linux-toradex.git/fs/locks.c, branch v4.4.93

locks: use file_inode()

2016-08-10T09:49:27+00:00

commit 6343a2120862f7023006c8091ad95c1f16a32077 upstream.

(Another one for the f_path debacle.)

ltp fcntl33 testcase caused an Oops in selinux_file_send_sigiotask.

The reason is that generic_add_lease() used filp->f_path.dentry->inode
while all the others use file_inode().  This makes a difference for files
opened on overlayfs since the former will point to the overlay inode the
latter to the underlying inode.

So generic_add_lease() added the lease to the overlay inode and
generic_delete_lease() removed it from the underlying inode.  When the file
was released the lease remained on the overlay inode's lock list, resulting
in use after free.

Reported-by: Eryu Guan 
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Miklos Szeredi 
Reviewed-by: Jeff Layton 
Signed-off-by: J. Bruce Fields 
Signed-off-by: Greg Kroah-Hartman

locks: fix unlock when fcntl_setlk races with a close

2016-03-03T23:07:12+00:00

commit 7f3697e24dc3820b10f445a4a7d914fc356012d1 upstream.

Dmitry reported that he was able to reproduce the WARN_ON_ONCE that
fires in locks_free_lock_context when the flc_posix list isn't empty.

The problem turns out to be that we're basically rebuilding the
file_lock from scratch in fcntl_setlk when we discover that the setlk
has raced with a close. If the l_whence field is SEEK_CUR or SEEK_END,
then we may end up with fl_start and fl_end values that differ from
when the lock was initially set, if the file position or length of the
file has changed in the interim.

Fix this by just reusing the same lock request structure, and simply
override fl_type value with F_UNLCK as appropriate. That ensures that
we really are unlocking the lock that was initially set.

While we're there, make sure that we do pop a WARN_ON_ONCE if the
removal ever fails. Also return -EBADF in this event, since that's
what we would have returned if the close had happened earlier.

Cc: Alexander Viro 
Fixes: c293621bbf67 (stale POSIX lock handling)
Reported-by: Dmitry Vyukov 
Signed-off-by: Jeff Layton 
Acked-by: "J. Bruce Fields" 
Signed-off-by: Greg Kroah-Hartman

locks: cleanup posix_lock_inode_wait and flock_lock_inode_wait

2015-10-22T18:57:42+00:00

All callers use locks_lock_inode_wait() instead.

Signed-off-by: Benjamin Coddington 
Signed-off-by: Jeff Layton

Move locks API users to locks_lock_inode_wait()

2015-10-22T18:57:36+00:00

Instead of having users check for FL_POSIX or FL_FLOCK to call the correct
locks API function, use the check within locks_lock_inode_wait().  This
allows for some later cleanup.

Signed-off-by: Benjamin Coddington 
Signed-off-by: Jeff Layton

locks: introduce locks_lock_inode_wait()

2015-10-22T18:57:20+00:00

Users of the locks API commonly call either posix_lock_file_wait() or
flock_lock_file_wait() depending upon the lock type.  Add a new function
locks_lock_inode_wait() which will check and call the correct function for
the type of lock passed in.

Signed-off-by: Benjamin Coddington 
Signed-off-by: Jeff Layton

locks: Use more file_inode and fix a comment

2015-10-15T13:07:07+00:00

Signed-off-by: Benjamin Coddington 
Signed-off-by: Jeff Layton

fs: fix data races on inode->i_flctx

2015-09-21T11:27:35+00:00

locks_get_lock_context() uses cmpxchg() to install i_flctx.
cmpxchg() is a release operation which is correct. But it uses
a plain load to load i_flctx. This is incorrect. Subsequent loads
from i_flctx can hoist above the load of i_flctx pointer itself
and observe uninitialized garbage there. This in turn can lead
to corruption of ctx->flc_lock and other members.

Documentation/memory-barriers.txt explicitly requires to use
a barrier in such context:
"A load-load control dependency requires a full read memory barrier".

Use smp_load_acquire() in locks_get_lock_context() and in bunch
of other functions that can proceed concurrently with
locks_get_lock_context().

The data race was found with KernelThreadSanitizer (KTSAN).

Signed-off-by: Dmitry Vyukov 
Signed-off-by: Jeff Layton

fs: fix fs/locks.c kernel-doc warning

2015-08-31T20:27:25+00:00

Fix kernel-doc warnings in fs/locks.c:

Warning(..//fs/locks.c:1577): No description found for parameter 'flags'

Signed-off-by: Randy Dunlap 
Signed-off-by: Jeff Layton

locks: inline posix_lock_file_wait and flock_lock_file_wait

2015-07-13T10:29:11+00:00

They just call file_inode and then the corresponding *_inode_file_wait
function. Just make them static inlines instead.

Signed-off-by: Jeff Layton

locks: new helpers - flock_lock_inode_wait and posix_lock_inode_wait

2015-07-13T10:29:11+00:00

Allow callers to pass in an inode instead of a filp.

Signed-off-by: Jeff Layton 
Reviewed-by: "J. Bruce Fields" 
Tested-by: "J. Bruce Fields"