summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAl Viro <viro@zeniv.linux.org.uk>2009-05-09 00:05:57 +0400
committerAl Viro <viro@zeniv.linux.org.uk>2009-05-09 18:51:34 +0400
commit2a32cebd6cbcc43996c3e2d114fa32ba1e71192a (patch)
tree0ad94849a7bc3e97cd19978005d1898c8bb44b36
parentf9dbd05bc97d1d4f17c2057612f6a8e4dbd039e0 (diff)
downloadlinux-2a32cebd6cbcc43996c3e2d114fa32ba1e71192a.tar.xz
Fix races around the access to ->s_options
Put generic_show_options read access to s_options under rcu_read_lock, split save_mount_options() into "we are setting it the first time" (uses in foo_fill_super()) and "we are relacing and freeing the old one", synchronize_rcu() before kfree() in the latter. Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r--drivers/isdn/capi/capifs.c3
-rw-r--r--fs/affs/super.c3
-rw-r--r--fs/afs/super.c4
-rw-r--r--fs/hpfs/super.c3
-rw-r--r--fs/namespace.c21
-rw-r--r--fs/reiserfs/super.c3
-rw-r--r--include/linux/fs.h1
7 files changed, 25 insertions, 13 deletions
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index b129409925af..8f9f3b5a3e8c 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -75,8 +75,7 @@ static int capifs_remount(struct super_block *s, int *flags, char *data)
}
}
- kfree(s->s_options);
- s->s_options = new_opt;
+ replace_mount_options(s, new_opt);
config.setuid = setuid;
config.setgid = setgid;
diff --git a/fs/affs/super.c b/fs/affs/super.c
index 5ce695e707fe..63f5183f263b 100644
--- a/fs/affs/super.c
+++ b/fs/affs/super.c
@@ -507,8 +507,7 @@ affs_remount(struct super_block *sb, int *flags, char *data)
kfree(new_opts);
return -EINVAL;
}
- kfree(sb->s_options);
- sb->s_options = new_opts;
+ replace_mount_options(sb, new_opts);
sbi->s_flags = mount_flags;
sbi->s_mode = mode;
diff --git a/fs/afs/super.c b/fs/afs/super.c
index 2753f16dd315..76828e5f8a39 100644
--- a/fs/afs/super.c
+++ b/fs/afs/super.c
@@ -408,17 +408,17 @@ static int afs_get_sb(struct file_system_type *fs_type,
deactivate_locked_super(sb);
goto error;
}
- sb->s_options = new_opts;
+ save_mount_options(sb, new_opts);
sb->s_flags |= MS_ACTIVE;
} else {
_debug("reuse");
- kfree(new_opts);
ASSERTCMP(sb->s_flags, &, MS_ACTIVE);
}
simple_set_mnt(mnt, sb);
afs_put_volume(params.volume);
afs_put_cell(params.cell);
+ kfree(new_opts);
_leave(" = 0 [%p]", sb);
return 0;
diff --git a/fs/hpfs/super.c b/fs/hpfs/super.c
index fecf402d7b8a..fc77965be841 100644
--- a/fs/hpfs/super.c
+++ b/fs/hpfs/super.c
@@ -423,8 +423,7 @@ static int hpfs_remount_fs(struct super_block *s, int *flags, char *data)
if (!(*flags & MS_RDONLY)) mark_dirty(s);
- kfree(s->s_options);
- s->s_options = new_opts;
+ replace_mount_options(s, new_opts);
return 0;
diff --git a/fs/namespace.c b/fs/namespace.c
index 0d2003fb4377..134d494158d9 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -695,12 +695,16 @@ static inline void mangle(struct seq_file *m, const char *s)
*/
int generic_show_options(struct seq_file *m, struct vfsmount *mnt)
{
- const char *options = mnt->mnt_sb->s_options;
+ const char *options;
+
+ rcu_read_lock();
+ options = rcu_dereference(mnt->mnt_sb->s_options);
if (options != NULL && options[0]) {
seq_putc(m, ',');
mangle(m, options);
}
+ rcu_read_unlock();
return 0;
}
@@ -721,11 +725,22 @@ EXPORT_SYMBOL(generic_show_options);
*/
void save_mount_options(struct super_block *sb, char *options)
{
- kfree(sb->s_options);
- sb->s_options = kstrdup(options, GFP_KERNEL);
+ BUG_ON(sb->s_options);
+ rcu_assign_pointer(sb->s_options, kstrdup(options, GFP_KERNEL));
}
EXPORT_SYMBOL(save_mount_options);
+void replace_mount_options(struct super_block *sb, char *options)
+{
+ char *old = sb->s_options;
+ rcu_assign_pointer(sb->s_options, options);
+ if (old) {
+ synchronize_rcu();
+ kfree(old);
+ }
+}
+EXPORT_SYMBOL(replace_mount_options);
+
#ifdef CONFIG_PROC_FS
/* iterator */
static void *m_start(struct seq_file *m, loff_t *pos)
diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
index d444fe0013a4..1215a4f50cd2 100644
--- a/fs/reiserfs/super.c
+++ b/fs/reiserfs/super.c
@@ -1316,8 +1316,7 @@ static int reiserfs_remount(struct super_block *s, int *mount_flags, char *arg)
}
out_ok:
- kfree(s->s_options);
- s->s_options = new_opts;
+ replace_mount_options(s, new_opts);
return 0;
out_err:
diff --git a/include/linux/fs.h b/include/linux/fs.h
index ed788426f464..3b534e527e09 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2368,6 +2368,7 @@ extern void file_update_time(struct file *file);
extern int generic_show_options(struct seq_file *m, struct vfsmount *mnt);
extern void save_mount_options(struct super_block *sb, char *options);
+extern void replace_mount_options(struct super_block *sb, char *options);
static inline ino_t parent_ino(struct dentry *dentry)
{