[PATCH] Fix double decrement of mqueue_mnt->mnt_count in sys_mq_open
Fixed the refcounting on failure exits in sys_mq_open() and cleaned the logics up. Rules are actually pretty simple - dentry_open() expects vfsmount and dentry to be pinned down and it either transfers them into created struct file or drops them. Old code had been very confused in that area - if dentry_open() had failed either in do_open() or do_create(), we ended up dentry and mqueue_mnt dropped twice, once by dentry_open() cleanup and then by sys_mq_open(). Fix consists of making the rules for do_create() and do_open() same as for dentry_open() and updating the sys_mq_open() accordingly; that actually leads to more straightforward code and less work on normal path. Signed-off-by: Al Viro <aviro@redhat.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
parent
12dbf3fc4d
commit
7c7dce9209
59
ipc/mqueue.c
59
ipc/mqueue.c
|
@ -599,15 +599,16 @@ static int mq_attr_ok(struct mq_attr *attr)
|
||||||
static struct file *do_create(struct dentry *dir, struct dentry *dentry,
|
static struct file *do_create(struct dentry *dir, struct dentry *dentry,
|
||||||
int oflag, mode_t mode, struct mq_attr __user *u_attr)
|
int oflag, mode_t mode, struct mq_attr __user *u_attr)
|
||||||
{
|
{
|
||||||
struct file *filp;
|
|
||||||
struct mq_attr attr;
|
struct mq_attr attr;
|
||||||
int ret;
|
int ret;
|
||||||
|
|
||||||
if (u_attr != NULL) {
|
if (u_attr) {
|
||||||
|
ret = -EFAULT;
|
||||||
if (copy_from_user(&attr, u_attr, sizeof(attr)))
|
if (copy_from_user(&attr, u_attr, sizeof(attr)))
|
||||||
return ERR_PTR(-EFAULT);
|
goto out;
|
||||||
|
ret = -EINVAL;
|
||||||
if (!mq_attr_ok(&attr))
|
if (!mq_attr_ok(&attr))
|
||||||
return ERR_PTR(-EINVAL);
|
goto out;
|
||||||
/* store for use during create */
|
/* store for use during create */
|
||||||
dentry->d_fsdata = &attr;
|
dentry->d_fsdata = &attr;
|
||||||
}
|
}
|
||||||
|
@ -616,13 +617,14 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
|
||||||
ret = vfs_create(dir->d_inode, dentry, mode, NULL);
|
ret = vfs_create(dir->d_inode, dentry, mode, NULL);
|
||||||
dentry->d_fsdata = NULL;
|
dentry->d_fsdata = NULL;
|
||||||
if (ret)
|
if (ret)
|
||||||
return ERR_PTR(ret);
|
goto out;
|
||||||
|
|
||||||
filp = dentry_open(dentry, mqueue_mnt, oflag);
|
return dentry_open(dentry, mqueue_mnt, oflag);
|
||||||
if (!IS_ERR(filp))
|
|
||||||
dget(dentry);
|
|
||||||
|
|
||||||
return filp;
|
out:
|
||||||
|
dput(dentry);
|
||||||
|
mntput(mqueue_mnt);
|
||||||
|
return ERR_PTR(ret);
|
||||||
}
|
}
|
||||||
|
|
||||||
/* Opens existing queue */
|
/* Opens existing queue */
|
||||||
|
@ -630,20 +632,20 @@ static struct file *do_open(struct dentry *dentry, int oflag)
|
||||||
{
|
{
|
||||||
static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
|
static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
|
||||||
MAY_READ | MAY_WRITE };
|
MAY_READ | MAY_WRITE };
|
||||||
struct file *filp;
|
|
||||||
|
|
||||||
if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY))
|
if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
|
||||||
|
dput(dentry);
|
||||||
|
mntput(mqueue_mnt);
|
||||||
return ERR_PTR(-EINVAL);
|
return ERR_PTR(-EINVAL);
|
||||||
|
}
|
||||||
|
|
||||||
if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL))
|
if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) {
|
||||||
|
dput(dentry);
|
||||||
|
mntput(mqueue_mnt);
|
||||||
return ERR_PTR(-EACCES);
|
return ERR_PTR(-EACCES);
|
||||||
|
}
|
||||||
|
|
||||||
filp = dentry_open(dentry, mqueue_mnt, oflag);
|
return dentry_open(dentry, mqueue_mnt, oflag);
|
||||||
|
|
||||||
if (!IS_ERR(filp))
|
|
||||||
dget(dentry);
|
|
||||||
|
|
||||||
return filp;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
|
asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
|
||||||
|
@ -671,17 +673,20 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
|
||||||
|
|
||||||
if (oflag & O_CREAT) {
|
if (oflag & O_CREAT) {
|
||||||
if (dentry->d_inode) { /* entry already exists */
|
if (dentry->d_inode) { /* entry already exists */
|
||||||
filp = (oflag & O_EXCL) ? ERR_PTR(-EEXIST) :
|
error = -EEXIST;
|
||||||
do_open(dentry, oflag);
|
if (oflag & O_EXCL)
|
||||||
|
goto out;
|
||||||
|
filp = do_open(dentry, oflag);
|
||||||
} else {
|
} else {
|
||||||
filp = do_create(mqueue_mnt->mnt_root, dentry,
|
filp = do_create(mqueue_mnt->mnt_root, dentry,
|
||||||
oflag, mode, u_attr);
|
oflag, mode, u_attr);
|
||||||
}
|
}
|
||||||
} else
|
} else {
|
||||||
filp = (dentry->d_inode) ? do_open(dentry, oflag) :
|
error = -ENOENT;
|
||||||
ERR_PTR(-ENOENT);
|
if (!dentry->d_inode)
|
||||||
|
goto out;
|
||||||
dput(dentry);
|
filp = do_open(dentry, oflag);
|
||||||
|
}
|
||||||
|
|
||||||
if (IS_ERR(filp)) {
|
if (IS_ERR(filp)) {
|
||||||
error = PTR_ERR(filp);
|
error = PTR_ERR(filp);
|
||||||
|
@ -692,8 +697,10 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
|
||||||
fd_install(fd, filp);
|
fd_install(fd, filp);
|
||||||
goto out_upsem;
|
goto out_upsem;
|
||||||
|
|
||||||
out_putfd:
|
out:
|
||||||
|
dput(dentry);
|
||||||
mntput(mqueue_mnt);
|
mntput(mqueue_mnt);
|
||||||
|
out_putfd:
|
||||||
put_unused_fd(fd);
|
put_unused_fd(fd);
|
||||||
out_err:
|
out_err:
|
||||||
fd = error;
|
fd = error;
|
||||||
|
|
Loading…
Reference in New Issue