnt)
420+void __mnt_drop_write(struct vfsmount *mnt)
383421 {
384422 preempt_disable();
385423 mnt_dec_writers(real_mount(mnt));
386424 preempt_enable();
387425 }
426+
427+/**
428+ * mnt_drop_write - give up write access to a mount
429+ * @mnt: the mount on which to give up write access
430+ *
431+ * Tells the low-level filesystem that we are done performing writes to it and
432+ * also allows filesystem to be frozen again. Must be matched with
433+ * mnt_want_write() call above.
434+ */
435+void mnt_drop_write(struct vfsmount *mnt)
436+{
437+ __mnt_drop_write(mnt);
438+ sb_end_write(mnt->mnt_sb);
439+}
388440 EXPORT_SYMBOL_GPL(mnt_drop_write);
389441
442+void __mnt_drop_write_file(struct file *file)
443+{
444+ __mnt_drop_write(file->f_path.mnt);
445+}
446+
390447 void mnt_drop_write_file(struct file *file)
391448 {
392449 mnt_drop_write(file->f_path.mnt);
fs/nfsd/nfs4recover.c+5−4
@@ -154,6 +154,10 @@ nfsd4_create_clid_dir(struct nfs4_client *clp) · 153 unmodified lines
154154 if (status < 0)
155155 return;
156156
157+ status = mnt_want_write_file(rec_file);
158+ if (status)
159+ return;
160+
157161 dir = rec_file->f_path.dentry;
158162 /* lock the parent */
159163 mutex_lock(&dir->d_inode->i_mutex);
@@ -173,11 +177,7 @@ nfsd4_create_clid_dir(struct nfs4_client *clp) · 13 unmodified lines
173177 * as well be forgiving and just succeed silently.
174178 */
175179 goto out_put;
176− status = mnt_want_write_file(rec_file);
177− if (status)
178− goto out_put;
179180 status = vfs_mkdir(dir->d_inode, dentry, S_IRWXU);
180− mnt_drop_write_file(rec_file);
181181 out_put:
182182 dput(dentry);
183183 out_unlock:
@@ -189,6 +189,7 @@ out_unlock: · 5 unmodified lines
189189 " (err %d); please check that %s exists"
190190 " and is writeable", status,
191191 user_recovery_dirname);
192+ mnt_drop_write_file(rec_file);
192193 nfs4_reset_creds(original_cred);
193194 }
194195
fs/nfsd/nfsfh.c+1−0
@@ -635,6 +635,7 @@ fh_put(struct svc_fh *fhp) · 634 unmodified lines
635635 fhp->fh_post_saved = 0;
636636 #endif
637637 }
638+ fh_drop_write(fhp);
638639 if (exp) {
639640 exp_put(exp);
640641 fhp->fh_export = NULL;
fs/nfsd/nfsproc.c+8−1
@@ -196,6 +196,7 @@ nfsd_proc_create(struct svc_rqst *rqstp, struct nfsd_createargs *argp, · 195 unmodified lines
196196 struct dentry *dchild;
197197 int type, mode;
198198 __be32 nfserr;
199+ int hosterr;
199200 dev_t rdev = 0, wanted = new_decode_dev(attr->ia_size);
200201
201202 dprintk("nfsd: CREATE %s %.*s\n",
@@ -214,6 +215,12 @@ nfsd_proc_create(struct svc_rqst *rqstp, struct nfsd_createargs *argp, · 12 unmodified lines
214215 nfserr = nfserr_exist;
215216 if (isdotent(argp->name, argp->len))
216217 goto done;
218+ hosterr = fh_want_write(dirfhp);
219+ if (hosterr) {
220+ nfserr = nfserrno(hosterr);
221+ goto done;
222+ }
223+
217224 fh_lock_nested(dirfhp, I_MUTEX_PARENT);
218225 dchild = lookup_one_len(argp->name, dirfhp->fh_dentry, argp->len);
219226 if (IS_ERR(dchild)) {
@@ -330,7 +337,7 @@ nfsd_proc_create(struct svc_rqst *rqstp, struct nfsd_createargs *argp, · 110 unmodified lines
330337 out_unlock:
331338 /* We don't really need to unlock, as fh_put does it. */
332339 fh_unlock(dirfhp);
333−
340+ fh_drop_write(dirfhp);
334341 done:
335342 fh_put(dirfhp);
336343 return nfsd_return_dirop(nfserr, resp);
fs/nfsd/vfs.c+40−39
@@ -1284,6 +1284,10 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 1283 unmodified lines
12841284 * If it has, the parent directory should already be locked.
12851285 */
12861286 if (!resfhp->fh_dentry) {
1287+ host_err = fh_want_write(fhp);
1288+ if (host_err)
1289+ goto out_nfserr;
1290+
12871291 /* called from nfsd_proc_mkdir, or possibly nfsd3_proc_create */
12881292 fh_lock_nested(fhp, I_MUTEX_PARENT);
12891293 dchild = lookup_one_len(fname, dentry, flen);
@@ -1327,14 +1331,11 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 37 unmodified lines
13271331 goto out;
13281332 }
13291333
1330− host_err = fh_want_write(fhp);
1331− if (host_err)
1332− goto out_nfserr;
1333−
13341334 /*
13351335 * Get the dir op function pointer.
13361336 */
13371337 err = 0;
1338+ host_err = 0;
13381339 switch (type) {
13391340 case S_IFREG:
13401341 host_err = vfs_create(dirp, dchild, iap->ia_mode, true);
@@ -1351,10 +1352,8 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 10 unmodified lines
13511352 host_err = vfs_mknod(dirp, dchild, iap->ia_mode, rdev);
13521353 break;
13531354 }
1354− if (host_err < 0) {
1355− fh_drop_write(fhp);
1355+ if (host_err < 0)
13561356 goto out_nfserr;
1357− }
13581357
13591358 err = nfsd_create_setattr(rqstp, resfhp, iap);
13601359
@@ -1366,7 +1365,6 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 5 unmodified lines
13661365 err2 = nfserrno(commit_metadata(fhp));
13671366 if (err2)
13681367 err = err2;
1369− fh_drop_write(fhp);
13701368 /*
13711369 * Update the file handle to get the new inode info.
13721370 */
@@ -1425,6 +1423,11 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 52 unmodified lines
14251423 err = nfserr_notdir;
14261424 if (!dirp->i_op->lookup)
14271425 goto out;
1426+
1427+ host_err = fh_want_write(fhp);
1428+ if (host_err)
1429+ goto out_nfserr;
1430+
14281431 fh_lock_nested(fhp, I_MUTEX_PARENT);
14291432
14301433 /*
@@ -1457,9 +1460,6 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 26 unmodified lines
14571460 v_atime = verifier[1]&0x7fffffff;
14581461 }
14591462
1460− host_err = fh_want_write(fhp);
1461− if (host_err)
1462− goto out_nfserr;
14631463 if (dchild->d_inode) {
14641464 err = 0;
14651465
@@ -1530,7 +1530,6 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 64 unmodified lines
15301530 if (!err)
15311531 err = nfserrno(commit_metadata(fhp));
15321532
1533− fh_drop_write(fhp);
15341533 /*
15351534 * Update the filehandle to get the new inode info.
15361535 */
@@ -1541,6 +1540,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, · 4 unmodified lines
15411540 fh_unlock(fhp);
15421541 if (dchild && !IS_ERR(dchild))
15431542 dput(dchild);
1543+ fh_drop_write(fhp);
15441544 return err;
15451545
15461546 out_nfserr:
@@ -1621,6 +1621,11 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp, · 74 unmodified lines
16211621 err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
16221622 if (err)
16231623 goto out;
1624+
1625+ host_err = fh_want_write(fhp);
1626+ if (host_err)
1627+ goto out_nfserr;
1628+
16241629 fh_lock(fhp);
16251630 dentry = fhp->fh_dentry;
16261631 dnew = lookup_one_len(fname, dentry, flen);
@@ -1628,10 +1633,6 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp, · 1 unmodified line
16281633 if (IS_ERR(dnew))
16291634 goto out_nfserr;
16301635
1631− host_err = fh_want_write(fhp);
1632− if (host_err)
1633− goto out_nfserr;
1634−
16351636 if (unlikely(path[plen] != 0)) {
16361637 char *path_alloced = kmalloc(plen+1, GFP_KERNEL);
16371638 if (path_alloced == NULL)
@@ -1691,6 +1692,12 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp, · 53 unmodified lines
16911692 if (isdotent(name, len))
16921693 goto out;
16931694
1695+ host_err = fh_want_write(tfhp);
1696+ if (host_err) {
1697+ err = nfserrno(host_err);
1698+ goto out;
1699+ }
1700+
16941701 fh_lock_nested(ffhp, I_MUTEX_PARENT);
16951702 ddir = ffhp->fh_dentry;
16961703 dirp = ddir->d_inode;
@@ -1702,18 +1709,13 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp, · 5 unmodified lines
17021709
17031710 dold = tfhp->fh_dentry;
17041711
1705− host_err = fh_want_write(tfhp);
1706− if (host_err) {
1707− err = nfserrno(host_err);
1708− goto out_dput;
1709− }
17101712 err = nfserr_noent;
17111713 if (!dold->d_inode)
1712− goto out_drop_write;
1714+ goto out_dput;
17131715 host_err = nfsd_break_lease(dold->d_inode);
17141716 if (host_err) {
17151717 err = nfserrno(host_err);
1716− goto out_drop_write;
1718+ goto out_dput;
17171719 }
17181720 host_err = vfs_link(dold, dirp, dnew);
17191721 if (!host_err) {
@@ -1726,12 +1728,11 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp, · 6 unmodified lines
17261728 else
17271729 err = nfserrno(host_err);
17281730 }
1729−out_drop_write:
1730− fh_drop_write(tfhp);
17311731 out_dput:
17321732 dput(dnew);
17331733 out_unlock:
17341734 fh_unlock(ffhp);
1735+ fh_drop_write(tfhp);
17351736 out:
17361737 return err;
17371738
@@ -1774,6 +1775,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, · 36 unmodified lines
17741775 if (!flen || isdotent(fname, flen) || !tlen || isdotent(tname, tlen))
17751776 goto out;
17761777
1778+ host_err = fh_want_write(ffhp);
1779+ if (host_err) {
1780+ err = nfserrno(host_err);
1781+ goto out;
1782+ }
1783+
17771784 /* cannot use fh_lock as we need deadlock protective ordering
17781785 * so do it by hand */
17791786 trap = lock_rename(tdentry, fdentry);
@@ -1804,17 +1811,14 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, · 24 unmodified lines
18041811 host_err = -EXDEV;
18051812 if (ffhp->fh_export->ex_path.mnt != tfhp->fh_export->ex_path.mnt)
18061813 goto out_dput_new;
1807− host_err = fh_want_write(ffhp);
1808− if (host_err)
1809− goto out_dput_new;
18101814
18111815 host_err = nfsd_break_lease(odentry->d_inode);
18121816 if (host_err)
1813− goto out_drop_write;
1817+ goto out_dput_new;
18141818 if (ndentry->d_inode) {
18151819 host_err = nfsd_break_lease(ndentry->d_inode);
18161820 if (host_err)
1817− goto out_drop_write;
1821+ goto out_dput_new;
18181822 }
18191823 host_err = vfs_rename(fdir, odentry, tdir, ndentry);
18201824 if (!host_err) {
@@ -1822,8 +1826,6 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, · 1 unmodified line
18221826 if (!host_err)
18231827 host_err = commit_metadata(ffhp);
18241828 }
1825−out_drop_write:
1826− fh_drop_write(ffhp);
18271829 out_dput_new:
18281830 dput(ndentry);
18291831 out_dput_old:
@@ -1839,6 +1841,7 @@ out_drop_write: · 9 unmodified lines
18391841 fill_post_wcc(tfhp);
18401842 unlock_rename(tdentry, fdentry);
18411843 ffhp->fh_locked = tfhp->fh_locked = 0;
1844+ fh_drop_write(ffhp);
18421845
18431846 out:
18441847 return err;
@@ -1864,6 +1867,10 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, · 19 unmodified lines
18641867 if (err)
18651868 goto out;
18661869
1870+ host_err = fh_want_write(fhp);
1871+ if (host_err)
1872+ goto out_nfserr;
1873+
18671874 fh_lock_nested(fhp, I_MUTEX_PARENT);
18681875 dentry = fhp->fh_dentry;
18691876 dirp = dentry->d_inode;
@@ -1882,21 +1889,15 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, · 12 unmodified lines
18821889 if (!type)
18831890 type = rdentry->d_inode->i_mode & S_IFMT;
18841891
1885− host_err = fh_want_write(fhp);
1886− if (host_err)
1887− goto out_put;
1888−
18891892 host_err = nfsd_break_lease(rdentry->d_inode);
18901893 if (host_err)
1891− goto out_drop_write;
1894+ goto out_put;
18921895 if (type != S_IFDIR)
18931896 host_err = vfs_unlink(dirp, rdentry);
18941897 else
18951898 host_err = vfs_rmdir(dirp, rdentry);
18961899 if (!host_err)
18971900 host_err = commit_metadata(fhp);
1898−out_drop_write:
1899− fh_drop_write(fhp);
19001901 out_put:
19011902 dput(rdentry);
19021903
fs/nfsd/vfs.h+9−2
@@ -110,12 +110,19 @@ int nfsd_set_posix_acl(struct svc_fh *, int, struct posix_acl *); · 109 unmodified lines
110110
111111 static inline int fh_want_write(struct svc_fh *fh)
112112 {
113− return mnt_want_write(fh->fh_export->ex_path.mnt);
113+ int ret = mnt_want_write(fh->fh_export->ex_path.mnt);
114+
115+ if (!ret)
116+ fh->fh_want_write = 1;
117+ return ret;
114118 }
115119
116120 static inline void fh_drop_write(struct svc_fh *fh)
117121 {
118− mnt_drop_write(fh->fh_export->ex_path.mnt);
122+ if (fh->fh_want_write) {
123+ fh->fh_want_write = 0;
124+ mnt_drop_write(fh->fh_export->ex_path.mnt);
125+ }
119126 }
120127
121128 #endif /* LINUX_NFSD_VFS_H */
fs/nilfs2/file.c+11−7
@@ -69,16 +69,18 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 68 unmodified lines
6969 struct page *page = vmf->page;
7070 struct inode *inode = vma->vm_file->f_dentry->d_inode;
7171 struct nilfs_transaction_info ti;
72− int ret;
72+ int ret = 0;
7373
7474 if (unlikely(nilfs_near_disk_full(inode->i_sb->s_fs_info)))
7575 return VM_FAULT_SIGBUS; /* -ENOSPC */
7676
77+ sb_start_pagefault(inode->i_sb);
7778 lock_page(page);
7879 if (page->mapping != inode->i_mapping ||
7980 page_offset(page) >= i_size_read(inode) || !PageUptodate(page)) {
8081 unlock_page(page);
81− return VM_FAULT_NOPAGE; /* make the VM retry the fault */
82+ ret = -EFAULT; /* make the VM retry the fault */
83+ goto out;
8284 }
8385
8486 /*
@@ -112,19 +114,21 @@ static int nilfs_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 27 unmodified lines
112114 ret = nilfs_transaction_begin(inode->i_sb, &ti, 1);
113115 /* never returns -ENOMEM, but may return -ENOSPC */
114116 if (unlikely(ret))
115− return VM_FAULT_SIGBUS;
117+ goto out;
116118
117− ret = block_page_mkwrite(vma, vmf, nilfs_get_block);
118− if (ret != VM_FAULT_LOCKED) {
119+ ret = __block_page_mkwrite(vma, vmf, nilfs_get_block);
120+ if (ret) {
119121 nilfs_transaction_abort(inode->i_sb);
120− return ret;
122+ goto out;
121123 }
122124 nilfs_set_file_dirty(inode, 1 << (PAGE_SHIFT - inode->i_blkbits));
123125 nilfs_transaction_commit(inode->i_sb);
124126
125127 mapped:
126128 wait_on_page_writeback(page);
127− return VM_FAULT_LOCKED;
129+ out:
130+ sb_end_pagefault(inode->i_sb);
131+ return block_page_mkwrite_return(ret);
128132 }
129133
130134 static const struct vm_operations_struct nilfs_file_vm_ops = {
fs/nilfs2/ioctl.c+0−2
@@ -660,8 +660,6 @@ static int nilfs_ioctl_clean_segments(struct inode *inode, struct file *filp, · 659 unmodified lines
660660 goto out_free;
661661 }
662662
663− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
664−
665663 ret = nilfs_ioctl_move_blocks(inode->i_sb, &argv[0], kbufs[0]);
666664 if (ret < 0)
667665 printk(KERN_ERR "NILFS: GC failed during preparation: "
fs/nilfs2/segment.c+4−1
@@ -189,7 +189,7 @@ int nilfs_transaction_begin(struct super_block *sb, · 188 unmodified lines
189189 if (ret > 0)
190190 return 0;
191191
192− vfs_check_frozen(sb, SB_FREEZE_WRITE);
192+ sb_start_intwrite(sb);
193193
194194 nilfs = sb->s_fs_info;
195195 down_read(&nilfs->ns_segctor_sem);
@@ -205,6 +205,7 @@ int nilfs_transaction_begin(struct super_block *sb, · 9 unmodified lines
205205 current->journal_info = ti->ti_save;
206206 if (ti->ti_flags & NILFS_TI_DYNAMIC_ALLOC)
207207 kmem_cache_free(nilfs_transaction_cachep, ti);
208+ sb_end_intwrite(sb);
208209 return ret;
209210 }
210211
@@ -246,6 +247,7 @@ int nilfs_transaction_commit(struct super_block *sb) · 35 unmodified lines
246247 err = nilfs_construct_segment(sb);
247248 if (ti->ti_flags & NILFS_TI_DYNAMIC_ALLOC)
248249 kmem_cache_free(nilfs_transaction_cachep, ti);
250+ sb_end_intwrite(sb);
249251 return err;
250252 }
251253
@@ -264,6 +266,7 @@ void nilfs_transaction_abort(struct super_block *sb) · 12 unmodified lines
264266 current->journal_info = ti->ti_save;
265267 if (ti->ti_flags & NILFS_TI_DYNAMIC_ALLOC)
266268 kmem_cache_free(nilfs_transaction_cachep, ti);
269+ sb_end_intwrite(sb);
267270 }
268271
269272 void nilfs_relax_pressure_in_lock(struct super_block *sb)
fs/ntfs/file.c+2−1
@@ -2084,7 +2084,6 @@ static ssize_t ntfs_file_aio_write_nolock(struct kiocb *iocb, · 2083 unmodified lines
20842084 if (err)
20852085 return err;
20862086 pos = *ppos;
2087− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
20882087 /* We can write back this queue in page reclaim. */
20892088 current->backing_dev_info = mapping->backing_dev_info;
20902089 written = 0;
@@ -2119,6 +2118,7 @@ static ssize_t ntfs_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 28 unmodified lines
21192118
21202119 BUG_ON(iocb->ki_pos != pos);
21212120
2121+ sb_start_write(inode->i_sb);
21222122 mutex_lock(&inode->i_mutex);
21232123 ret = ntfs_file_aio_write_nolock(iocb, iov, nr_segs, &iocb->ki_pos);
21242124 mutex_unlock(&inode->i_mutex);
@@ -2127,6 +2127,7 @@ static ssize_t ntfs_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 2 unmodified lines
21272127 if (err < 0)
21282128 ret = err;
21292129 }
2130+ sb_end_write(inode->i_sb);
21302131 return ret;
21312132 }
21322133
fs/ocfs2/file.c+9−2
@@ -1971,6 +1971,7 @@ int ocfs2_change_file_space(struct file *file, unsigned int cmd, · 1970 unmodified lines
19711971 {
19721972 struct inode *inode = file->f_path.dentry->d_inode;
19731973 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
1974+ int ret;
19741975
19751976 if ((cmd == OCFS2_IOC_RESVSP || cmd == OCFS2_IOC_RESVSP64) &&
19761977 !ocfs2_writes_unwritten_extents(osb))
@@ -1985,7 +1986,12 @@ int ocfs2_change_file_space(struct file *file, unsigned int cmd, · 8 unmodified lines
19851986 if (!(file->f_mode & FMODE_WRITE))
19861987 return -EBADF;
19871988
1988− return __ocfs2_change_file_space(file, inode, file->f_pos, cmd, sr, 0);
1989+ ret = mnt_want_write_file(file);
1990+ if (ret)
1991+ return ret;
1992+ ret = __ocfs2_change_file_space(file, inode, file->f_pos, cmd, sr, 0);
1993+ mnt_drop_write_file(file);
1994+ return ret;
19891995 }
19901996
19911997 static long ocfs2_fallocate(struct file *file, int mode, loff_t offset,
@@ -2261,7 +2267,7 @@ static ssize_t ocfs2_file_aio_write(struct kiocb *iocb, · 269 unmodified lines
22612267 if (iocb->ki_left == 0)
22622268 return 0;
22632269
2264− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
2270+ sb_start_write(inode->i_sb);
22652271
22662272 appending = file->f_flags & O_APPEND ? 1 : 0;
22672273 direct_io = file->f_flags & O_DIRECT ? 1 : 0;
@@ -2436,6 +2442,7 @@ out_sems: · 168 unmodified lines
24362442 ocfs2_iocb_clear_sem_locked(iocb);
24372443
24382444 mutex_unlock(&inode->i_mutex);
2445+ sb_end_write(inode->i_sb);
24392446
24402447 if (written)
24412448 ret = written;
fs/ocfs2/ioctl.c+12−2
@@ -928,7 +928,12 @@ long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) · 927 unmodified lines
928928 if (get_user(new_clusters, (int __user *)arg))
929929 return -EFAULT;
930930
931− return ocfs2_group_extend(inode, new_clusters);
931+ status = mnt_want_write_file(filp);
932+ if (status)
933+ return status;
934+ status = ocfs2_group_extend(inode, new_clusters);
935+ mnt_drop_write_file(filp);
936+ return status;
932937 case OCFS2_IOC_GROUP_ADD:
933938 case OCFS2_IOC_GROUP_ADD64:
934939 if (!capable(CAP_SYS_RESOURCE))
@@ -937,7 +942,12 @@ long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) · 2 unmodified lines
937942 if (copy_from_user(&input, (int __user *) arg, sizeof(input)))
938943 return -EFAULT;
939944
940− return ocfs2_group_add(inode, &input);
945+ status = mnt_want_write_file(filp);
946+ if (status)
947+ return status;
948+ status = ocfs2_group_add(inode, &input);
949+ mnt_drop_write_file(filp);
950+ return status;
941951 case OCFS2_IOC_REFLINK:
942952 if (copy_from_user(&args, argp, sizeof(args)))
943953 return -EFAULT;
fs/ocfs2/journal.c+6−1
@@ -355,11 +355,14 @@ handle_t *ocfs2_start_trans(struct ocfs2_super *osb, int max_buffs) · 354 unmodified lines
355355 if (journal_current_handle())
356356 return jbd2_journal_start(journal, max_buffs);
357357
358+ sb_start_intwrite(osb->sb);
359+
358360 down_read(&osb->journal->j_trans_barrier);
359361
360362 handle = jbd2_journal_start(journal, max_buffs);
361363 if (IS_ERR(handle)) {
362364 up_read(&osb->journal->j_trans_barrier);
365+ sb_end_intwrite(osb->sb);
363366
364367 mlog_errno(PTR_ERR(handle));
365368
@@ -388,8 +391,10 @@ int ocfs2_commit_trans(struct ocfs2_super *osb, · 22 unmodified lines
388391 if (ret < 0)
389392 mlog_errno(ret);
390393
391− if (!nested)
394+ if (!nested) {
392395 up_read(&journal->j_trans_barrier);
396+ sb_end_intwrite(osb->sb);
397+ }
393398
394399 return ret;
395400 }
fs/ocfs2/mmap.c+2−0
@@ -136,6 +136,7 @@ static int ocfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 135 unmodified lines
136136 sigset_t oldset;
137137 int ret;
138138
139+ sb_start_pagefault(inode->i_sb);
139140 ocfs2_block_signals(&oldset);
140141
141142 /*
@@ -165,6 +166,7 @@ static int ocfs2_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 23 unmodified lines
165166
166167 out:
167168 ocfs2_unblock_signals(&oldset);
169+ sb_end_pagefault(inode->i_sb);
168170 return ret;
169171 }
170172
fs/ocfs2/refcounttree.c+1−10
@@ -4466,20 +4466,11 @@ int ocfs2_reflink_ioctl(struct inode *inode, · 4465 unmodified lines
44664466 goto out_dput;
44674467 }
44684468
4469− error = mnt_want_write(new_path.mnt);
4470− if (error) {
4471− mlog_errno(error);
4472− goto out_dput;
4473− }
4474−
44754469 error = ocfs2_vfs_reflink(old_path.dentry,
44764470 new_path.dentry->d_inode,
44774471 new_dentry, preserve);
4478− mnt_drop_write(new_path.mnt);
44794472 out_dput:
4480− dput(new_dentry);
4481− mutex_unlock(&new_path.dentry->d_inode->i_mutex);
4482− path_put(&new_path);
4473+ done_path_create(&new_path, new_dentry);
44834474 out:
44844475 path_put(&old_path);
44854476
fs/open.c+9−6
@@ -164,11 +164,13 @@ static long do_sys_ftruncate(unsigned int fd, loff_t length, int small) · 163 unmodified lines
164164 if (IS_APPEND(inode))
165165 goto out_putf;
166166
167+ sb_start_write(inode->i_sb);
167168 error = locks_verify_truncate(inode, file, length);
168169 if (!error)
169170 error = security_path_truncate(&file->f_path);
170171 if (!error)
171172 error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file);
173+ sb_end_write(inode->i_sb);
172174 out_putf:
173175 fput(file);
174176 out:
@@ -266,7 +268,10 @@ int do_fallocate(struct file *file, int mode, loff_t offset, loff_t len) · 91 unmodified lines
266268 if (!file->f_op->fallocate)
267269 return -EOPNOTSUPP;
268270
269− return file->f_op->fallocate(file, mode, offset, len);
271+ sb_start_write(inode->i_sb);
272+ ret = file->f_op->fallocate(file, mode, offset, len);
273+ sb_end_write(inode->i_sb);
274+ return ret;
270275 }
271276
272277 SYSCALL_DEFINE(fallocate)(int fd, int mode, loff_t offset, loff_t len)
@@ -620,7 +625,7 @@ static inline int __get_file_write_access(struct inode *inode, · 347 unmodified lines
620625 /*
621626 * Balanced in __fput()
622627 */
623− error = mnt_want_write(mnt);
628+ error = __mnt_want_write(mnt);
624629 if (error)
625630 put_write_access(inode);
626631 }
@@ -654,6 +659,7 @@ static int do_dentry_open(struct file *f, · 27 unmodified lines
654659 if (unlikely(f->f_flags & O_PATH))
655660 f->f_mode = FMODE_PATH;
656661
662+ path_get(&f->f_path);
657663 inode = f->f_path.dentry->d_inode;
658664 if (f->f_mode & FMODE_WRITE) {
659665 error = __get_file_write_access(inode, f->f_path.mnt);
@@ -739,9 +745,7 @@ int finish_open(struct file *file, struct dentry *dentry, · 79 unmodified lines
739745 int error;
740746 BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
741747
742− mntget(file->f_path.mnt);
743− file->f_path.dentry = dget(dentry);
744−
748+ file->f_path.dentry = dentry;
745749 error = do_dentry_open(file, open, current_cred());
746750 if (!error)
747751 *opened |= FILE_OPENED;
@@ -784,7 +788,6 @@ struct file *dentry_open(const struct path *path, int flags, · 36 unmodified lines
784788
785789 f->f_flags = flags;
786790 f->f_path = *path;
787− path_get(&f->f_path);
788791 error = do_dentry_open(f, NULL, cred);
789792 if (!error) {
790793 error = open_check_o_direct(f);
fs/pipe.c+26−49
@@ -1016,18 +1016,16 @@ fail_inode: · 1015 unmodified lines
10161016 return NULL;
10171017 }
10181018
1019−struct file *create_write_pipe(int flags)
1019+int create_pipe_files(struct file **res, int flags)
10201020 {
10211021 int err;
1022− struct inode *inode;
1022+ struct inode *inode = get_pipe_inode();
10231023 struct file *f;
10241024 struct path path;
1025− struct qstr name = { .name = "" };
1025+ static struct qstr name = { .name = "" };
10261026
1027− err = -ENFILE;
1028− inode = get_pipe_inode();
10291027 if (!inode)
1030− goto err;
1028+ return -ENFILE;
10311029
10321030 err = -ENOMEM;
10331031 path.dentry = d_alloc_pseudo(pipe_mnt->mnt_sb, &name);
@@ -1041,62 +1039,43 @@ struct file *create_write_pipe(int flags) · 7 unmodified lines
10411039 f = alloc_file(&path, FMODE_WRITE, &write_pipefifo_fops);
10421040 if (!f)
10431041 goto err_dentry;
1044− f->f_mapping = inode->i_mapping;
10451042
10461043 f->f_flags = O_WRONLY | (flags & (O_NONBLOCK | O_DIRECT));
1047− f->f_version = 0;
10481044
1049− return f;
1045+ res[0] = alloc_file(&path, FMODE_READ, &read_pipefifo_fops);
1046+ if (!res[0])
1047+ goto err_file;
1048+
1049+ path_get(&path);
1050+ res[0]->f_flags = O_RDONLY | (flags & O_NONBLOCK);
1051+ res[1] = f;
1052+ return 0;
10501053
1051− err_dentry:
1054+err_file:
1055+ put_filp(f);
1056+err_dentry:
10521057 free_pipe_info(inode);
10531058 path_put(&path);
1054− return ERR_PTR(err);
1059+ return err;
10551060
1056− err_inode:
1061+err_inode:
10571062 free_pipe_info(inode);
10581063 iput(inode);
1059− err:
1060− return ERR_PTR(err);
1061−}
1062−
1063−void free_write_pipe(struct file *f)
1064−{
1065− free_pipe_info(f->f_dentry->d_inode);
1066− path_put(&f->f_path);
1067− put_filp(f);
1068−}
1069−
1070−struct file *create_read_pipe(struct file *wrf, int flags)
1071−{
1072− /* Grab pipe from the writer */
1073− struct file *f = alloc_file(&wrf->f_path, FMODE_READ,
1074− &read_pipefifo_fops);
1075− if (!f)
1076− return ERR_PTR(-ENFILE);
1077−
1078− path_get(&wrf->f_path);
1079− f->f_flags = O_RDONLY | (flags & O_NONBLOCK);
1080−
1081− return f;
1064+ return err;
10821065 }
10831066
10841067 int do_pipe_flags(int *fd, int flags)
10851068 {
1086− struct file *fw, *fr;
1069+ struct file *files[2];
10871070 int error;
10881071 int fdw, fdr;
10891072
10901073 if (flags & ~(O_CLOEXEC | O_NONBLOCK | O_DIRECT))
10911074 return -EINVAL;
10921075
1093− fw = create_write_pipe(flags);
1094− if (IS_ERR(fw))
1095− return PTR_ERR(fw);
1096− fr = create_read_pipe(fw, flags);
1097− error = PTR_ERR(fr);
1098− if (IS_ERR(fr))
1099− goto err_write_pipe;
1076+ error = create_pipe_files(files, flags);
1077+ if (error)
1078+ return error;
11001079
11011080 error = get_unused_fd_flags(flags);
11021081 if (error < 0)
@@ -1109,8 +1088,8 @@ int do_pipe_flags(int *fd, int flags) · 6 unmodified lines
11091088 fdw = error;
11101089
11111090 audit_fd_pair(fdr, fdw);
1112− fd_install(fdr, fr);
1113− fd_install(fdw, fw);
1091+ fd_install(fdr, files[0]);
1092+ fd_install(fdw, files[1]);
11141093 fd[0] = fdr;
11151094 fd[1] = fdw;
11161095
@@ -1119,10 +1098,8 @@ int do_pipe_flags(int *fd, int flags) · 2 unmodified lines
11191098 err_fdr:
11201099 put_unused_fd(fdr);
11211100 err_read_pipe:
1122− path_put(&fr->f_path);
1123− put_filp(fr);
1124− err_write_pipe:
1125− free_write_pipe(fw);
1101+ fput(files[0]);
1102+ fput(files[1]);
11261103 return error;
11271104 }
11281105
fs/splice.c+3−0
@@ -996,6 +996,8 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out, · 995 unmodified lines
996996 };
997997 ssize_t ret;
998998
999+ sb_start_write(inode->i_sb);
1000+
9991001 pipe_lock(pipe);
10001002
10011003 splice_from_pipe_begin(&sd);
@@ -1034,6 +1036,7 @@ generic_file_splice_write(struct pipe_inode_info *pipe, struct file *out, · 32 unmodified lines
10341036 *ppos += ret;
10351037 balance_dirty_pages_ratelimited_nr(mapping, nr_pages);
10361038 }
1039+ sb_end_write(inode->i_sb);
10371040
10381041 return ret;
10391042 }
fs/super.c+230−22
@@ -33,12 +33,19 @@ · 32 unmodified lines
3333 #include <linux/rculist_bl.h>
3434 #include <linux/cleancache.h>
3535 #include <linux/fsnotify.h>
36+#include <linux/lockdep.h>
3637 #include "internal.h"
3738
3839
3940 LIST_HEAD(super_blocks);
4041 DEFINE_SPINLOCK(sb_lock);
4142
43+static char *sb_writers_name[SB_FREEZE_LEVELS] = {
44+ "sb_writers",
45+ "sb_pagefaults",
46+ "sb_internal",
47+};
48+
4249 /*
4350 * One thing we have to be careful of with a per-sb shrinker is that we don't
4451 * drop the last active reference to the superblock from within the shrinker.
@@ -102,6 +109,35 @@ static int prune_super(struct shrinker *shrink, struct shrink_control *sc) · 57 unmodified lines
102109 return total_objects;
103110 }
104111
112+static int init_sb_writers(struct super_block *s, struct file_system_type *type)
113+{
114+ int err;
115+ int i;
116+
117+ for (i = 0; i < SB_FREEZE_LEVELS; i++) {
118+ err = percpu_counter_init(&s->s_writers.counter[i], 0);
119+ if (err < 0)
120+ goto err_out;
121+ lockdep_init_map(&s->s_writers.lock_map[i], sb_writers_name[i],
122+ &type->s_writers_key[i], 0);
123+ }
124+ init_waitqueue_head(&s->s_writers.wait);
125+ init_waitqueue_head(&s->s_writers.wait_unfrozen);
126+ return 0;
127+err_out:
128+ while (--i >= 0)
129+ percpu_counter_destroy(&s->s_writers.counter[i]);
130+ return err;
131+}
132+
133+static void destroy_sb_writers(struct super_block *s)
134+{
135+ int i;
136+
137+ for (i = 0; i < SB_FREEZE_LEVELS; i++)
138+ percpu_counter_destroy(&s->s_writers.counter[i]);
139+}
140+
105141 /**
106142 * alloc_super - create new superblock
107143 * @type: filesystem type superblock should belong to
@@ -117,18 +153,19 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags) · 9 unmodified lines
117153
118154 if (s) {
119155 if (security_sb_alloc(s)) {
156+ /*
157+ * We cannot call security_sb_free() without
158+ * security_sb_alloc() succeeding. So bail out manually
159+ */
120160 kfree(s);
121161 s = NULL;
122162 goto out;
123163 }
124164 #ifdef CONFIG_SMP
125165 s->s_files = alloc_percpu(struct list_head);
126− if (!s->s_files) {
127− security_sb_free(s);
128− kfree(s);
129− s = NULL;
130− goto out;
131− } else {
166+ if (!s->s_files)
167+ goto err_out;
168+ else {
132169 int i;
133170
134171 for_each_possible_cpu(i)
@@ -137,6 +174,8 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags) · 2 unmodified lines
137174 #else
138175 INIT_LIST_HEAD(&s->s_files);
139176 #endif
177+ if (init_sb_writers(s, type))
178+ goto err_out;
140179 s->s_flags = flags;
141180 s->s_bdi = &default_backing_dev_info;
142181 INIT_HLIST_NODE(&s->s_instances);
@@ -178,7 +217,6 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags) · 35 unmodified lines
178217 mutex_init(&s->s_dquot.dqio_mutex);
179218 mutex_init(&s->s_dquot.dqonoff_mutex);
180219 init_rwsem(&s->s_dquot.dqptr_sem);
181− init_waitqueue_head(&s->s_wait_unfrozen);
182220 s->s_maxbytes = MAX_NON_LFS;
183221 s->s_op = &default_op;
184222 s->s_time_gran = 1000000000;
@@ -190,6 +228,16 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags) · 5 unmodified lines
190228 }
191229 out:
192230 return s;
231+err_out:
232+ security_sb_free(s);
233+#ifdef CONFIG_SMP
234+ if (s->s_files)
235+ free_percpu(s->s_files);
236+#endif
237+ destroy_sb_writers(s);
238+ kfree(s);
239+ s = NULL;
240+ goto out;
193241 }
194242
195243 /**
@@ -203,6 +251,7 @@ static inline void destroy_super(struct super_block *s) · 7 unmodified lines
203251 #ifdef CONFIG_SMP
204252 free_percpu(s->s_files);
205253 #endif
254+ destroy_sb_writers(s);
206255 security_sb_free(s);
207256 WARN_ON(!list_empty(&s->s_mounts));
208257 kfree(s->s_subtype);
@@ -651,10 +700,11 @@ struct super_block *get_super_thawed(struct block_device *bdev) · 442 unmodified lines
651700 {
652701 while (1) {
653702 struct super_block *s = get_super(bdev);
654− if (!s || s->s_frozen == SB_UNFROZEN)
703+ if (!s || s->s_writers.frozen == SB_UNFROZEN)
655704 return s;
656705 up_read(&s->s_umount);
657− vfs_check_frozen(s, SB_FREEZE_WRITE);
706+ wait_event(s->s_writers.wait_unfrozen,
707+ s->s_writers.frozen == SB_UNFROZEN);
658708 put_super(s);
659709 }
660710 }
@@ -732,7 +782,7 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force) · 71 unmodified lines
732782 int retval;
733783 int remount_ro;
734784
735− if (sb->s_frozen != SB_UNFROZEN)
785+ if (sb->s_writers.frozen != SB_UNFROZEN)
736786 return -EBUSY;
737787
738788 #ifdef CONFIG_BLOCK
@@ -1163,6 +1213,120 @@ out: · 424 unmodified lines
11631213 return ERR_PTR(error);
11641214 }
11651215
1216+/*
1217+ * This is an internal function, please use sb_end_{write,pagefault,intwrite}
1218+ * instead.
1219+ */
1220+void __sb_end_write(struct super_block *sb, int level)
1221+{
1222+ percpu_counter_dec(&sb->s_writers.counter[level-1]);
1223+ /*
1224+ * Make sure s_writers are updated before we wake up waiters in
1225+ * freeze_super().
1226+ */
1227+ smp_mb();
1228+ if (waitqueue_active(&sb->s_writers.wait))
1229+ wake_up(&sb->s_writers.wait);
1230+ rwsem_release(&sb->s_writers.lock_map[level-1], 1, _RET_IP_);
1231+}
1232+EXPORT_SYMBOL(__sb_end_write);
1233+
1234+#ifdef CONFIG_LOCKDEP
1235+/*
1236+ * We want lockdep to tell us about possible deadlocks with freezing but
1237+ * it's it bit tricky to properly instrument it. Getting a freeze protection
1238+ * works as getting a read lock but there are subtle problems. XFS for example
1239+ * gets freeze protection on internal level twice in some cases, which is OK
1240+ * only because we already hold a freeze protection also on higher level. Due
1241+ * to these cases we have to tell lockdep we are doing trylock when we
1242+ * already hold a freeze protection for a higher freeze level.
1243+ */
1244+static void acquire_freeze_lock(struct super_block *sb, int level, bool trylock,
1245+ unsigned long ip)
1246+{
1247+ int i;
1248+
1249+ if (!trylock) {
1250+ for (i = 0; i < level - 1; i++)
1251+ if (lock_is_held(&sb->s_writers.lock_map[i])) {
1252+ trylock = true;
1253+ break;
1254+ }
1255+ }
1256+ rwsem_acquire_read(&sb->s_writers.lock_map[level-1], 0, trylock, ip);
1257+}
1258+#endif
1259+
1260+/*
1261+ * This is an internal function, please use sb_start_{write,pagefault,intwrite}
1262+ * instead.
1263+ */
1264+int __sb_start_write(struct super_block *sb, int level, bool wait)
1265+{
1266+retry:
1267+ if (unlikely(sb->s_writers.frozen >= level)) {
1268+ if (!wait)
1269+ return 0;
1270+ wait_event(sb->s_writers.wait_unfrozen,
1271+ sb->s_writers.frozen < level);
1272+ }
1273+
1274+#ifdef CONFIG_LOCKDEP
1275+ acquire_freeze_lock(sb, level, !wait, _RET_IP_);
1276+#endif
1277+ percpu_counter_inc(&sb->s_writers.counter[level-1]);
1278+ /*
1279+ * Make sure counter is updated before we check for frozen.
1280+ * freeze_super() first sets frozen and then checks the counter.
1281+ */
1282+ smp_mb();
1283+ if (unlikely(sb->s_writers.frozen >= level)) {
1284+ __sb_end_write(sb, level);
1285+ goto retry;
1286+ }
1287+ return 1;
1288+}
1289+EXPORT_SYMBOL(__sb_start_write);
1290+
1291+/**
1292+ * sb_wait_write - wait until all writers to given file system finish
1293+ * @sb: the super for which we wait
1294+ * @level: type of writers we wait for (normal vs page fault)
1295+ *
1296+ * This function waits until there are no writers of given type to given file
1297+ * system. Caller of this function should make sure there can be no new writers
1298+ * of type @level before calling this function. Otherwise this function can
1299+ * livelock.
1300+ */
1301+static void sb_wait_write(struct super_block *sb, int level)
1302+{
1303+ s64 writers;
1304+
1305+ /*
1306+ * We just cycle-through lockdep here so that it does not complain
1307+ * about returning with lock to userspace
1308+ */
1309+ rwsem_acquire(&sb->s_writers.lock_map[level-1], 0, 0, _THIS_IP_);
1310+ rwsem_release(&sb->s_writers.lock_map[level-1], 1, _THIS_IP_);
1311+
1312+ do {
1313+ DEFINE_WAIT(wait);
1314+
1315+ /*
1316+ * We use a barrier in prepare_to_wait() to separate setting
1317+ * of frozen and checking of the counter
1318+ */
1319+ prepare_to_wait(&sb->s_writers.wait, &wait,
1320+ TASK_UNINTERRUPTIBLE);
1321+
1322+ writers = percpu_counter_sum(&sb->s_writers.counter[level-1]);
1323+ if (writers)
1324+ schedule();
1325+
1326+ finish_wait(&sb->s_writers.wait, &wait);
1327+ } while (writers);
1328+}
1329+
11661330 /**
11671331 * freeze_super - lock the filesystem and force it into a consistent state
11681332 * @sb: the super to lock
@@ -1170,6 +1334,31 @@ out: · 1 unmodified line
11701334 * Syncs the super to make sure the filesystem is consistent and calls the fs's
11711335 * freeze_fs. Subsequent calls to this without first thawing the fs will return
11721336 * -EBUSY.
1337+ *
1338+ * During this function, sb->s_writers.frozen goes through these values:
1339+ *
1340+ * SB_UNFROZEN: File system is normal, all writes progress as usual.
1341+ *
1342+ * SB_FREEZE_WRITE: The file system is in the process of being frozen. New
1343+ * writes should be blocked, though page faults are still allowed. We wait for
1344+ * all writes to complete and then proceed to the next stage.
1345+ *
1346+ * SB_FREEZE_PAGEFAULT: Freezing continues. Now also page faults are blocked
1347+ * but internal fs threads can still modify the filesystem (although they
1348+ * should not dirty new pages or inodes), writeback can run etc. After waiting
1349+ * for all running page faults we sync the filesystem which will clean all
1350+ * dirty pages and inodes (no new dirty pages or inodes can be created when
1351+ * sync is running).
1352+ *
1353+ * SB_FREEZE_FS: The file system is frozen. Now all internal sources of fs
1354+ * modification are blocked (e.g. XFS preallocation truncation on inode
1355+ * reclaim). This is usually implemented by blocking new transactions for
1356+ * filesystems that have them and need this additional guard. After all
1357+ * internal writers are finished we call ->freeze_fs() to finish filesystem
1358+ * freezing. Then we transition to SB_FREEZE_COMPLETE state. This state is
1359+ * mostly auxiliary for filesystems to verify they do not modify frozen fs.
1360+ *
1361+ * sb->s_writers.frozen is protected by sb->s_umount.
11731362 */
11741363 int freeze_super(struct super_block *sb)
11751364 {
@@ -1177,7 +1366,7 @@ int freeze_super(struct super_block *sb) · 1 unmodified line
11771366
11781367 atomic_inc(&sb->s_active);
11791368 down_write(&sb->s_umount);
1180− if (sb->s_frozen) {
1369+ if (sb->s_writers.frozen != SB_UNFROZEN) {
11811370 deactivate_locked_super(sb);
11821371 return -EBUSY;
11831372 }
@@ -1188,33 +1377,53 @@ int freeze_super(struct super_block *sb) · 4 unmodified lines
11881377 }
11891378
11901379 if (sb->s_flags & MS_RDONLY) {
1191− sb->s_frozen = SB_FREEZE_TRANS;
1192− smp_wmb();
1380+ /* Nothing to do really... */
1381+ sb->s_writers.frozen = SB_FREEZE_COMPLETE;
11931382 up_write(&sb->s_umount);
11941383 return 0;
11951384 }
11961385
1197− sb->s_frozen = SB_FREEZE_WRITE;
1386+ /* From now on, no new normal writers can start */
1387+ sb->s_writers.frozen = SB_FREEZE_WRITE;
1388+ smp_wmb();
1389+
1390+ /* Release s_umount to preserve sb_start_write -> s_umount ordering */
1391+ up_write(&sb->s_umount);
1392+
1393+ sb_wait_write(sb, SB_FREEZE_WRITE);
1394+
1395+ /* Now we go and block page faults... */
1396+ down_write(&sb->s_umount);
1397+ sb->s_writers.frozen = SB_FREEZE_PAGEFAULT;
11981398 smp_wmb();
11991399
1400+ sb_wait_write(sb, SB_FREEZE_PAGEFAULT);
1401+
1402+ /* All writers are done so after syncing there won't be dirty data */
12001403 sync_filesystem(sb);
12011404
1202− sb->s_frozen = SB_FREEZE_TRANS;
1405+ /* Now wait for internal filesystem counter */
1406+ sb->s_writers.frozen = SB_FREEZE_FS;
12031407 smp_wmb();
1408+ sb_wait_write(sb, SB_FREEZE_FS);
12041409
1205− sync_blockdev(sb->s_bdev);
12061410 if (sb->s_op->freeze_fs) {
12071411 ret = sb->s_op->freeze_fs(sb);
12081412 if (ret) {
12091413 printk(KERN_ERR
12101414 "VFS:Filesystem freeze failed\n");
1211− sb->s_frozen = SB_UNFROZEN;
1415+ sb->s_writers.frozen = SB_UNFROZEN;
12121416 smp_wmb();
1213− wake_up(&sb->s_wait_unfrozen);
1417+ wake_up(&sb->s_writers.wait_unfrozen);
12141418 deactivate_locked_super(sb);
12151419 return ret;
12161420 }
12171421 }
1422+ /*
1423+ * This is just for debugging purposes so that fs can warn if it
1424+ * sees write activity when frozen is set to SB_FREEZE_COMPLETE.
1425+ */
1426+ sb->s_writers.frozen = SB_FREEZE_COMPLETE;
12181427 up_write(&sb->s_umount);
12191428 return 0;
12201429 }
@@ -1231,7 +1440,7 @@ int thaw_super(struct super_block *sb) · 10 unmodified lines
12311440 int error;
12321441
12331442 down_write(&sb->s_umount);
1234− if (sb->s_frozen == SB_UNFROZEN) {
1443+ if (sb->s_writers.frozen == SB_UNFROZEN) {
12351444 up_write(&sb->s_umount);
12361445 return -EINVAL;
12371446 }
@@ -1244,16 +1453,15 @@ int thaw_super(struct super_block *sb) · 6 unmodified lines
12441453 if (error) {
12451454 printk(KERN_ERR
12461455 "VFS:Filesystem thaw failed\n");
1247− sb->s_frozen = SB_FREEZE_TRANS;
12481456 up_write(&sb->s_umount);
12491457 return error;
12501458 }
12511459 }
12521460
12531461 out:
1254− sb->s_frozen = SB_UNFROZEN;
1462+ sb->s_writers.frozen = SB_UNFROZEN;
12551463 smp_wmb();
1256− wake_up(&sb->s_wait_unfrozen);
1464+ wake_up(&sb->s_writers.wait_unfrozen);
12571465 deactivate_locked_super(sb);
12581466
12591467 return 0;
fs/sysfs/bin.c+2−0
@@ -228,6 +228,8 @@ static int bin_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) · 227 unmodified lines
228228 ret = 0;
229229 if (bb->vm_ops->page_mkwrite)
230230 ret = bb->vm_ops->page_mkwrite(vma, vmf);
231+ else
232+ file_update_time(file);
231233
232234 sysfs_put_active(attr_sd);
233235 return ret;
fs/xfs/xfs_aops.c+18−0
@@ -123,6 +123,12 @@ xfs_setfilesize_trans_alloc( · 122 unmodified lines
123123
124124 ioend->io_append_trans = tp;
125125
126+ /*
127+ * We will pass freeze protection with a transaction. So tell lockdep
128+ * we released it.
129+ */
130+ rwsem_release(&ioend->io_inode->i_sb->s_writers.lock_map[SB_FREEZE_FS-1],
131+ 1, _THIS_IP_);
126132 /*
127133 * We hand off the transaction to the completion thread now, so
128134 * clear the flag here.
@@ -199,6 +205,15 @@ xfs_end_io( · 70 unmodified lines
199205 struct xfs_inode *ip = XFS_I(ioend->io_inode);
200206 int error = 0;
201207
208+ if (ioend->io_append_trans) {
209+ /*
210+ * We've got freeze protection passed with the transaction.
211+ * Tell lockdep about it.
212+ */
213+ rwsem_acquire_read(
214+ &ioend->io_inode->i_sb->s_writers.lock_map[SB_FREEZE_FS-1],
215+ 0, 1, _THIS_IP_);
216+ }
202217 if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
203218 ioend->io_error = -EIO;
204219 goto done;
@@ -1425,6 +1440,9 @@ out_trans_cancel: · 1220 unmodified lines
14251440 if (ioend->io_append_trans) {
14261441 current_set_flags_nested(&ioend->io_append_trans->t_pflags,
14271442 PF_FSTRANS);
1443+ rwsem_acquire_read(
1444+ &inode->i_sb->s_writers.lock_map[SB_FREEZE_FS-1],
1445+ 0, 1, _THIS_IP_);
14281446 xfs_trans_cancel(ioend->io_append_trans, 0);
14291447 }
14301448 out_destroy_ioend:
fs/xfs/xfs_file.c+7−3
@@ -770,10 +770,12 @@ xfs_file_aio_write( · 769 unmodified lines
770770 if (ocount == 0)
771771 return 0;
772772
773− xfs_wait_for_freeze(ip->i_mount, SB_FREEZE_WRITE);
773+ sb_start_write(inode->i_sb);
774774
775− if (XFS_FORCED_SHUTDOWN(ip->i_mount))
776− return -EIO;
775+ if (XFS_FORCED_SHUTDOWN(ip->i_mount)) {
776+ ret = -EIO;
777+ goto out;
778+ }
777779
778780 if (unlikely(file->f_flags & O_DIRECT))
779781 ret = xfs_file_dio_aio_write(iocb, iovp, nr_segs, pos, ocount);
@@ -792,6 +794,8 @@ xfs_file_aio_write( · 12 unmodified lines
792794 ret = err;
793795 }
794796
797+out:
798+ sb_end_write(inode->i_sb);
795799 return ret;
796800 }
797801
fs/xfs/xfs_ioctl.c+52−3
@@ -364,9 +364,15 @@ xfs_fssetdm_by_handle( · 363 unmodified lines
364364 if (copy_from_user(&dmhreq, arg, sizeof(xfs_fsop_setdm_handlereq_t)))
365365 return -XFS_ERROR(EFAULT);
366366
367+ error = mnt_want_write_file(parfilp);
368+ if (error)
369+ return error;
370+
367371 dentry = xfs_handlereq_to_dentry(parfilp, &dmhreq.hreq);
368− if (IS_ERR(dentry))
372+ if (IS_ERR(dentry)) {
373+ mnt_drop_write_file(parfilp);
369374 return PTR_ERR(dentry);
375+ }
370376
371377 if (IS_IMMUTABLE(dentry->d_inode) || IS_APPEND(dentry->d_inode)) {
372378 error = -XFS_ERROR(EPERM);
@@ -382,6 +388,7 @@ xfs_fssetdm_by_handle( · 9 unmodified lines
382388 fsd.fsd_dmstate);
383389
384390 out:
391+ mnt_drop_write_file(parfilp);
385392 dput(dentry);
386393 return error;
387394 }
@@ -634,7 +641,11 @@ xfs_ioc_space( · 246 unmodified lines
634641 if (ioflags & IO_INVIS)
635642 attr_flags |= XFS_ATTR_DMI;
636643
644+ error = mnt_want_write_file(filp);
645+ if (error)
646+ return error;
637647 error = xfs_change_file_space(ip, cmd, bf, filp->f_pos, attr_flags);
648+ mnt_drop_write_file(filp);
638649 return -error;
639650 }
640651
@@ -1163,6 +1174,7 @@ xfs_ioc_fssetxattr( · 522 unmodified lines
11631174 {
11641175 struct fsxattr fa;
11651176 unsigned int mask;
1177+ int error;
11661178
11671179 if (copy_from_user(&fa, arg, sizeof(fa)))
11681180 return -EFAULT;
@@ -1171,7 +1183,12 @@ xfs_ioc_fssetxattr( · 2 unmodified lines
11711183 if (filp->f_flags & (O_NDELAY|O_NONBLOCK))
11721184 mask |= FSX_NONBLOCK;
11731185
1174− return -xfs_ioctl_setattr(ip, &fa, mask);
1186+ error = mnt_want_write_file(filp);
1187+ if (error)
1188+ return error;
1189+ error = xfs_ioctl_setattr(ip, &fa, mask);
1190+ mnt_drop_write_file(filp);
1191+ return -error;
11751192 }
11761193
11771194 STATIC int
@@ -1196,6 +1213,7 @@ xfs_ioc_setxflags( · 18 unmodified lines
11961213 struct fsxattr fa;
11971214 unsigned int flags;
11981215 unsigned int mask;
1216+ int error;
11991217
12001218 if (copy_from_user(&flags, arg, sizeof(flags)))
12011219 return -EFAULT;
@@ -1210,7 +1228,12 @@ xfs_ioc_setxflags( · 8 unmodified lines
12101228 mask |= FSX_NONBLOCK;
12111229 fa.fsx_xflags = xfs_merge_ioc_xflags(flags, xfs_ip2xflags(ip));
12121230
1213− return -xfs_ioctl_setattr(ip, &fa, mask);
1231+ error = mnt_want_write_file(filp);
1232+ if (error)
1233+ return error;
1234+ error = xfs_ioctl_setattr(ip, &fa, mask);
1235+ mnt_drop_write_file(filp);
1236+ return -error;
12141237 }
12151238
12161239 STATIC int
@@ -1385,8 +1408,13 @@ xfs_file_ioctl( · 168 unmodified lines
13851408 if (copy_from_user(&dmi, arg, sizeof(dmi)))
13861409 return -XFS_ERROR(EFAULT);
13871410
1411+ error = mnt_want_write_file(filp);
1412+ if (error)
1413+ return error;
1414+
13881415 error = xfs_set_dmattrs(ip, dmi.fsd_dmevmask,
13891416 dmi.fsd_dmstate);
1417+ mnt_drop_write_file(filp);
13901418 return -error;
13911419 }
13921420
@@ -1434,7 +1462,11 @@ xfs_file_ioctl( · 41 unmodified lines
14341462
14351463 if (copy_from_user(&sxp, arg, sizeof(xfs_swapext_t)))
14361464 return -XFS_ERROR(EFAULT);
1465+ error = mnt_want_write_file(filp);
1466+ if (error)
1467+ return error;
14371468 error = xfs_swapext(&sxp);
1469+ mnt_drop_write_file(filp);
14381470 return -error;
14391471 }
14401472
@@ -1463,9 +1495,14 @@ xfs_file_ioctl( · 22 unmodified lines
14631495 if (copy_from_user(&inout, arg, sizeof(inout)))
14641496 return -XFS_ERROR(EFAULT);
14651497
1498+ error = mnt_want_write_file(filp);
1499+ if (error)
1500+ return error;
1501+
14661502 /* input parameter is passed in resblks field of structure */
14671503 in = inout.resblks;
14681504 error = xfs_reserve_blocks(mp, &in, &inout);
1505+ mnt_drop_write_file(filp);
14691506 if (error)
14701507 return -error;
14711508
@@ -1496,7 +1533,11 @@ xfs_file_ioctl( · 24 unmodified lines
14961533 if (copy_from_user(&in, arg, sizeof(in)))
14971534 return -XFS_ERROR(EFAULT);
14981535
1536+ error = mnt_want_write_file(filp);
1537+ if (error)
1538+ return error;
14991539 error = xfs_growfs_data(mp, &in);
1540+ mnt_drop_write_file(filp);
15001541 return -error;
15011542 }
15021543
@@ -1506,7 +1547,11 @@ xfs_file_ioctl( · 3 unmodified lines
15061547 if (copy_from_user(&in, arg, sizeof(in)))
15071548 return -XFS_ERROR(EFAULT);
15081549
1550+ error = mnt_want_write_file(filp);
1551+ if (error)
1552+ return error;
15091553 error = xfs_growfs_log(mp, &in);
1554+ mnt_drop_write_file(filp);
15101555 return -error;
15111556 }
15121557
@@ -1516,7 +1561,11 @@ xfs_file_ioctl( · 3 unmodified lines
15161561 if (copy_from_user(&in, arg, sizeof(in)))
15171562 return -XFS_ERROR(EFAULT);
15181563
1564+ error = mnt_want_write_file(filp);
1565+ if (error)
1566+ return error;
15191567 error = xfs_growfs_rt(mp, &in);
1568+ mnt_drop_write_file(filp);
15201569 return -error;
15211570 }
15221571
fs/xfs/xfs_ioctl32.c+12−0
@@ -600,7 +600,11 @@ xfs_file_compat_ioctl( · 599 unmodified lines
600600
601601 if (xfs_compat_growfs_data_copyin(&in, arg))
602602 return -XFS_ERROR(EFAULT);
603+ error = mnt_want_write_file(filp);
604+ if (error)
605+ return error;
603606 error = xfs_growfs_data(mp, &in);
607+ mnt_drop_write_file(filp);
604608 return -error;
605609 }
606610 case XFS_IOC_FSGROWFSRT_32: {
@@ -608,7 +612,11 @@ xfs_file_compat_ioctl( · 1 unmodified line
608612
609613 if (xfs_compat_growfs_rt_copyin(&in, arg))
610614 return -XFS_ERROR(EFAULT);
615+ error = mnt_want_write_file(filp);
616+ if (error)
617+ return error;
611618 error = xfs_growfs_rt(mp, &in);
619+ mnt_drop_write_file(filp);
612620 return -error;
613621 }
614622 #endif
@@ -627,7 +635,11 @@ xfs_file_compat_ioctl( · 12 unmodified lines
627635 offsetof(struct xfs_swapext, sx_stat)) ||
628636 xfs_ioctl32_bstat_copyin(&sxp.sx_stat, &sxu->sx_stat))
629637 return -XFS_ERROR(EFAULT);
638+ error = mnt_want_write_file(filp);
639+ if (error)
640+ return error;
630641 error = xfs_swapext(&sxp);
642+ mnt_drop_write_file(filp);
631643 return -error;
632644 }
633645 case XFS_IOC_FSBULKSTAT_32:
fs/xfs/xfs_iomap.c+2−2
@@ -680,9 +680,9 @@ xfs_iomap_write_unwritten( · 679 unmodified lines
680680 * the same inode that we complete here and might deadlock
681681 * on the iolock.
682682 */
683− xfs_wait_for_freeze(mp, SB_FREEZE_TRANS);
683+ sb_start_intwrite(mp->m_super);
684684 tp = _xfs_trans_alloc(mp, XFS_TRANS_STRAT_WRITE, KM_NOFS);
685− tp->t_flags |= XFS_TRANS_RESERVE;
685+ tp->t_flags |= XFS_TRANS_RESERVE | XFS_TRANS_FREEZE_PROT;
686686 error = xfs_trans_reserve(tp, resblks,
687687 XFS_WRITE_LOG_RES(mp), 0,
688688 XFS_TRANS_PERM_LOG_RES,
fs/xfs/xfs_mount.c+1−1
@@ -1551,7 +1551,7 @@ xfs_unmountfs( · 1550 unmodified lines
15511551 int
15521552 xfs_fs_writable(xfs_mount_t *mp)
15531553 {
1554− return !(xfs_test_for_freeze(mp) || XFS_FORCED_SHUTDOWN(mp) ||
1554+ return !(mp->m_super->s_writers.frozen || XFS_FORCED_SHUTDOWN(mp) ||
15551555 (mp->m_flags & XFS_MOUNT_RDONLY));
15561556 }
15571557
fs/xfs/xfs_mount.h+0−3
@@ -311,9 +311,6 @@ void xfs_do_force_shutdown(struct xfs_mount *mp, int flags, char *fname, · 310 unmodified lines
311311 #define SHUTDOWN_REMOTE_REQ 0x0010 /* shutdown came from remote cell */
312312 #define SHUTDOWN_DEVICE_REQ 0x0020 /* failed all paths to the device */
313313
314−#define xfs_test_for_freeze(mp) ((mp)->m_super->s_frozen)
315−#define xfs_wait_for_freeze(mp,l) vfs_check_frozen((mp)->m_super, (l))
316−
317314 /*
318315 * Flags for xfs_mountfs
319316 */
fs/xfs/xfs_sync.c+1−1
@@ -403,7 +403,7 @@ xfs_sync_worker( · 402 unmodified lines
403403 if (!(mp->m_super->s_flags & MS_ACTIVE) &&
404404 !(mp->m_flags & XFS_MOUNT_RDONLY)) {
405405 /* dgc: errors ignored here */
406− if (mp->m_super->s_frozen == SB_UNFROZEN &&
406+ if (mp->m_super->s_writers.frozen == SB_UNFROZEN &&
407407 xfs_log_need_covered(mp))
408408 error = xfs_fs_log_dummy(mp);
409409 else
fs/xfs/xfs_trans.c+14−3
@@ -576,8 +576,12 @@ xfs_trans_alloc( · 575 unmodified lines
576576 xfs_mount_t *mp,
577577 uint type)
578578 {
579− xfs_wait_for_freeze(mp, SB_FREEZE_TRANS);
580− return _xfs_trans_alloc(mp, type, KM_SLEEP);
579+ xfs_trans_t *tp;
580+
581+ sb_start_intwrite(mp->m_super);
582+ tp = _xfs_trans_alloc(mp, type, KM_SLEEP);
583+ tp->t_flags |= XFS_TRANS_FREEZE_PROT;
584+ return tp;
581585 }
582586
583587 xfs_trans_t *
@@ -588,6 +592,7 @@ _xfs_trans_alloc( · 4 unmodified lines
588592 {
589593 xfs_trans_t *tp;
590594
595+ WARN_ON(mp->m_super->s_writers.frozen == SB_FREEZE_COMPLETE);
591596 atomic_inc(&mp->m_active_trans);
592597
593598 tp = kmem_zone_zalloc(xfs_trans_zone, memflags);
@@ -611,6 +616,8 @@ xfs_trans_free( · 17 unmodified lines
611616 xfs_extent_busy_clear(tp->t_mountp, &tp->t_busy, false);
612617
613618 atomic_dec(&tp->t_mountp->m_active_trans);
619+ if (tp->t_flags & XFS_TRANS_FREEZE_PROT)
620+ sb_end_intwrite(tp->t_mountp->m_super);
614621 xfs_trans_free_dqinfo(tp);
615622 kmem_zone_free(xfs_trans_zone, tp);
616623 }
@@ -643,7 +650,11 @@ xfs_trans_dup( · 26 unmodified lines
643650 ASSERT(tp->t_flags & XFS_TRANS_PERM_LOG_RES);
644651 ASSERT(tp->t_ticket != NULL);
645652
646− ntp->t_flags = XFS_TRANS_PERM_LOG_RES | (tp->t_flags & XFS_TRANS_RESERVE);
653+ ntp->t_flags = XFS_TRANS_PERM_LOG_RES |
654+ (tp->t_flags & XFS_TRANS_RESERVE) |
655+ (tp->t_flags & XFS_TRANS_FREEZE_PROT);
656+ /* We gave our writer reference to the new transaction */
657+ tp->t_flags &= ~XFS_TRANS_FREEZE_PROT;
647658 ntp->t_ticket = xfs_log_ticket_get(tp->t_ticket);
648659 ntp->t_blk_res = tp->t_blk_res - tp->t_blk_res_used;
649660 tp->t_blk_res = tp->t_blk_res_used;
fs/xfs/xfs_trans.h+2−0
@@ -179,6 +179,8 @@ struct xfs_log_item_desc { · 178 unmodified lines
179179 #define XFS_TRANS_SYNC 0x08 /* make commit synchronous */
180180 #define XFS_TRANS_DQ_DIRTY 0x10 /* at least one dquot in trx dirty */
181181 #define XFS_TRANS_RESERVE 0x20 /* OK to use reserved data blocks */
182+#define XFS_TRANS_FREEZE_PROT 0x40 /* Transaction has elevated writer
183+ count in superblock */
182184
183185 /*
184186 * Values for call flags parameter.
include/linux/audit.h+4−0
@@ -130,6 +130,7 @@ · 129 unmodified lines
130130 #define AUDIT_LAST_KERN_ANOM_MSG 1799
131131 #define AUDIT_ANOM_PROMISCUOUS 1700 /* Device changed promiscuous mode */
132132 #define AUDIT_ANOM_ABEND 1701 /* Process ended abnormally */
133+#define AUDIT_ANOM_LINK 1702 /* Suspicious use of file links */
133134 #define AUDIT_INTEGRITY_DATA 1800 /* Data integrity verification */
134135 #define AUDIT_INTEGRITY_METADATA 1801 /* Metadata integrity verification */
135136 #define AUDIT_INTEGRITY_STATUS 1802 /* Integrity enable status */
@@ -687,6 +688,8 @@ extern void audit_log_d_path(struct audit_buffer *ab, · 551 unmodified lines
687688 const struct path *path);
688689 extern void audit_log_key(struct audit_buffer *ab,
689690 char *key);
691+extern void audit_log_link_denied(const char *operation,
692+ struct path *link);
690693 extern void audit_log_lost(const char *message);
691694 #ifdef CONFIG_SECURITY
692695 extern void audit_log_secctx(struct audit_buffer *ab, u32 secid);
@@ -716,6 +719,7 @@ extern int audit_enabled; · 23 unmodified lines
716719 #define audit_log_untrustedstring(a,s) do { ; } while (0)
717720 #define audit_log_d_path(b, p, d) do { ; } while (0)
718721 #define audit_log_key(b, k) do { ; } while (0)
722+#define audit_log_link_denied(o, l) do { ; } while (0)
719723 #define audit_log_secctx(b,s) do { ; } while (0)
720724 #define audit_enabled 0
721725 #endif
include/linux/fs.h+142−12
@@ -414,6 +414,7 @@ struct inodes_stat_t { · 413 unmodified lines
414414 #include <linux/shrinker.h>
415415 #include <linux/migrate_mode.h>
416416 #include <linux/uidgid.h>
417+#include <linux/lockdep.h>
417418
418419 #include <asm/byteorder.h>
419420
@@ -440,6 +441,8 @@ extern unsigned long get_max_files(void); · 20 unmodified lines
440441 extern int sysctl_nr_open;
441442 extern struct inodes_stat_t inodes_stat;
442443 extern int leases_enable, lease_break_time;
444+extern int sysctl_protected_symlinks;
445+extern int sysctl_protected_hardlinks;
443446
444447 struct buffer_head;
445448 typedef int (get_block_t)(struct inode *inode, sector_t iblock,
@@ -1445,6 +1448,8 @@ extern void f_delown(struct file *filp); · 999 unmodified lines
14451448 extern pid_t f_getown(struct file *filp);
14461449 extern int send_sigurg(struct fown_struct *fown);
14471450
1451+struct mm_struct;
1452+
14481453 /*
14491454 * Umount options
14501455 */
@@ -1458,6 +1463,31 @@ extern int send_sigurg(struct fown_struct *fown); · 7 unmodified lines
14581463 extern struct list_head super_blocks;
14591464 extern spinlock_t sb_lock;
14601465
1466+/* Possible states of 'frozen' field */
1467+enum {
1468+ SB_UNFROZEN = 0, /* FS is unfrozen */
1469+ SB_FREEZE_WRITE = 1, /* Writes, dir ops, ioctls frozen */
1470+ SB_FREEZE_PAGEFAULT = 2, /* Page faults stopped as well */
1471+ SB_FREEZE_FS = 3, /* For internal FS use (e.g. to stop
1472+ * internal threads if needed) */
1473+ SB_FREEZE_COMPLETE = 4, /* ->freeze_fs finished successfully */
1474+};
1475+
1476+#define SB_FREEZE_LEVELS (SB_FREEZE_COMPLETE - 1)
1477+
1478+struct sb_writers {
1479+ /* Counters for counting writers at each level */
1480+ struct percpu_counter counter[SB_FREEZE_LEVELS];
1481+ wait_queue_head_t wait; /* queue for waiting for
1482+ writers / faults to finish */
1483+ int frozen; /* Is sb frozen? */
1484+ wait_queue_head_t wait_unfrozen; /* queue for waiting for
1485+ sb to be thawed */
1486+#ifdef CONFIG_DEBUG_LOCK_ALLOC
1487+ struct lockdep_map lock_map[SB_FREEZE_LEVELS];
1488+#endif
1489+};
1490+
14611491 struct super_block {
14621492 struct list_head s_list; /* Keep this first */
14631493 dev_t s_dev; /* search index; _not_ kdev_t */
@@ -1505,8 +1535,7 @@ struct super_block { · 41 unmodified lines
15051535 struct hlist_node s_instances;
15061536 struct quota_info s_dquot; /* Diskquota specific options */
15071537
1508− int s_frozen;
1509− wait_queue_head_t s_wait_unfrozen;
1538+ struct sb_writers s_writers;
15101539
15111540 char s_id[32]; /* Informational name */
15121541 u8 s_uuid[16]; /* UUID */
@@ -1561,14 +1590,117 @@ extern struct timespec current_fs_time(struct super_block *sb); · 48 unmodified lines
15611590 /*
15621591 * Snapshotting support.
15631592 */
1564−enum {
1565− SB_UNFROZEN = 0,
1566− SB_FREEZE_WRITE = 1,
1567− SB_FREEZE_TRANS = 2,
1568−};
15691593
1570−#define vfs_check_frozen(sb, level) \
1571− wait_event((sb)->s_wait_unfrozen, ((sb)->s_frozen < (level)))
1594+void __sb_end_write(struct super_block *sb, int level);
1595+int __sb_start_write(struct super_block *sb, int level, bool wait);
1596+
1597+/**
1598+ * sb_end_write - drop write access to a superblock
1599+ * @sb: the super we wrote to
1600+ *
1601+ * Decrement number of writers to the filesystem. Wake up possible waiters
1602+ * wanting to freeze the filesystem.
1603+ */
1604+static inline void sb_end_write(struct super_block *sb)
1605+{
1606+ __sb_end_write(sb, SB_FREEZE_WRITE);
1607+}
1608+
1609+/**
1610+ * sb_end_pagefault - drop write access to a superblock from a page fault
1611+ * @sb: the super we wrote to
1612+ *
1613+ * Decrement number of processes handling write page fault to the filesystem.
1614+ * Wake up possible waiters wanting to freeze the filesystem.
1615+ */
1616+static inline void sb_end_pagefault(struct super_block *sb)
1617+{
1618+ __sb_end_write(sb, SB_FREEZE_PAGEFAULT);
1619+}
1620+
1621+/**
1622+ * sb_end_intwrite - drop write access to a superblock for internal fs purposes
1623+ * @sb: the super we wrote to
1624+ *
1625+ * Decrement fs-internal number of writers to the filesystem. Wake up possible
1626+ * waiters wanting to freeze the filesystem.
1627+ */
1628+static inline void sb_end_intwrite(struct super_block *sb)
1629+{
1630+ __sb_end_write(sb, SB_FREEZE_FS);
1631+}
1632+
1633+/**
1634+ * sb_start_write - get write access to a superblock
1635+ * @sb: the super we write to
1636+ *
1637+ * When a process wants to write data or metadata to a file system (i.e. dirty
1638+ * a page or an inode), it should embed the operation in a sb_start_write() -
1639+ * sb_end_write() pair to get exclusion against file system freezing. This
1640+ * function increments number of writers preventing freezing. If the file
1641+ * system is already frozen, the function waits until the file system is
1642+ * thawed.
1643+ *
1644+ * Since freeze protection behaves as a lock, users have to preserve
1645+ * ordering of freeze protection and other filesystem locks. Generally,
1646+ * freeze protection should be the outermost lock. In particular, we have:
1647+ *
1648+ * sb_start_write
1649+ * -> i_mutex (write path, truncate, directory ops, ...)
1650+ * -> s_umount (freeze_super, thaw_super)
1651+ */
1652+static inline void sb_start_write(struct super_block *sb)
1653+{
1654+ __sb_start_write(sb, SB_FREEZE_WRITE, true);
1655+}
1656+
1657+static inline int sb_start_write_trylock(struct super_block *sb)
1658+{
1659+ return __sb_start_write(sb, SB_FREEZE_WRITE, false);
1660+}
1661+
1662+/**
1663+ * sb_start_pagefault - get write access to a superblock from a page fault
1664+ * @sb: the super we write to
1665+ *
1666+ * When a process starts handling write page fault, it should embed the
1667+ * operation into sb_start_pagefault() - sb_end_pagefault() pair to get
1668+ * exclusion against file system freezing. This is needed since the page fault
1669+ * is going to dirty a page. This function increments number of running page
1670+ * faults preventing freezing. If the file system is already frozen, the
1671+ * function waits until the file system is thawed.
1672+ *
1673+ * Since page fault freeze protection behaves as a lock, users have to preserve
1674+ * ordering of freeze protection and other filesystem locks. It is advised to
1675+ * put sb_start_pagefault() close to mmap_sem in lock ordering. Page fault
1676+ * handling code implies lock dependency:
1677+ *
1678+ * mmap_sem
1679+ * -> sb_start_pagefault
1680+ */
1681+static inline void sb_start_pagefault(struct super_block *sb)
1682+{
1683+ __sb_start_write(sb, SB_FREEZE_PAGEFAULT, true);
1684+}
1685+
1686+/*
1687+ * sb_start_intwrite - get write access to a superblock for internal fs purposes
1688+ * @sb: the super we write to
1689+ *
1690+ * This is the third level of protection against filesystem freezing. It is
1691+ * free for use by a filesystem. The only requirement is that it must rank
1692+ * below sb_start_pagefault.
1693+ *
1694+ * For example filesystem can call sb_start_intwrite() when starting a
1695+ * transaction which somewhat eases handling of freezing for internal sources
1696+ * of filesystem changes (internal fs threads, discarding preallocation on file
1697+ * close, etc.).
1698+ */
1699+static inline void sb_start_intwrite(struct super_block *sb)
1700+{
1701+ __sb_start_write(sb, SB_FREEZE_FS, true);
1702+}
1703+
15721704
15731705 extern bool inode_owner_or_capable(const struct inode *inode);
15741706
@@ -1892,6 +2024,7 @@ struct file_system_type { · 317 unmodified lines
18922024 struct lock_class_key s_lock_key;
18932025 struct lock_class_key s_umount_key;
18942026 struct lock_class_key s_vfs_rename_key;
2027+ struct lock_class_key s_writers_key[SB_FREEZE_LEVELS];
18952028
18962029 struct lock_class_key i_lock_key;
18972030 struct lock_class_key i_mutex_key;
@@ -2334,9 +2467,6 @@ static inline void i_readcount_inc(struct inode *inode) · 436 unmodified lines
23342467 }
23352468 #endif
23362469 extern int do_pipe_flags(int *, int);
2337−extern struct file *create_read_pipe(struct file *f, int flags);
2338−extern struct file *create_write_pipe(int flags);
2339−extern void free_write_pipe(struct file *);
23402470
23412471 extern int kernel_read(struct file *, loff_t, char *, unsigned long);
23422472 extern struct file * open_exec(const char *);
include/linux/mm.h+1−0
@@ -1441,6 +1441,7 @@ extern void truncate_inode_pages_range(struct address_space *, · 1440 unmodified lines
14411441
14421442 /* generic vm_area_ops exported for stackable file systems */
14431443 extern int filemap_fault(struct vm_area_struct *, struct vm_fault *);
1444+extern int filemap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
14441445
14451446 /* mm/page-writeback.c */
14461447 int write_one_page(struct page *page, int wait);
include/linux/namei.h+1−0
@@ -67,6 +67,7 @@ extern int kern_path(const char *, unsigned, struct path *); · 66 unmodified lines
6767
6868 extern struct dentry *kern_path_create(int, const char *, struct path *, int);
6969 extern struct dentry *user_path_create(int, const char __user *, struct path *, int);
70+extern void done_path_create(struct path *, struct dentry *);
7071 extern struct dentry *kern_path_locked(const char *, struct path *);
7172 extern int vfs_path_lookup(struct dentry *, struct vfsmount *,
7273 const char *, unsigned int, struct path *);
include/linux/nfsd/nfsfh.h+1−0
@@ -143,6 +143,7 @@ typedef struct svc_fh { · 142 unmodified lines
143143 int fh_maxsize; /* max size for fh_handle */
144144
145145 unsigned char fh_locked; /* inode locked by us */
146+ unsigned char fh_want_write; /* remount protection taken */
146147
147148 #ifdef CONFIG_NFSD_V3
148149 unsigned char fh_post_saved; /* post-op attrs saved */
include/linux/pipe_fs_i.h+2−0
@@ -160,4 +160,6 @@ void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *); · 159 unmodified lines
160160 long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
161161 struct pipe_inode_info *get_pipe_info(struct file *file);
162162
163+int create_pipe_files(struct file **, int);
164+
163165 #endif
kernel/audit.c+21−0
@@ -1455,6 +1455,27 @@ void audit_log_key(struct audit_buffer *ab, char *key) · 1454 unmodified lines
14551455 audit_log_format(ab, "(null)");
14561456 }
14571457
1458+/**
1459+ * audit_log_link_denied - report a link restriction denial
1460+ * @operation: specific link opreation
1461+ * @link: the path that triggered the restriction
1462+ */
1463+void audit_log_link_denied(const char *operation, struct path *link)
1464+{
1465+ struct audit_buffer *ab;
1466+
1467+ ab = audit_log_start(current->audit_context, GFP_KERNEL,
1468+ AUDIT_ANOM_LINK);
1469+ audit_log_format(ab, "op=%s action=denied", operation);
1470+ audit_log_format(ab, " pid=%d comm=", current->pid);
1471+ audit_log_untrustedstring(ab, current->comm);
1472+ audit_log_d_path(ab, " path=", link);
1473+ audit_log_format(ab, " dev=");
1474+ audit_log_untrustedstring(ab, link->dentry->d_inode->i_sb->s_id);
1475+ audit_log_format(ab, " ino=%lu", link->dentry->d_inode->i_ino);
1476+ audit_log_end(ab);
1477+}
1478+
14581479 /**
14591480 * audit_log_end - end one audit record
14601481 * @ab: the audit_buffer
kernel/sysctl.c+18−0
@@ -1497,6 +1497,24 @@ static struct ctl_table fs_table[] = { · 1496 unmodified lines
14971497 },
14981498 #endif
14991499 #endif
1500+ {
1501+ .procname = "protected_symlinks",
1502+ .data = &sysctl_protected_symlinks,
1503+ .maxlen = sizeof(int),
1504+ .mode = 0600,
1505+ .proc_handler = proc_dointvec_minmax,
1506+ .extra1 = &zero,
1507+ .extra2 = &one,
1508+ },
1509+ {
1510+ .procname = "protected_hardlinks",
1511+ .data = &sysctl_protected_hardlinks,
1512+ .maxlen = sizeof(int),
1513+ .mode = 0600,
1514+ .proc_handler = proc_dointvec_minmax,
1515+ .extra1 = &zero,
1516+ .extra2 = &one,
1517+ },
15001518 {
15011519 .procname = "suid_dumpable",
15021520 .data = &suid_dumpable,
lib/percpu_counter.c+7−7
@@ -12,7 +12,7 @@ · 11 unmodified lines
1212
1313 #ifdef CONFIG_HOTPLUG_CPU
1414 static LIST_HEAD(percpu_counters);
15−static DEFINE_MUTEX(percpu_counters_lock);
15+static DEFINE_SPINLOCK(percpu_counters_lock);
1616 #endif
1717
1818 #ifdef CONFIG_DEBUG_OBJECTS_PERCPU_COUNTER
@@ -123,9 +123,9 @@ int __percpu_counter_init(struct percpu_counter *fbc, s64 amount, · 104 unmodified lines
123123
124124 #ifdef CONFIG_HOTPLUG_CPU
125125 INIT_LIST_HEAD(&fbc->list);
126− mutex_lock(&percpu_counters_lock);
126+ spin_lock(&percpu_counters_lock);
127127 list_add(&fbc->list, &percpu_counters);
128− mutex_unlock(&percpu_counters_lock);
128+ spin_unlock(&percpu_counters_lock);
129129 #endif
130130 return 0;
131131 }
@@ -139,9 +139,9 @@ void percpu_counter_destroy(struct percpu_counter *fbc) · 7 unmodified lines
139139 debug_percpu_counter_deactivate(fbc);
140140
141141 #ifdef CONFIG_HOTPLUG_CPU
142− mutex_lock(&percpu_counters_lock);
142+ spin_lock(&percpu_counters_lock);
143143 list_del(&fbc->list);
144− mutex_unlock(&percpu_counters_lock);
144+ spin_unlock(&percpu_counters_lock);
145145 #endif
146146 free_percpu(fbc->counters);
147147 fbc->counters = NULL;
@@ -170,7 +170,7 @@ static int __cpuinit percpu_counter_hotcpu_callback(struct notifier_block *nb, · 22 unmodified lines
170170 return NOTIFY_OK;
171171
172172 cpu = (unsigned long)hcpu;
173− mutex_lock(&percpu_counters_lock);
173+ spin_lock(&percpu_counters_lock);
174174 list_for_each_entry(fbc, &percpu_counters, list) {
175175 s32 *pcount;
176176 unsigned long flags;
@@ -181,7 +181,7 @@ static int __cpuinit percpu_counter_hotcpu_callback(struct notifier_block *nb, · 4 unmodified lines
181181 *pcount = 0;
182182 raw_spin_unlock_irqrestore(&fbc->lock, flags);
183183 }
184− mutex_unlock(&percpu_counters_lock);
184+ spin_unlock(&percpu_counters_lock);
185185 #endif
186186 return NOTIFY_OK;
187187 }
mm/filemap.c+29−2
@@ -1712,8 +1712,35 @@ page_not_uptodate: · 1711 unmodified lines
17121712 }
17131713 EXPORT_SYMBOL(filemap_fault);
17141714
1715+int filemap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
1716+{
1717+ struct page *page = vmf->page;
1718+ struct inode *inode = vma->vm_file->f_path.dentry->d_inode;
1719+ int ret = VM_FAULT_LOCKED;
1720+
1721+ sb_start_pagefault(inode->i_sb);
1722+ file_update_time(vma->vm_file);
1723+ lock_page(page);
1724+ if (page->mapping != inode->i_mapping) {
1725+ unlock_page(page);
1726+ ret = VM_FAULT_NOPAGE;
1727+ goto out;
1728+ }
1729+ /*
1730+ * We mark the page dirty already here so that when freeze is in
1731+ * progress, we are guaranteed that writeback during freezing will
1732+ * see the dirty page and writeprotect it again.
1733+ */
1734+ set_page_dirty(page);
1735+out:
1736+ sb_end_pagefault(inode->i_sb);
1737+ return ret;
1738+}
1739+EXPORT_SYMBOL(filemap_page_mkwrite);
1740+
17151741 const struct vm_operations_struct generic_file_vm_ops = {
17161742 .fault = filemap_fault,
1743+ .page_mkwrite = filemap_page_mkwrite,
17171744 };
17181745
17191746 /* This is used for a general mmap of a disk file */
@@ -2407,8 +2434,6 @@ ssize_t __generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 687 unmodified lines
24072434 count = ocount;
24082435 pos = *ppos;
24092436
2410− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
2411−
24122437 /* We can write back this queue in page reclaim */
24132438 current->backing_dev_info = mapping->backing_dev_info;
24142439 written = 0;
@@ -2507,6 +2532,7 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 92 unmodified lines
25072532
25082533 BUG_ON(iocb->ki_pos != pos);
25092534
2535+ sb_start_write(inode->i_sb);
25102536 mutex_lock(&inode->i_mutex);
25112537 blk_start_plug(&plug);
25122538 ret = __generic_file_aio_write(iocb, iov, nr_segs, &iocb->ki_pos);
@@ -2520,6 +2546,7 @@ ssize_t generic_file_aio_write(struct kiocb *iocb, const struct iovec *iov, · 7 unmodified lines
25202546 ret = err;
25212547 }
25222548 blk_finish_plug(&plug);
2549+ sb_end_write(inode->i_sb);
25232550 return ret;
25242551 }
25252552 EXPORT_SYMBOL(generic_file_aio_write);
mm/filemap_xip.c+4−2
@@ -304,6 +304,7 @@ out: · 303 unmodified lines
304304
305305 static const struct vm_operations_struct xip_file_vm_ops = {
306306 .fault = xip_file_fault,
307+ .page_mkwrite = filemap_page_mkwrite,
307308 };
308309
309310 int xip_file_mmap(struct file * file, struct vm_area_struct * vma)
@@ -401,6 +402,8 @@ xip_file_write(struct file *filp, const char __user *buf, size_t len, · 91 unmodified lines
401402 loff_t pos;
402403 ssize_t ret;
403404
405+ sb_start_write(inode->i_sb);
406+
404407 mutex_lock(&inode->i_mutex);
405408
406409 if (!access_ok(VERIFY_READ, buf, len)) {
@@ -411,8 +414,6 @@ xip_file_write(struct file *filp, const char __user *buf, size_t len, · 4 unmodified lines
411414 pos = *ppos;
412415 count = len;
413416
414− vfs_check_frozen(inode->i_sb, SB_FREEZE_WRITE);
415−
416417 /* We can write back this queue in page reclaim */
417418 current->backing_dev_info = mapping->backing_dev_info;
418419
@@ -436,6 +437,7 @@ xip_file_write(struct file *filp, const char __user *buf, size_t len, · 17 unmodified lines
436437 current->backing_dev_info = NULL;
437438 out_up:
438439 mutex_unlock(&inode->i_mutex);
440+ sb_end_write(inode->i_sb);
439441 return ret;
440442 }
441443 EXPORT_SYMBOL_GPL(xip_file_write);
mm/memory.c+7−7
@@ -2650,6 +2650,9 @@ reuse: · 2649 unmodified lines
26502650 if (!page_mkwrite) {
26512651 wait_on_page_locked(dirty_page);
26522652 set_page_dirty_balance(dirty_page, page_mkwrite);
2653+ /* file_update_time outside page_lock */
2654+ if (vma->vm_file)
2655+ file_update_time(vma->vm_file);
26532656 }
26542657 put_page(dirty_page);
26552658 if (page_mkwrite) {
@@ -2667,10 +2670,6 @@ reuse: · 11 unmodified lines
26672670 }
26682671 }
26692672
2670− /* file_update_time outside page_lock */
2671− if (vma->vm_file)
2672− file_update_time(vma->vm_file);
2673−
26742673 return ret;
26752674 }
26762675
@@ -3339,12 +3338,13 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma, · 662 unmodified lines
33393338
33403339 if (dirty_page) {
33413340 struct address_space *mapping = page->mapping;
3341+ int dirtied = 0;
33423342
33433343 if (set_page_dirty(dirty_page))
3344− page_mkwrite = 1;
3344+ dirtied = 1;
33453345 unlock_page(dirty_page);
33463346 put_page(dirty_page);
3347− if (page_mkwrite && mapping) {
3347+ if ((dirtied || page_mkwrite) && mapping) {
33483348 /*
33493349 * Some device drivers do not set page.mapping but still
33503350 * dirty their pages
@@ -3353,7 +3353,7 @@ static int __do_fault(struct mm_struct *mm, struct vm_area_struct *vma, · 2 unmodified lines
33533353 }
33543354
33553355 /* file_update_time outside page_lock */
3356− if (vma->vm_file)
3356+ if (vma->vm_file && !page_mkwrite)
33573357 file_update_time(vma->vm_file);
33583358 } else {
33593359 unlock_page(vmf.page);
net/unix/af_unix.c+43−50
@@ -823,6 +823,34 @@ fail: · 822 unmodified lines
823823 return NULL;
824824 }
825825
826+static int unix_mknod(const char *sun_path, umode_t mode, struct path *res)
827+{
828+ struct dentry *dentry;
829+ struct path path;
830+ int err = 0;
831+ /*
832+ * Get the parent directory, calculate the hash for last
833+ * component.
834+ */
835+ dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
836+ err = PTR_ERR(dentry);
837+ if (IS_ERR(dentry))
838+ return err;
839+
840+ /*
841+ * All right, let's create it.
842+ */
843+ err = security_path_mknod(&path, dentry, mode, 0);
844+ if (!err) {
845+ err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
846+ if (!err) {
847+ res->mnt = mntget(path.mnt);
848+ res->dentry = dget(dentry);
849+ }
850+ }
851+ done_path_create(&path, dentry);
852+ return err;
853+}
826854
827855 static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
828856 {
@@ -831,8 +859,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) · 2 unmodified lines
831859 struct unix_sock *u = unix_sk(sk);
832860 struct sockaddr_un *sunaddr = (struct sockaddr_un *)uaddr;
833861 char *sun_path = sunaddr->sun_path;
834− struct dentry *dentry = NULL;
835− struct path path;
836862 int err;
837863 unsigned int hash;
838864 struct unix_address *addr;
@@ -869,43 +895,23 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) · 30 unmodified lines
869895 atomic_set(&addr->refcnt, 1);
870896
871897 if (sun_path[0]) {
872− umode_t mode;
873− err = 0;
874− /*
875− * Get the parent directory, calculate the hash for last
876− * component.
877− */
878− dentry = kern_path_create(AT_FDCWD, sun_path, &path, 0);
879− err = PTR_ERR(dentry);
880− if (IS_ERR(dentry))
881− goto out_mknod_parent;
882−
883− /*
884− * All right, let's create it.
885− */
886− mode = S_IFSOCK |
898+ struct path path;
899+ umode_t mode = S_IFSOCK |
887900 (SOCK_INODE(sock)->i_mode & ~current_umask());
888− err = mnt_want_write(path.mnt);
889− if (err)
890− goto out_mknod_dput;
891− err = security_path_mknod(&path, dentry, mode, 0);
892− if (err)
893− goto out_mknod_drop_write;
894− err = vfs_mknod(path.dentry->d_inode, dentry, mode, 0);
895−out_mknod_drop_write:
896− mnt_drop_write(path.mnt);
897− if (err)
898− goto out_mknod_dput;
899− mutex_unlock(&path.dentry->d_inode->i_mutex);
900− dput(path.dentry);
901− path.dentry = dentry;
902−
901+ err = unix_mknod(sun_path, mode, &path);
902+ if (err) {
903+ if (err == -EEXIST)
904+ err = -EADDRINUSE;
905+ unix_release_addr(addr);
906+ goto out_up;
907+ }
903908 addr->hash = UNIX_HASH_SIZE;
904− }
905−
906− spin_lock(&unix_table_lock);
907−
908− if (!sun_path[0]) {
909+ hash = path.dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1);
910+ spin_lock(&unix_table_lock);
911+ u->path = path;
912+ list = &unix_socket_table[hash];
913+ } else {
914+ spin_lock(&unix_table_lock);
909915 err = -EADDRINUSE;
910916 if (__unix_find_socket_byname(net, sunaddr, addr_len,
911917 sk->sk_type, hash)) {
@@ -914,9 +920,6 @@ out_mknod_drop_write: · 2 unmodified lines
914920 }
915921
916922 list = &unix_socket_table[addr->hash];
917− } else {
918− list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
919− u->path = path;
920923 }
921924
922925 err = 0;
@@ -930,16 +933,6 @@ out_up: · 7 unmodified lines
930933 mutex_unlock(&u->readlock);
931934 out:
932935 return err;
933−
934−out_mknod_dput:
935− dput(dentry);
936− mutex_unlock(&path.dentry->d_inode->i_mutex);
937− path_put(&path);
938−out_mknod_parent:
939− if (err == -EEXIST)
940− err = -EADDRINUSE;
941− unix_release_addr(addr);
942− goto out_up;
943936 }
944937
945938 static void unix_state_double_lock(struct sock *sk1, struct sock *sk2)
sound/sound_firmware.c+4−4
@@ -23,14 +23,14 @@ static int do_mod_firmware_load(const char *fn, char **fp) · 22 unmodified lines
2323 if (l <= 0 || l > 131072)
2424 {
2525 printk(KERN_INFO "Invalid firmware '%s'\n", fn);
26− filp_close(filp, current->files);
26+ filp_close(filp, NULL);
2727 return 0;
2828 }
2929 dp = vmalloc(l);
3030 if (dp == NULL)
3131 {
3232 printk(KERN_INFO "Out of memory loading '%s'.\n", fn);
33− filp_close(filp, current->files);
33+ filp_close(filp, NULL);
3434 return 0;
3535 }
3636 pos = 0;
@@ -38,10 +38,10 @@ static int do_mod_firmware_load(const char *fn, char **fp) · 1 unmodified line
3838 {
3939 printk(KERN_INFO "Failed to read '%s'.\n", fn);
4040 vfree(dp);
41− filp_close(filp, current->files);
41+ filp_close(filp, NULL);
4242 return 0;
4343 }
44− filp_close(filp, current->files);
44+ filp_close(filp, NULL);
4545 *fp = dp;
4646 return (int) l;
4747 }