Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2024-12-29 17:23:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[PATCH] Fix double decrement of mqueue_mnt->mnt_count in sys_mq_open

Browse Source 
Fixed the refcounting on failure exits in sys_mq_open() and
cleaned the logics up.  Rules are actually pretty simple - dentry_open()
expects vfsmount and dentry to be pinned down and it either transfers
them into created struct file or drops them.  Old code had been very
confused in that area - if dentry_open() had failed either in do_open()
or do_create(), we ended up dentry and mqueue_mnt dropped twice, once
by dentry_open() cleanup and then by sys_mq_open().

Fix consists of making the rules for do_create() and do_open()
same as for dentry_open() and updating the sys_mq_open() accordingly;
that actually leads to more straightforward code and less work on
normal path.

Signed-off-by: Al Viro <aviro@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Alexander Viro 2006-01-14 15:29:55 -05:00 committed by Linus Torvalds
parent 12dbf3fc4d
commit 7c7dce9209
1 changed files with 33 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

59
ipc/mqueue.c
View File

@ -599,15 +599,16 @@ static int mq_attr_ok(struct mq_attr *attr)
static struct file *do_create(struct dentry *dir, struct dentry *dentry,
int oflag, mode_t mode, struct mq_attr __user *u_attr)
{
struct file *filp;
struct mq_attr attr;
int ret;
if (u_attr != NULL) {
if (u_attr) {
ret = -EFAULT;
if (copy_from_user(&attr, u_attr, sizeof(attr)))
return ERR_PTR(-EFAULT);
goto out;
ret = -EINVAL;
if (!mq_attr_ok(&attr))
return ERR_PTR(-EINVAL);
goto out;
/* store for use during create */
dentry->d_fsdata = &attr;
}
@ -616,13 +617,14 @@ static struct file *do_create(struct dentry *dir, struct dentry *dentry,
ret = vfs_create(dir->d_inode, dentry, mode, NULL);
dentry->d_fsdata = NULL;
if (ret)
return ERR_PTR(ret);
goto out;
filp = dentry_open(dentry, mqueue_mnt, oflag);
if (!IS_ERR(filp))
dget(dentry);
return dentry_open(dentry, mqueue_mnt, oflag);
return filp;
out:
dput(dentry);
mntput(mqueue_mnt);
return ERR_PTR(ret);
}
/* Opens existing queue */
@ -630,20 +632,20 @@ static struct file *do_open(struct dentry *dentry, int oflag)
{
static int oflag2acc[O_ACCMODE] = { MAY_READ, MAY_WRITE,
MAY_READ | MAY_WRITE };
struct file *filp;
if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY))
if ((oflag & O_ACCMODE) == (O_RDWR | O_WRONLY)) {
dput(dentry);
mntput(mqueue_mnt);
return ERR_PTR(-EINVAL);
}
if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL))
if (permission(dentry->d_inode, oflag2acc[oflag & O_ACCMODE], NULL)) {
dput(dentry);
mntput(mqueue_mnt);
return ERR_PTR(-EACCES);
}
filp = dentry_open(dentry, mqueue_mnt, oflag);
if (!IS_ERR(filp))
dget(dentry);
return filp;
return dentry_open(dentry, mqueue_mnt, oflag);
}
asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
@ -671,17 +673,20 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
if (oflag & O_CREAT) {
if (dentry->d_inode) { /* entry already exists */
filp = (oflag & O_EXCL) ? ERR_PTR(-EEXIST) :
do_open(dentry, oflag);
error = -EEXIST;
if (oflag & O_EXCL)
goto out;
filp = do_open(dentry, oflag);
} else {
filp = do_create(mqueue_mnt->mnt_root, dentry,
oflag, mode, u_attr);
}
} else
filp = (dentry->d_inode) ? do_open(dentry, oflag) :
ERR_PTR(-ENOENT);
dput(dentry);
} else {
error = -ENOENT;
if (!dentry->d_inode)
goto out;
filp = do_open(dentry, oflag);
}
if (IS_ERR(filp)) {
error = PTR_ERR(filp);
@ -692,8 +697,10 @@ asmlinkage long sys_mq_open(const char __user *u_name, int oflag, mode_t mode,
fd_install(fd, filp);
goto out_upsem;
out_putfd:
out:
dput(dentry);
mntput(mqueue_mnt);
out_putfd:
put_unused_fd(fd);
out_err:
fd = error;