Skip to content

Commit

Permalink
Merge branch 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/…
Browse files Browse the repository at this point in the history 
…git/jack/linux-fs

Pull fsnotify updates from Jan Kara:

 - fixes of use-after-tree issues when handling fanotify permission
   events from Miklos

 - refcount_t conversions from Elena

 - fixes of ENOMEM handling in dnotify and fsnotify from me

* 'fsnotify' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  fsnotify: convert fsnotify_mark.refcnt from atomic_t to refcount_t
  fanotify: clean up CONFIG_FANOTIFY_ACCESS_PERMISSIONS ifdefs
  fsnotify: clean up fsnotify()
  fanotify: fix fsnotify_prepare_user_wait() failure
  fsnotify: fix pinning group in fsnotify_prepare_user_wait()
  fsnotify: pin both inode and vfsmount mark
  fsnotify: clean up fsnotify_prepare/finish_user_wait()
  fsnotify: convert fsnotify_group.refcnt from atomic_t to refcount_t
  fsnotify: Protect bail out path of fsnotify_add_mark_locked() properly
  dnotify: Handle errors from fsnotify_add_mark_locked() in fcntl_dirnotify()
  • Loading branch information
@torvalds
torvalds committed Nov 14, 2017
2 parents f0b60bf + ab97f87 commit 23281c8
Show file tree
Hide file tree
Showing 10 changed files with 162 additions and 186 deletions.
7 changes: 6 additions & 1 deletion fs/notify/dnotify/dnotify.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,11 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark);
spin_lock(&fsn_mark->lock);
} else {
fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);
error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);
if (error) {
mutex_unlock(&dnotify_group->mark_mutex);
goto out_err;
}
spin_lock(&new_fsn_mark->lock);
fsn_mark = new_fsn_mark;
dn_mark = new_dn_mark;
Expand All @@ -345,6 +349,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
*/
if (dn_mark == new_dn_mark)
destroy = 1;
error = 0;
goto out;
}

Expand Down
49 changes: 20 additions & 29 deletions fs/notify/fanotify/fanotify.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -36,15 +36,13 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event)

pr_debug("%s: list=%p event=%p\n", __func__, list, event);

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
/*
* Don't merge a permission event with any other event so that we know
* the event structure we have created in fanotify_handle_event() is the
* one we should check for permission response.
*/
if (event->mask & FAN_ALL_PERM_EVENTS)
if (fanotify_is_perm_event(event->mask))
return 0;
#endif

list_for_each_entry_reverse(test_event, list, list) {
if (should_merge(test_event, event)) {
Expand All @@ -56,7 +54,6 @@ static int fanotify_merge(struct list_head *list, struct fsnotify_event *event)
return 0;
}

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
static int fanotify_get_response(struct fsnotify_group *group,
struct fanotify_perm_event_info *event,
struct fsnotify_iter_info *iter_info)
Expand All @@ -65,19 +62,8 @@ static int fanotify_get_response(struct fsnotify_group *group,

pr_debug("%s: group=%p event=%p\n", __func__, group, event);

/*
* fsnotify_prepare_user_wait() fails if we race with mark deletion.
* Just let the operation pass in that case.
*/
if (!fsnotify_prepare_user_wait(iter_info)) {
event->response = FAN_ALLOW;
goto out;
}

wait_event(group->fanotify_data.access_waitq, event->response);

fsnotify_finish_user_wait(iter_info);
out:
/* userspace responded, convert to something usable */
switch (event->response) {
case FAN_ALLOW:
Expand All @@ -94,7 +80,6 @@ static int fanotify_get_response(struct fsnotify_group *group,

return ret;
}
#endif

static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark,
struct fsnotify_mark *vfsmnt_mark,
Expand Down Expand Up @@ -153,8 +138,7 @@ struct fanotify_event_info *fanotify_alloc_event(struct inode *inode, u32 mask,
{
struct fanotify_event_info *event;

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
if (mask & FAN_ALL_PERM_EVENTS) {
if (fanotify_is_perm_event(mask)) {
struct fanotify_perm_event_info *pevent;

pevent = kmem_cache_alloc(fanotify_perm_event_cachep,
Expand All @@ -165,7 +149,6 @@ struct fanotify_event_info *fanotify_alloc_event(struct inode *inode, u32 mask,
pevent->response = 0;
goto init;
}
#endif
event = kmem_cache_alloc(fanotify_event_cachep, GFP_KERNEL);
if (!event)
return NULL;
Expand Down Expand Up @@ -212,9 +195,19 @@ static int fanotify_handle_event(struct fsnotify_group *group,
pr_debug("%s: group=%p inode=%p mask=%x\n", __func__, group, inode,
mask);

if (fanotify_is_perm_event(mask)) {
/*
* fsnotify_prepare_user_wait() fails if we race with mark
* deletion. Just let the operation pass in that case.
*/
if (!fsnotify_prepare_user_wait(iter_info))
return 0;
}

event = fanotify_alloc_event(inode, mask, data);
ret = -ENOMEM;
if (unlikely(!event))
return -ENOMEM;
goto finish;

fsn_event = &event->fse;
ret = fsnotify_add_event(group, fsn_event, fanotify_merge);
Expand All @@ -224,16 +217,16 @@ static int fanotify_handle_event(struct fsnotify_group *group,
/* Our event wasn't used in the end. Free it. */
fsnotify_destroy_event(group, fsn_event);

return 0;
}

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
if (mask & FAN_ALL_PERM_EVENTS) {
ret = 0;
} else if (fanotify_is_perm_event(mask)) {
ret = fanotify_get_response(group, FANOTIFY_PE(fsn_event),
iter_info);
fsnotify_destroy_event(group, fsn_event);
}
#endif
finish:
if (fanotify_is_perm_event(mask))
fsnotify_finish_user_wait(iter_info);

return ret;
}

Expand All @@ -253,13 +246,11 @@ static void fanotify_free_event(struct fsnotify_event *fsn_event)
event = FANOTIFY_E(fsn_event);
path_put(&event->path);
put_pid(event->tgid);
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
if (fsn_event->mask & FAN_ALL_PERM_EVENTS) {
if (fanotify_is_perm_event(fsn_event->mask)) {
kmem_cache_free(fanotify_perm_event_cachep,
FANOTIFY_PE(fsn_event));
return;
}
#endif
kmem_cache_free(fanotify_event_cachep, event);
}

Expand Down
8 changes: 6 additions & 2 deletions fs/notify/fanotify/fanotify.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,6 @@ struct fanotify_event_info {
struct pid *tgid;
};

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
/*
* Structure for permission fanotify events. It gets allocated and freed in
* fanotify_handle_event() since we wait there for user response. When the
Expand All @@ -41,7 +40,12 @@ FANOTIFY_PE(struct fsnotify_event *fse)
{
return container_of(fse, struct fanotify_perm_event_info, fae.fse);
}
#endif

static inline bool fanotify_is_perm_event(u32 mask)
{
return IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS) &&
mask & FAN_ALL_PERM_EVENTS;
}

static inline struct fanotify_event_info *FANOTIFY_E(struct fsnotify_event *fse)
{
Expand Down
43 changes: 16 additions & 27 deletions fs/notify/fanotify/fanotify_user.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,6 @@ static int fill_event_metadata(struct fsnotify_group *group,
return ret;
}

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
static struct fanotify_perm_event_info *dequeue_event(
struct fsnotify_group *group, int fd)
{
Expand Down Expand Up @@ -200,7 +199,6 @@ static int process_access_response(struct fsnotify_group *group,

return 0;
}
#endif

static ssize_t copy_event_to_user(struct fsnotify_group *group,
struct fsnotify_event *event,
Expand All @@ -222,10 +220,8 @@ static ssize_t copy_event_to_user(struct fsnotify_group *group,
fanotify_event_metadata.event_len))
goto out_close_fd;

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
if (event->mask & FAN_ALL_PERM_EVENTS)
if (fanotify_is_perm_event(event->mask))
FANOTIFY_PE(event)->fd = fd;
#endif

if (fd != FAN_NOFD)
fd_install(fd, f);
Expand Down Expand Up @@ -310,10 +306,9 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
* Permission events get queued to wait for response. Other
* events can be destroyed now.
*/
if (!(kevent->mask & FAN_ALL_PERM_EVENTS)) {
if (!fanotify_is_perm_event(kevent->mask)) {
fsnotify_destroy_event(group, kevent);
} else {
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
if (ret <= 0) {
FANOTIFY_PE(kevent)->response = FAN_DENY;
wake_up(&group->fanotify_data.access_waitq);
Expand All @@ -323,7 +318,6 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,
&group->fanotify_data.access_list);
spin_unlock(&group->notification_lock);
}
#endif
}
if (ret < 0)
break;
Expand All @@ -339,11 +333,13 @@ static ssize_t fanotify_read(struct file *file, char __user *buf,

static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos)
{
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
struct fanotify_response response = { .fd = -1, .response = -1 };
struct fsnotify_group *group;
int ret;

if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS))
return -EINVAL;

group = file->private_data;

if (count > sizeof(response))
Expand All @@ -359,16 +355,11 @@ static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t
count = ret;

return count;
#else
return -EINVAL;
#endif
}

static int fanotify_release(struct inode *ignored, struct file *file)
{
struct fsnotify_group *group = file->private_data;

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
struct fanotify_perm_event_info *event, *next;
struct fsnotify_event *fsn_event;

Expand Down Expand Up @@ -404,14 +395,14 @@ static int fanotify_release(struct inode *ignored, struct file *file)
spin_unlock(&group->notification_lock);
fsnotify_destroy_event(group, fsn_event);
spin_lock(&group->notification_lock);
} else
} else {
FANOTIFY_PE(fsn_event)->response = FAN_ALLOW;
}
}
spin_unlock(&group->notification_lock);

/* Response for all permission events it set, wakeup waiters */
wake_up(&group->fanotify_data.access_waitq);
#endif

/* matches the fanotify_init->fsnotify_alloc_group */
fsnotify_destroy_group(group);
Expand Down Expand Up @@ -769,10 +760,8 @@ SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags)
if (force_o_largefile())
event_f_flags |= O_LARGEFILE;
group->fanotify_data.f_flags = event_f_flags;
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
init_waitqueue_head(&group->fanotify_data.access_waitq);
INIT_LIST_HEAD(&group->fanotify_data.access_list);
#endif
switch (flags & FAN_ALL_CLASS_BITS) {
case FAN_CLASS_NOTIF:
group->priority = FS_PRIO_0;
Expand Down Expand Up @@ -826,6 +815,7 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
struct fsnotify_group *group;
struct fd f;
struct path path;
u32 valid_mask = FAN_ALL_EVENTS | FAN_EVENT_ON_CHILD;
int ret;

pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n",
Expand Down Expand Up @@ -856,11 +846,10 @@ SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags,
mask &= ~FAN_ONDIR;
}

#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
if (mask & ~(FAN_ALL_EVENTS | FAN_ALL_PERM_EVENTS | FAN_EVENT_ON_CHILD))
#else
if (mask & ~(FAN_ALL_EVENTS | FAN_EVENT_ON_CHILD))
#endif
if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS))
valid_mask |= FAN_ALL_PERM_EVENTS;

if (mask & ~valid_mask)
return -EINVAL;

f = fdget(fanotify_fd);
Expand Down Expand Up @@ -950,10 +939,10 @@ static int __init fanotify_user_setup(void)
{
fanotify_mark_cache = KMEM_CACHE(fsnotify_mark, SLAB_PANIC);
fanotify_event_cachep = KMEM_CACHE(fanotify_event_info, SLAB_PANIC);
#ifdef CONFIG_FANOTIFY_ACCESS_PERMISSIONS
fanotify_perm_event_cachep = KMEM_CACHE(fanotify_perm_event_info,
SLAB_PANIC);
#endif
if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) {
fanotify_perm_event_cachep =
KMEM_CACHE(fanotify_perm_event_info, SLAB_PANIC);
}

return 0;
}
Expand Down
Loading

0 comments on commit 23281c8

Please sign in to comment.