mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2025-01-10 07:00:48 +00:00
3f259d092c
The reiserfs mutex already depends on the inode mutex, so we can't lock the inode mutex in reiserfs_unpack() without using the safe locking API, because reiserfs_unpack() is always called with the reiserfs mutex locked. This fixes: ======================================================= [ INFO: possible circular locking dependency detected ] 2.6.35c #13 ------------------------------------------------------- lilo/1606 is trying to acquire lock: (&sb->s_type->i_mutex_key#8){+.+.+.}, at: [<d0329450>] reiserfs_unpack+0x60/0x110 [reiserfs] but task is already holding lock: (&REISERFS_SB(s)->lock){+.+.+.}, at: [<d032a268>] reiserfs_write_lock+0x28/0x40 [reiserfs] which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #1 (&REISERFS_SB(s)->lock){+.+.+.}: [<c1056347>] lock_acquire+0x67/0x80 [<c12f083d>] __mutex_lock_common+0x4d/0x410 [<c12f0c58>] mutex_lock_nested+0x18/0x20 [<d032a268>] reiserfs_write_lock+0x28/0x40 [reiserfs] [<d0329e9a>] reiserfs_lookup_privroot+0x2a/0x90 [reiserfs] [<d0316b81>] reiserfs_fill_super+0x941/0xe60 [reiserfs] [<c10b7d17>] get_sb_bdev+0x117/0x170 [<d0313e21>] get_super_block+0x21/0x30 [reiserfs] [<c10b74ba>] vfs_kern_mount+0x6a/0x1b0 [<c10b7659>] do_kern_mount+0x39/0xe0 [<c10cebe0>] do_mount+0x340/0x790 [<c10cf0b4>] sys_mount+0x84/0xb0 [<c12f25cd>] syscall_call+0x7/0xb -> #0 (&sb->s_type->i_mutex_key#8){+.+.+.}: [<c1056186>] __lock_acquire+0x1026/0x1180 [<c1056347>] lock_acquire+0x67/0x80 [<c12f083d>] __mutex_lock_common+0x4d/0x410 [<c12f0c58>] mutex_lock_nested+0x18/0x20 [<d0329450>] reiserfs_unpack+0x60/0x110 [reiserfs] [<d0329772>] reiserfs_ioctl+0x272/0x320 [reiserfs] [<c10c3228>] vfs_ioctl+0x28/0xa0 [<c10c3c5d>] do_vfs_ioctl+0x32d/0x5c0 [<c10c3f53>] sys_ioctl+0x63/0x70 [<c12f25cd>] syscall_call+0x7/0xb other info that might help us debug this: 1 lock held by lilo/1606: #0: (&REISERFS_SB(s)->lock){+.+.+.}, at: [<d032a268>] reiserfs_write_lock+0x28/0x40 [reiserfs] stack backtrace: Pid: 1606, comm: lilo Not tainted 2.6.35c #13 Call Trace: [<c1056186>] __lock_acquire+0x1026/0x1180 [<c1056347>] lock_acquire+0x67/0x80 [<c12f083d>] __mutex_lock_common+0x4d/0x410 [<c12f0c58>] mutex_lock_nested+0x18/0x20 [<d0329450>] reiserfs_unpack+0x60/0x110 [reiserfs] [<d0329772>] reiserfs_ioctl+0x272/0x320 [reiserfs] [<c10c3228>] vfs_ioctl+0x28/0xa0 [<c10c3c5d>] do_vfs_ioctl+0x32d/0x5c0 [<c10c3f53>] sys_ioctl+0x63/0x70 [<c12f25cd>] syscall_call+0x7/0xb Reported-by: Jarek Poplawski <jarkao2@gmail.com> Tested-by: Jarek Poplawski <jarkao2@gmail.com> Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com> Cc: Jeff Mahoney <jeffm@suse.com> Cc: <stable@kernel.org> [2.6.32 and later] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
230 lines
5.5 KiB
C
230 lines
5.5 KiB
C
/*
|
|
* Copyright 2000 by Hans Reiser, licensing governed by reiserfs/README
|
|
*/
|
|
|
|
#include <linux/capability.h>
|
|
#include <linux/fs.h>
|
|
#include <linux/mount.h>
|
|
#include <linux/reiserfs_fs.h>
|
|
#include <linux/time.h>
|
|
#include <asm/uaccess.h>
|
|
#include <linux/pagemap.h>
|
|
#include <linux/smp_lock.h>
|
|
#include <linux/compat.h>
|
|
|
|
/*
|
|
* reiserfs_ioctl - handler for ioctl for inode
|
|
* supported commands:
|
|
* 1) REISERFS_IOC_UNPACK - try to unpack tail from direct item into indirect
|
|
* and prevent packing file (argument arg has to be non-zero)
|
|
* 2) REISERFS_IOC_[GS]ETFLAGS, REISERFS_IOC_[GS]ETVERSION
|
|
* 3) That's all for a while ...
|
|
*/
|
|
long reiserfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct inode *inode = filp->f_path.dentry->d_inode;
|
|
unsigned int flags;
|
|
int err = 0;
|
|
|
|
reiserfs_write_lock(inode->i_sb);
|
|
|
|
switch (cmd) {
|
|
case REISERFS_IOC_UNPACK:
|
|
if (S_ISREG(inode->i_mode)) {
|
|
if (arg)
|
|
err = reiserfs_unpack(inode, filp);
|
|
} else
|
|
err = -ENOTTY;
|
|
break;
|
|
/*
|
|
* following two cases are taken from fs/ext2/ioctl.c by Remy
|
|
* Card (card@masi.ibp.fr)
|
|
*/
|
|
case REISERFS_IOC_GETFLAGS:
|
|
if (!reiserfs_attrs(inode->i_sb)) {
|
|
err = -ENOTTY;
|
|
break;
|
|
}
|
|
|
|
flags = REISERFS_I(inode)->i_attrs;
|
|
i_attrs_to_sd_attrs(inode, (__u16 *) & flags);
|
|
err = put_user(flags, (int __user *)arg);
|
|
break;
|
|
case REISERFS_IOC_SETFLAGS:{
|
|
if (!reiserfs_attrs(inode->i_sb)) {
|
|
err = -ENOTTY;
|
|
break;
|
|
}
|
|
|
|
err = mnt_want_write(filp->f_path.mnt);
|
|
if (err)
|
|
break;
|
|
|
|
if (!is_owner_or_cap(inode)) {
|
|
err = -EPERM;
|
|
goto setflags_out;
|
|
}
|
|
if (get_user(flags, (int __user *)arg)) {
|
|
err = -EFAULT;
|
|
goto setflags_out;
|
|
}
|
|
/*
|
|
* Is it quota file? Do not allow user to mess with it
|
|
*/
|
|
if (IS_NOQUOTA(inode)) {
|
|
err = -EPERM;
|
|
goto setflags_out;
|
|
}
|
|
if (((flags ^ REISERFS_I(inode)->
|
|
i_attrs) & (REISERFS_IMMUTABLE_FL |
|
|
REISERFS_APPEND_FL))
|
|
&& !capable(CAP_LINUX_IMMUTABLE)) {
|
|
err = -EPERM;
|
|
goto setflags_out;
|
|
}
|
|
if ((flags & REISERFS_NOTAIL_FL) &&
|
|
S_ISREG(inode->i_mode)) {
|
|
int result;
|
|
|
|
result = reiserfs_unpack(inode, filp);
|
|
if (result) {
|
|
err = result;
|
|
goto setflags_out;
|
|
}
|
|
}
|
|
sd_attrs_to_i_attrs(flags, inode);
|
|
REISERFS_I(inode)->i_attrs = flags;
|
|
inode->i_ctime = CURRENT_TIME_SEC;
|
|
mark_inode_dirty(inode);
|
|
setflags_out:
|
|
mnt_drop_write(filp->f_path.mnt);
|
|
break;
|
|
}
|
|
case REISERFS_IOC_GETVERSION:
|
|
err = put_user(inode->i_generation, (int __user *)arg);
|
|
break;
|
|
case REISERFS_IOC_SETVERSION:
|
|
if (!is_owner_or_cap(inode)) {
|
|
err = -EPERM;
|
|
break;
|
|
}
|
|
err = mnt_want_write(filp->f_path.mnt);
|
|
if (err)
|
|
break;
|
|
if (get_user(inode->i_generation, (int __user *)arg)) {
|
|
err = -EFAULT;
|
|
goto setversion_out;
|
|
}
|
|
inode->i_ctime = CURRENT_TIME_SEC;
|
|
mark_inode_dirty(inode);
|
|
setversion_out:
|
|
mnt_drop_write(filp->f_path.mnt);
|
|
break;
|
|
default:
|
|
err = -ENOTTY;
|
|
}
|
|
|
|
reiserfs_write_unlock(inode->i_sb);
|
|
|
|
return err;
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
long reiserfs_compat_ioctl(struct file *file, unsigned int cmd,
|
|
unsigned long arg)
|
|
{
|
|
/* These are just misnamed, they actually get/put from/to user an int */
|
|
switch (cmd) {
|
|
case REISERFS_IOC32_UNPACK:
|
|
cmd = REISERFS_IOC_UNPACK;
|
|
break;
|
|
case REISERFS_IOC32_GETFLAGS:
|
|
cmd = REISERFS_IOC_GETFLAGS;
|
|
break;
|
|
case REISERFS_IOC32_SETFLAGS:
|
|
cmd = REISERFS_IOC_SETFLAGS;
|
|
break;
|
|
case REISERFS_IOC32_GETVERSION:
|
|
cmd = REISERFS_IOC_GETVERSION;
|
|
break;
|
|
case REISERFS_IOC32_SETVERSION:
|
|
cmd = REISERFS_IOC_SETVERSION;
|
|
break;
|
|
default:
|
|
return -ENOIOCTLCMD;
|
|
}
|
|
|
|
return reiserfs_ioctl(file, cmd, (unsigned long) compat_ptr(arg));
|
|
}
|
|
#endif
|
|
|
|
int reiserfs_commit_write(struct file *f, struct page *page,
|
|
unsigned from, unsigned to);
|
|
int reiserfs_prepare_write(struct file *f, struct page *page,
|
|
unsigned from, unsigned to);
|
|
/*
|
|
** reiserfs_unpack
|
|
** Function try to convert tail from direct item into indirect.
|
|
** It set up nopack attribute in the REISERFS_I(inode)->nopack
|
|
*/
|
|
int reiserfs_unpack(struct inode *inode, struct file *filp)
|
|
{
|
|
int retval = 0;
|
|
int index;
|
|
struct page *page;
|
|
struct address_space *mapping;
|
|
unsigned long write_from;
|
|
unsigned long blocksize = inode->i_sb->s_blocksize;
|
|
|
|
if (inode->i_size == 0) {
|
|
REISERFS_I(inode)->i_flags |= i_nopack_mask;
|
|
return 0;
|
|
}
|
|
/* ioctl already done */
|
|
if (REISERFS_I(inode)->i_flags & i_nopack_mask) {
|
|
return 0;
|
|
}
|
|
|
|
/* we need to make sure nobody is changing the file size beneath
|
|
** us
|
|
*/
|
|
reiserfs_mutex_lock_safe(&inode->i_mutex, inode->i_sb);
|
|
reiserfs_write_lock(inode->i_sb);
|
|
|
|
write_from = inode->i_size & (blocksize - 1);
|
|
/* if we are on a block boundary, we are already unpacked. */
|
|
if (write_from == 0) {
|
|
REISERFS_I(inode)->i_flags |= i_nopack_mask;
|
|
goto out;
|
|
}
|
|
|
|
/* we unpack by finding the page with the tail, and calling
|
|
** reiserfs_prepare_write on that page. This will force a
|
|
** reiserfs_get_block to unpack the tail for us.
|
|
*/
|
|
index = inode->i_size >> PAGE_CACHE_SHIFT;
|
|
mapping = inode->i_mapping;
|
|
page = grab_cache_page(mapping, index);
|
|
retval = -ENOMEM;
|
|
if (!page) {
|
|
goto out;
|
|
}
|
|
retval = reiserfs_prepare_write(NULL, page, write_from, write_from);
|
|
if (retval)
|
|
goto out_unlock;
|
|
|
|
/* conversion can change page contents, must flush */
|
|
flush_dcache_page(page);
|
|
retval = reiserfs_commit_write(NULL, page, write_from, write_from);
|
|
REISERFS_I(inode)->i_flags |= i_nopack_mask;
|
|
|
|
out_unlock:
|
|
unlock_page(page);
|
|
page_cache_release(page);
|
|
|
|
out:
|
|
mutex_unlock(&inode->i_mutex);
|
|
reiserfs_write_unlock(inode->i_sb);
|
|
return retval;
|
|
}
|