Eric Lee / smarc-fsl-linux-kernel

04 Jan, 2012

1 commit

07 Dec, 2011

1 commit

  • 02125a826   fix apparmor dereferencing potentially freed dentry, sanitize __d_path() API ... Browse Code »
    1

    __d_path() API is asking for trouble and in case of apparmor d_namespace_path()
    getting just that. The root cause is that when __d_path() misses the root
    it had been told to look for, it stores the location of the most remote ancestor
    in *root. Without grabbing references. Sure, at the moment of call it had
    been pinned down by what we have in *path. And if we raced with umount -l, we
    could have very well stopped at vfsmount/dentry that got freed as soon as
    prepend_path() dropped vfsmount_lock.

    It is safe to compare these pointers with pre-existing (and known to be still
    alive) vfsmount and dentry, as long as all we are asking is "is it the same
    address?". Dereferencing is not safe and apparmor ended up stepping into
    that. d_namespace_path() really wants to examine the place where we stopped,
    even if it's not connected to our namespace. As the result, it looked
    at ->d_sb->s_magic of a dentry that might've been already freed by that point.
    All other callers had been careful enough to avoid that, but it's really
    a bad interface - it invites that kind of trouble.

    The fix is fairly straightforward, even though it's bigger than I'd like:
    * prepend_path() root argument becomes const.
    * __d_path() is never called with NULL/NULL root. It was a kludge
    to start with. Instead, we have an explicit function - d_absolute_root().
    Same as __d_path(), except that it doesn't get root passed and stops where
    it stops. apparmor and tomoyo are using it.
    * __d_path() returns NULL on path outside of root. The main
    caller is show_mountinfo() and that's precisely what we pass root for - to
    skip those outside chroot jail. Those who don't want that can (and do)
    use d_path().
    * __d_path() root argument becomes const. Everyone agrees, I hope.
    * apparmor does *NOT* try to use __d_path() or any of its variants
    when it sees that path->mnt is an internal vfsmount. In that case it's
    definitely not mounted anywhere and dentry_path() is exactly what we want
    there. Handling of sysctl()-triggered weirdness is moved to that place.
    * if apparmor is asked to do pathname relative to chroot jail
    and __d_path() tells it we it's not in that jail, the sucker just calls
    d_absolute_path() instead. That's the other remaining caller of __d_path(),
    BTW.
    * seq_path_root() does _NOT_ return -ENAMETOOLONG (it's stupid anyway -
    the normal seq_file logics will take care of growing the buffer and redoing
    the call of ->show() just fine). However, if it gets path not reachable
    from root, it returns SEQ_SKIP. The only caller adjusted (i.e. stopped
    ignoring the return value as it used to do).

    Reviewed-by: John Johansen
    ACKed-by: John Johansen
    Signed-off-by: Al Viro
    Cc: stable@vger.kernel.org

    Al Viro
     

26 Oct, 2010

1 commit

23 Sep, 2010

1 commit

08 Mar, 2010

1 commit

23 Feb, 2010

1 commit

11 Feb, 2010

1 commit

24 Sep, 2009

2 commits

  • f84398068   vfs: seq_file: add helpers for data filling ... Browse Code »

    Add two helpers that allow access to the seq_file's own buffer, but
    hide the internal details of seq_files.

    This allows easier implementation of special purpose filling
    functions. It also cleans up some existing functions which duplicated
    the seq_file logic.

    Make these inline functions in seq_file.h, as suggested by Al.

    Signed-off-by: Miklos Szeredi
    Acked-by: Hugh Dickins
    Signed-off-by: Al Viro

    Miklos Szeredi
     
  • 7a62cc102   seq_file: return a negative error code when seq_path_root() fails. ... Browse Code »

    seq_path_root() is returning a return value of successful __d_path()
    instead of returning a negative value when mangle_path() failed.

    This is not a bug so far because nobody is using return value of
    seq_path_root().

    Signed-off-by: Tetsuo Handa
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Al Viro

    Tetsuo Handa
     

19 Jun, 2009

1 commit

  • 0b923606e   seq_file: add function to write binary data ... Browse Code »

    seq_write() can be used to construct seq_files containing arbitrary data.
    Required by the gcov-profiling interface to synthesize binary profiling
    data files.

    Signed-off-by: Peter Oberparleiter
    Cc: Andi Kleen
    Cc: Huang Ying
    Cc: Li Wei
    Cc: Michael Ellerman
    Cc: Ingo Molnar
    Cc: Heiko Carstens
    Cc: Martin Schwidefsky
    Cc: Rusty Russell
    Cc: WANG Cong
    Cc: Sam Ravnborg
    Cc: Jeff Dike
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Peter Oberparleiter
     

30 Mar, 2009

1 commit

19 Feb, 2009

1 commit

  • 8f19d4729   seq_file: properly cope with pread ... Browse Code »

    Currently seq_read assumes that the offset passed to it is always the
    offset it passed to user space. In the case pread this assumption is
    broken and we do the wrong thing when presented with pread.

    To solve this I introduce an offset cache inside of struct seq_file so we
    know where our logical file position is. Then in seq_read if we try to
    read from another offset we reset our data structures and attempt to go to
    the offset user space wanted.

    [akpm@linux-foundation.org: restore FMODE_PWRITE]
    [pjt@google.com: seq_open needs its fmode opened up to take advantage of this]
    Signed-off-by: Eric Biederman
    Cc: Alexey Dobriyan
    Cc: Al Viro
    Cc: Paul Turner
    Cc: [2.6.25.x, 2.6.26.x, 2.6.27.x, 2.6.28.x]
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric Biederman
     

06 Feb, 2009

2 commits

  • f01d1d546   seq_file: fix big-enough lseek() + read() ... Browse Code »

    lseek() further than length of the file will leave stale ->index
    (second-to-last during iteration). Next seq_read() will not notice
    that ->f_pos is big enough to return 0, but will print last item
    as if ->f_pos is pointing to it.

    Introduced in commit cb510b8172602a66467f3551b4be1911f5a7c8c2
    aka "seq_file: more atomicity in traverse()".

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     
  • 33da8892a   seq_file: move traverse so it can be used from seq_read ... Browse Code »

    In 2.6.25 some /proc files were converted to use the seq_file
    infrastructure. But seq_files do not correctly support pread(), which
    broke some usersapce applications.

    To handle pread correctly we can't assume that f_pos is where we left it
    in seq_read. So move traverse() so that we can eventually use it in
    seq_read and do thus some day support pread().

    Signed-off-by: Eric Biederman
    Cc: Paul Turner
    Cc: Alexey Dobriyan
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Eric Biederman
     

04 Jan, 2009

1 commit

  • 7d3b56ba3   Merge branch 'cpus4096-for-linus-3' of git://git.kernel.org/pub/scm/linux/kernel… ... Browse Code »

    …/git/tip/linux-2.6-tip

    * 'cpus4096-for-linus-3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (77 commits)
    x86: setup_per_cpu_areas() cleanup
    cpumask: fix compile error when CONFIG_NR_CPUS is not defined
    cpumask: use alloc_cpumask_var_node where appropriate
    cpumask: convert shared_cpu_map in acpi_processor* structs to cpumask_var_t
    x86: use cpumask_var_t in acpi/boot.c
    x86: cleanup some remaining usages of NR_CPUS where s/b nr_cpu_ids
    sched: put back some stack hog changes that were undone in kernel/sched.c
    x86: enable cpus display of kernel_max and offlined cpus
    ia64: cpumask fix for is_affinity_mask_valid()
    cpumask: convert RCU implementations, fix
    xtensa: define __fls
    mn10300: define __fls
    m32r: define __fls
    h8300: define __fls
    frv: define __fls
    cris: define __fls
    cpumask: CONFIG_DISABLE_OBSOLETE_CPUMASK_FUNCTIONS
    cpumask: zero extra bits in alloc_cpumask_var_node
    cpumask: replace for_each_cpu_mask_nr with for_each_cpu in kernel/time/
    cpumask: convert mm/
    ...

    Linus Torvalds
     

01 Jan, 2009

1 commit

  • 52afeefb9   expand some comments (d_path / seq_path) ... Browse Code »

    Explain that you really need to use the return value of d_path rather than
    the buffer you passed into it.

    Also fix the comment for seq_path(), the function arguments changed
    recently but the comment hadn't been updated in sync.

    Signed-off-by: Arjan van de Ven
    Cc: Al Viro
    Cc: Christoph Hellwig
    Signed-off-by: Andrew Morton
    Signed-off-by: Al Viro

    Arjan van de Ven
     

30 Dec, 2008

1 commit

29 Nov, 2008

1 commit

24 Nov, 2008

1 commit

23 Nov, 2008

1 commit

20 Oct, 2008

2 commits

25 Aug, 2008

1 commit

13 Aug, 2008

1 commit

  • 50ac2d694   seq_file: add seq_cpumask(), seq_nodemask() ... Browse Code »

    Short enough reads from /proc/irq/*/smp_affinity return -EINVAL for no
    good reason.

    This became noticed with NR_CPUS=4096 patches, when length of printed
    representation of cpumask becase 1152, but cat(1) continued to read with
    1024-byte chunks. bitmap_scnprintf() in good faith fills buffer, returns
    1023, check returns -EINVAL.

    Fix it by switching to seq_file, so handler will just fill buffer and
    doesn't care about offsets, length, filling EOF and all this crap.

    For that add seq_bitmap(), and wrappers around it -- seq_cpumask() and
    seq_nodemask().

    Signed-off-by: Alexey Dobriyan
    Reviewed-by: Paul Jackson
    Cc: Mike Travis
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

23 Apr, 2008

4 commits

  • 9d1bc6013   [patch 2/7] vfs: mountinfo: add seq_file_root() ... Browse Code »

    Add a new function:

    seq_file_root()

    This is similar to seq_path(), but calculates the path relative to the
    given root, instead of current->fs->root. If the path was unreachable
    from root, then modify the root parameter to reflect this.

    Signed-off-by: Miklos Szeredi
    Signed-off-by: Al Viro

    Miklos Szeredi
     
  • 6092d0481   [patch 1/7] vfs: mountinfo: add dentry_path() ... Browse Code »

    [mszeredi@suse.cz] split big patch into managable chunks

    Add the following functions:

    dentry_path()
    seq_dentry()

    These are similar to d_path() and seq_path(). But instead of
    calculating the path within a mount namespace, they calculate the path
    from the root of the filesystem to a given dentry, ignoring mounts
    completely.

    Signed-off-by: Ram Pai
    Signed-off-by: Miklos Szeredi
    Signed-off-by: Al Viro

    Ram Pai
     
  • 94bc891b0   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 ... Browse Code »

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
    [PATCH] get rid of __exit_files(), __exit_fs() and __put_fs_struct()
    [PATCH] proc_readfd_common() race fix
    [PATCH] double-free of inode on alloc_file() failure exit in create_write_pipe()
    [PATCH] teach seq_file to discard entries
    [PATCH] umount_tree() will unhash everything itself
    [PATCH] get rid of more nameidata passing in namespace.c
    [PATCH] switch a bunch of LSM hooks from nameidata to path
    [PATCH] lock exclusively in collect_mounts() and drop_collected_mounts()
    [PATCH] move a bunch of declarations to fs/internal.h

    Linus Torvalds
     
  • 16abef0e9   fs: use loff_t type instead of long long ... Browse Code »

    Use offset type consistently.

    Signed-off-by: David Sterba
    Signed-off-by: Linus Torvalds

    David Sterba
     

22 Apr, 2008

1 commit

15 Feb, 2008

2 commits

  • cf28b4863   d_path: Make d_path() use a struct path ... Browse Code »

    d_path() is used on a pair. Lets use a struct path to
    reflect this.

    [akpm@linux-foundation.org: fix build in mm/memory.c]
    Signed-off-by: Jan Blunck
    Acked-by: Bryan Wu
    Acked-by: Christoph Hellwig
    Cc: Al Viro
    Cc: "J. Bruce Fields"
    Cc: Neil Brown
    Cc: Michael Halcrow
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jan Blunck
     
  • c32c2f63a   d_path: Make seq_path() use a struct path argument ... Browse Code »

    seq_path() is always called with a dentry and a vfsmount from a struct path.
    Make seq_path() take it directly as an argument.

    Signed-off-by: Jan Blunck
    Cc: Christoph Hellwig
    Cc: Al Viro
    Cc: "J. Bruce Fields"
    Cc: Neil Brown
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Jan Blunck
     

11 Oct, 2007

1 commit

17 Jul, 2007

2 commits

  • cb510b817   seq_file: more atomicity in traverse() ... Browse Code »

    Original problem: in some circumstances seq_file interface can present
    infinite proc file to the following script when normally said proc file is
    finite:

    while read line; do
    [do something with $line]
    done index'es being 0 and 1. Current one is 1, as
    bash prints second object line by line.

    Imagine first object being removed right before lseek().
    traverse() will be called, because there is negative offset.
    traverse() will reset ->index to 0 (!).
    traverse() will call ->next() and get NULL in any usual iterate-over-list
    code using list_for_each_entry_continue() and such. There is one object in
    list now after all...
    traverse() will return 0, lseek() will update file position and pretend
    everything is OK.

    So, what we have now: ->f_pos points to place where second object will be
    printed, but ->index is 0. seq_read() instead of returning EOF, will start
    printing first line of first object every time it's called, until enough
    objects are added to ->f_pos return in bounds.

    Fix is to update ->index only after we're sure we saw enough objects down
    the road.

    Signed-off-by: Alexey Dobriyan
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     
  • 00c5746da   mutex_unlock() later in seq_lseek() ... Browse Code »

    All manipulations with struct seq_file::version are done under
    struct seq_file::lock except one introduced in commit
    d6b7a781c51c91dd054e5c437885205592faac21
    aka "[PATCH] Speed up /proc/pid/maps"

    Signed-off-by: Alexey Dobriyan
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

11 Jul, 2007

1 commit

  • bcf67e162   Make common helpers for seq_files that work with list_heads ... Browse Code »

    Many places in kernel use seq_file API to iterate over a regular list_head.
    The code for such iteration is identical in all the places, so it's worth
    introducing a common helpers.

    This makes code about 300 lines smaller:

    The first version of this patch made the helper functions static inline
    in the seq_file.h header. This patch moves them to the fs/seq_file.c as
    Andrew proposed. The vmlinux .text section sizes are as follows:

    2.6.22-rc1-mm1: 0x001794d5
    with the previous version: 0x00179505
    with this patch: 0x00179135

    The config file used was make allnoconfig with the "y" inclusion of all
    the possible options to make the files modified by the patch compile plus
    drivers I have on the test node.

    This patch:

    Many places in kernel use seq_file API to iterate over a regular list_head.
    The code for such iteration is identical in all the places, so it's worth
    introducing a common helpers.

    Signed-off-by: Pavel Emelianov
    Cc: "David S. Miller"
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Pavel Emelianov
     

09 Dec, 2006

1 commit

  • 0f7fc9e4d   [PATCH] VFS: change struct file to use struct path ... Browse Code »

    This patch changes struct file to use struct path instead of having
    independent pointers to struct dentry and struct vfsmount, and converts all
    users of f_{dentry,vfsmnt} in fs/ to use f_path.{dentry,mnt}.

    Additionally, it adds two #define's to make the transition easier for users of
    the f_dentry and f_vfsmnt.

    Signed-off-by: Josef "Jeff" Sipek
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Josef "Jeff" Sipek
     

08 Dec, 2006

1 commit

23 Mar, 2006

1 commit

  • 0ac1759ab   [PATCH] sem2mutex: fs/seq_file.c ... Browse Code »

    Semaphore to mutex conversion.

    The conversion was generated via scripts, and the result was validated
    automatically via a script as well.

    Signed-off-by: Ingo Molnar
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Ingo Molnar
     

08 Nov, 2005

1 commit

01 May, 2005

1 commit