redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

[PATCH] Fix double decrement of mqueue_mnt->mnt_count in sys_mq_open 

Fixed the refcounting on failure exits in sys_mq_open() and
cleaned the logics up.  Rules are actually pretty simple - dentry_open()
expects vfsmount and dentry to be pinned down and it either transfers
them into created struct file or drops them.  Old code had been very
confused in that area - if dentry_open() had failed either in do_open()
or do_create(), we ended up dentry and mqueue_mnt dropped twice, once
by dentry_open() cleanup and then by sys_mq_open().

Fix consists of making the rules for do_create() and do_open()
same as for dentry_open() and updating the sys_mq_open() accordingly;
that actually leads to more straightforward code and less work on
normal path.

Signed-off-by: Al Viro <aviro@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
wifi-calibration
Alexander Viro 2006-01-14 15:29:55 -05:00 committed by Linus Torvalds
parent 12dbf3fc4d
commit 7c7dce9209
1 changed files with 33 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
ipc/mqueue.c
View File

@ -599,15 +599,16 @@ static int mq_attr_ok(struct mq_attr *attr)
static struct file *do_create(struct dentry *dir, struct dentry *dentry, static struct file *do_create(struct dentry *dir, struct dentry *dentry,
int oflag, mode_t mode, struct mq_attr __user *u_attr) int oflag, mode_t mode, struct mq_attr __user *u_attr)
{ {
struct file *filp;
struct mq_attr attr; struct mq_attr attr;
int ret; int ret;
if (u_attr != NULL) { if (u_attr) {
ret = -EFAULT;
if (copy_from_user(&attr, u_attr, sizeof(attr))) if (copy_from_user(&attr, u_attr, sizeof(attr)))
return ERR_PTR(-EFAULT); goto out;
ret = -EINVAL;
if (!mq_attr_ok(&attr)) if (!mq_attr_ok(&attr))
return ERR_PTR(-EINVAL); goto out;
/* store for use during create */ /* store for use during create */
dentry->d_fsdata = &attr; dentry->d_fsdata = &attr;
} }
@ -616,13 +617,14 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
ret = vfs_create(dir->d_inode, dentry, mode, NULL); ret = vfs_create(dir->d_inode, dentry, mode, NULL);
dentry->d_fsdata = NULL; dentry->d_fsdata = NULL;
if (ret) if (ret)
return ERR_PTR(ret); goto out;
filp = dentry_open(dentry, mqueue_mnt, oflag); return dentry_open(dentry, mqueue_mnt, oflag);
if (!IS_ERR(filp))
dget(dentry);
return filp; out:
dput(dentry);
mntput(mqueue_mnt);
return ERR_PTR(ret);
} }
/* Opens existing queue */ /* Opens existing queue */
@ -630,20 +632,20 @@ static struct file *do_open(struct dentry *dentry, int oflag)
{ {
static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE, static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
MAY_READ | MAY_WRITE }; MAY_READ | MAY_WRITE };
struct file *filp;
if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
dput(dentry);
mntput(mqueue_mnt);
return ERR_PTR(-EINVAL); return ERR_PTR(-EINVAL);
}
if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) {
dput(dentry);
mntput(mqueue_mnt);
return ERR_PTR(-EACCES); return ERR_PTR(-EACCES);
}
filp = dentry_open(dentry, mqueue_mnt, oflag); return dentry_open(dentry, mqueue_mnt, oflag);
if (!IS_ERR(filp))
dget(dentry);
return filp;
} }
asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode, asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
@ -671,17 +673,20 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
if (oflag & O_CREAT) { if (oflag & O_CREAT) {
if (dentry->d_inode) { /* entry already exists */ if (dentry->d_inode) { /* entry already exists */
filp = (oflag & O_EXCL) ? ERR_PTR(-EEXIST) : error = -EEXIST;
do_open(dentry, oflag); if (oflag & O_EXCL)
goto out;
filp = do_open(dentry, oflag);
} else { } else {
filp = do_create(mqueue_mnt->mnt_root, dentry, filp = do_create(mqueue_mnt->mnt_root, dentry,
oflag, mode, u_attr); oflag, mode, u_attr);
} }
} else } else {
filp = (dentry->d_inode) ? do_open(dentry, oflag) : error = -ENOENT;
ERR_PTR(-ENOENT); if (!dentry->d_inode)
goto out;
dput(dentry); filp = do_open(dentry, oflag);
}
if (IS_ERR(filp)) { if (IS_ERR(filp)) {
error = PTR_ERR(filp); error = PTR_ERR(filp);
@ -692,8 +697,10 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
fd_install(fd, filp); fd_install(fd, filp);
goto out_upsem; goto out_upsem;
out_putfd: out:
dput(dentry);
mntput(mqueue_mnt); mntput(mqueue_mnt);
out_putfd:
put_unused_fd(fd); put_unused_fd(fd);
out_err: out_err:
fd = error; fd = error;