Files
lucaswei 64c0256540 Merge upstream-linux-4.4.y (4.4.210) into android-msm-wahoo-4.4-lts
Linux 4.4.210
    drm/i915/gen9: Clear residual context state on context switch
    netfilter: ipset: avoid null deref when IPSET_ATTR_LINENO is present
  * netfilter: arp_tables: init netns pointer in xt_tgchk_param struct
      net/ipv4/netfilter/arp_tables.c
  * USB: Fix: Don't skip endpoint descriptors with maxpacket=0
      drivers/usb/core/config.c
    rtl8xxxu: prevent leaking urb
    scsi: bfa: release allocated memory in case of error
    mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
    mwifiex: fix possible heap overflow in mwifiex_process_country_ie()
  * tty: always relink the port
      drivers/tty/tty_port.c
  * tty: link tty and port before configuring it as console
      drivers/tty/serial/serial_core.c
      drivers/tty/tty_port.c
    staging: rtl8188eu: Add device code for TP-Link TL-WN727N v5.21
    usb: musb: dma: Correct parameter passed to IRQ handler
    usb: musb: Disable pullup at init
    USB: serial: option: add ZLP support for 0x1bc7/0x9010
    staging: vt6656: set usb_set_intfdata on driver fail.
    can: can_dropped_invalid_skb(): ensure an initialized headroom in outgoing CAN sk_buffs
    can: mscan: mscan_rx_poll(): fix rx path lockup when returning from polling to irq mode
    can: gs_usb: gs_usb_probe(): use descriptors of current altsetting
    drm/dp_mst: correct the shifting in DP_REMOTE_I2C_READ
  * Input: add safety guards to input_set_keycode()
      drivers/input/input.c
  * HID: hid-input: clear unmapped usages
      drivers/hid/hid-input.c
  * HID: uhid: Fix returning EPOLLOUT from uhid_char_poll
      drivers/hid/uhid.c
  * HID: Fix slab-out-of-bounds read in hid_field_extract
      drivers/hid/hid-core.c
    tracing: Have stack tracer compile when MCOUNT_INSN_SIZE is not defined
    kernel/trace: Fix do not unregister tracepoints when register sched_migrate_task fail
  * ALSA: usb-audio: Apply the sample rate quirk for Bose Companion 5
      sound/usb/quirks.c
    usb: chipidea: host: Disable port power only if previously enabled
  * chardev: Avoid potential use-after-free in 'chrdev_open()'
      fs/char_dev.c
  * kobject: Export kobject_get_unless_zero()
      include/linux/kobject.h
      lib/kobject.c
Linux 4.4.209
    USB: serial: option: add Telit ME910G1 0x110a composition
  * USB: core: fix check for duplicate endpoints
      drivers/usb/core/config.c
  * macvlan: do not assume mac_header is set in macvlan_broadcast()
      include/linux/if_ether.h
    vxlan: fix tos value before xmit
    vlan: fix memory leak in vlan_dev_set_egress_priority
    vlan: vlan_changelink() should propagate errors
  * tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
      net/ipv4/tcp_input.c
    sctp: free cmd->obj.chunk for the unprocessed SCTP_CMD_REPLY
    pkt_sched: fq: do not accept silly TCA_FQ_QUANTUM
    net: usb: lan78xx: fix possible skb leak
    net: stmmac: dwmac-sunxi: Allow all RGMII modes
    llc2: Fix return statement of llc_stat_ev_rx_null_dsap_xid_c (and _test_c)
    parisc: Fix compiler warnings in debug_core.c
  * kconfig: don't crash on NULL expressions in expr_eq()
      scripts/kconfig/expr.c
    regulator: rn5t618: fix module aliases
    ASoC: wm8962: fix lambda value
  * rfkill: Fix incorrect check to avoid NULL pointer dereference
      net/rfkill/core.c
    net: usb: lan78xx: Fix error message format specifier
    bnx2x: Fix logic to get total no. of PFs per engine
    bnx2x: Do not handle requests from VFs after parity
    powerpc: Ensure that swiotlb buffer is allocated from low memory
    ARM: dts: am437x-gp/epos-evm: fix panel compatible
    netfilter: uapi: Avoid undefined left-shift in xt_sctp.h
    ARM: vexpress: Set-up shared OPP table instead of individual for each CPU
  * netfilter: ctnetlink: netns exit must wait for callbacks
      net/netfilter/nf_conntrack_netlink.c
    locking/spinlock/debug: Fix various data races
  * pstore/ram: Write new dumps to start of recycled zones
      fs/pstore/ram.c
    locking/x86: Remove the unused atomic_inc_short() methd
    s390/smp: fix physical to logical CPU map for SMT
  * net: add annotations on hh->hh_len lockless accesses
      include/net/neighbour.h
      net/core/neighbour.c
      net/ethernet/eth.c
    ath9k_htc: Discard undersized packets
    ath9k_htc: Modify byte order for an error message
    powerpc/pseries/hvconsole: Fix stack overread via udbg
    drm/mst: Fix MST sideband up-reply failure handling
  * tty: serial: msm_serial: Fix lockup for sysrq and oops
      drivers/tty/serial/msm_serial.c
  * Bluetooth: delete a stray unlock
      net/bluetooth/l2cap_core.c
    Bluetooth: btusb: fix PM leak in error case of setup
    ftrace: Avoid potential division by zero in function profiler
    ALSA: cs4236: fix error return comparison of an unsigned integer
  * gpiolib: fix up emulated open drain outputs
      drivers/gpio/gpiolib.c
  * compat_ioctl: block: handle Persistent Reservations
      block/compat_ioctl.c
  * dmaengine: Fix access to uninitialized dma_slave_caps
      include/linux/dmaengine.h
  * locks: print unsigned ino in /proc/locks
      fs/locks.c
    MIPS: Avoid VDSO ABI breakage due to global register variable
    ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code
    Revert "perf report: Add warning when libunwind not compiled in"
  * taskstats: fix data-race
      kernel/taskstats.c
    xfs: fix mount failure crash on invalid iclog memory access
    xen/balloon: fix ballooned page accounting without hotplug enabled
    s390/cpum_sf: Avoid SBD overflow condition in irq handler
    s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits
    md: raid1: check rdev before reference in raid1_sync_request func
    usb: gadget: fix wrong endpoint desc
    scsi: libsas: stop discovering if oob mode is disconnected
    scsi: iscsi: qla4xxx: fix double free in probe
    scsi: qla2xxx: Don't call qlt_async_event twice
    scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func
    RDMA/cma: add missed unregister_pernet_subsys in init failure
  * PM / devfreq: Don't fail devfreq_dev_release if not in list
      drivers/devfreq/devfreq.c
Linux 4.4.208
  * tcp: do not send empty skb from tcp_write_xmit()
      net/ipv4/tcp_output.c
    mmc: sdhci: Update the tuning failed messages to pr_debug level
  * hrtimer: Annotate lockless access to timer->state
      include/linux/hrtimer.h
      kernel/time/hrtimer.c
  * net: icmp: fix data-race in cmp_global_allow()
      net/ipv4/icmp.c
    netfilter: bridge: make sure to pull arp header in br_nf_forward_arp()
    6pack,mkiss: fix possible deadlock
  * netfilter: ebtables: compat: reject all padding in matches/watchers
      net/bridge/netfilter/ebtables.c
    net: davinci_cpdma: use dma_addr_t for DMA address
  * filldir[64]: remove WARN_ON_ONCE() for bad directory entries
      fs/readdir.c
  * Make filldir[64]() verify the directory entry filename is valid
      fs/readdir.c
    ALSA: hda - Downgrade error message for single-cmd fallback
  * kernel: sysctl: make drop_caches write-only
      kernel/sysctl.c
    ocfs2: fix passing zero to 'PTR_ERR' warning
    s390/cpum_sf: Check for SDBT and SDB consistency
  * libfdt: define INT32_MAX and UINT32_MAX in libfdt_env.h
      include/linux/libfdt_env.h
    perf regs: Make perf_reg_name() return "unknown" instead of NULL
    cdrom: respect device capabilities during opening action
  * scripts/kallsyms: fix definitely-lost memory leak
      scripts/kallsyms.c
    gpio: mpc8xxx: Don't overwrite default irq_set_type callback
    scsi: target: iscsi: Wait for all commands to finish before freeing a session
    scsi: pm80xx: Fix for SATA device discovery
  * ext4: work around deleting a file with i_nlink == 0 safely
      fs/ext4/namei.c
  * HID: Improve Windows Precision Touchpad detection.
      drivers/hid/hid-core.c
    bcache: at least try to shrink 1 node in bch_mca_scan()
    clk: pxa: fix one of the pxa RTC clocks
    powerpc/security: Fix wrong message when RFI Flush is disable
    powerpc/pseries/cmm: Implement release() function for sysfs device
  * scsi: ufs: fix potential bug which ends in system hang
      drivers/scsi/ufs/ufshcd.c
    scsi: lpfc: fix: Coverity: lpfc_cmpl_els_rsp(): Null pointer dereferences
  * fs/quota: handle overflows of sysctl fs.quota.* and report as unsigned long
      fs/quota/dquot.c
      include/linux/quota.h
    irqchip: ingenic: Error out if IRQ domain creation failed
    irqchip/irq-bcm7038-l1: Enable parent IRQ if necessary
    clk: qcom: Allow constant ratio freq tables for rcg
    scsi: lpfc: Fix duplicate unreg_rpi error in port offline flow
  * scsi: tracing: Fix handling of TRANSFER LENGTH == 0 for READ(6) and WRITE(6)
      drivers/scsi/scsi_trace.c
  * jbd2: Fix statistics for the number of logged blocks
      fs/jbd2/commit.c
    powerpc/security/book3s64: Report L1TF status in sysfs
    clocksource/drivers/asm9260: Add a check for of_clk_get
    dma-debug: add a schedule point in debug_dma_dump_mappings()
    powerpc/pseries: Mark accumulate_stolen_time() as notrace
    scsi: csiostor: Don't enable IRQs too early
    scsi: lpfc: Fix SLI3 hba in loop mode not discovering devices
    scsi: target: compare full CHAP_A Algorithm strings
    iommu/tegra-smmu: Fix page tables in > 4 GiB memory
    Input: atmel_mxt_ts - disable IRQ across suspend
    scsi: lpfc: Fix locking on mailbox command completion
    scsi: mpt3sas: Fix clear pending bit in ioctl status
    perf probe: Fix to show function entry line as probe-able
    mmc: sdhci-of-esdhc: fix P2020 errata handling
    powerpc/irq: fix stack overflow verification
  * ext4: check for directory entries too close to block end
      fs/ext4/dir.c
    staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value
    platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes
    USB: EHCI: Do not return -EPIPE when hub is disconnected
    usbip: Fix error path of vhci_recv_ret_submit()
  * net: dst: Force 4-byte alignment of dst_metrics
      include/net/dst.h
    sctp: fully initialize v4 addr in some functions
    net: usb: lan78xx: Fix suspend/resume PHY register access error
    net: qlogic: Fix error paths in ql_alloc_large_buffers()
    net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive()
    net: hisilicon: Fix a BUG trigered by wrong bytes_compl
  * mod_devicetable: fix PHY module format
      include/linux/mod_devicetable.h
    fjes: fix missed check in fjes_acpi_add
  * af_packet: set defaule value for tmo
      net/packet/af_packet.c
  * ALSA: pcm: Avoid possible info leaks from PCM stream buffers
      sound/core/pcm_native.c
    Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues
    btrfs: abort transaction after failed inode updates in create_subvol
    btrfs: return error pointer from alloc_test_extent_buffer
    btrfs: do not call synchronize_srcu() in inode_tree_del
  * usb: xhci: Fix build warning seen with CONFIG_PM=n
      drivers/usb/host/xhci-pci.c
    Revert "mmc: sdhci: Fix incorrect switch to HS mode"
  * net: phy: initialise phydev speed and duplex sanely
      drivers/net/phy/phy_device.c
    libtraceevent: Fix memory leakage in copy_filter_type
    crypto: vmx - Avoid weird build failures
    crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c
    fbtft: Make sure string is NULL terminated
    iwlwifi: check kasprintf() return value
    btrfs: don't prematurely free work in end_workqueue_fn()
    spi: tegra20-slink: add missed clk_unprepare
    x86/crash: Add a forward declaration of struct kimage
  * cpufreq: Register drivers only after CPU devices have been registered
      drivers/cpufreq/cpufreq.c
    parport: load lowlevel driver if ports not found
    ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile
    spi: pxa2xx: Add missed security checks
    EDAC/ghes: Fix grain calculation
    media: si470x-i2c: add missed operations in remove
    media: pvrusb2: Fix oops on tear-down when radio support is not present
    ath10k: fix get invalid tx rate for Mesh metric
    perf probe: Filter out instances except for inlined subroutine and subprogram
    perf probe: Skip end-of-sequence and non statement lines
    perf probe: Fix to show calling lines of inlined functions
    perf probe: Return a better scope DIE if there is no best scope
    perf probe: Skip overlapped location on searching variables
    perf probe: Fix to show inlined function callsite without entry_pc
    perf probe: Fix to show ranges of variables in functions without entry_pc
    perf probe: Fix to probe an inline function which has no entry pc
    perf probe: Walk function lines in lexical blocks
    perf probe: Fix to list probe event with correct line number
    perf probe: Fix to find range-only function instance
    rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt()
    spi: img-spfi: fix potential double release
    bnx2x: Fix PF-VF communication over multi-cos queues.
    pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B
    libata: Ensure ata_port probe has completed before detach
  * arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill()
      arch/arm64/kernel/psci.c
    x86/ioapic: Prevent inconsistent state when moving an interrupt
    drm/gma500: fix memory disclosures due to uninitialized bytes
  * Bluetooth: hci_core: fix init for HCI_USER_CHANNEL
      net/bluetooth/hci_core.c
    iio: adc: max1027: Reset the device at probe time
    perf report: Add warning when libunwind not compiled in
    x86/mm: Use the correct function type for native_set_fixmap()
    extcon: sm5502: Reset registers during initialization
    media: ti-vpe: vpe: Make sure YUYV is set as default format
    media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number
    media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format
    mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
    samples: pktgen: fix proc_cmd command result check logic
    media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init()
    regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe()
    hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled
    usb: renesas_usbhs: add suspend event support in gadget mode
    tools/power/cpupower: Fix initializer override in hsw_ext_cstates
    media: ov6650: Fix stored frame format not in sync with hardware
    media: i2c: ov2659: Fix missing 720p register config
    media: i2c: ov2659: fix s_stream return value
    media: am437x-vpfe: Setting STD to current value is not an error
    IB/iser: bound protection_sg size by data_sg size
    rtlwifi: prevent memory leak in rtl_usb_probe
    staging: rtl8188eu: fix possible null dereference
  * spi: Add call to spi_slave_abort() function when spidev driver is released
      drivers/spi/spidev.c
    iio: light: bh1750: Resolve compiler warning and make code more readable
    drm: mst: Fix query_payload ack reply struct
    ALSA: hda/ca0132 - Avoid endless loop
    ALSA: hda/ca0132 - Keep power on during processing DSP response
    btrfs: handle ENOENT in btrfs_uuid_tree_iterate
    btrfs: do not leak reloc root if we fail to read the fs root
Linux 4.4.207
    net: stmmac: don't stop NAPI processing when dropping a packet
    net: stmmac: use correct DMA buffer size in the RX descriptor
  * xhci: fix USB3 device initiated resume race with roothub autosuspend
      drivers/usb/host/xhci-hub.c
      drivers/usb/host/xhci-ring.c
      drivers/usb/host/xhci.h
    drm/radeon: fix r1xx/r2xx register checker for POT textures
    dm btree: increase rebalance threshold in __rebalance2()
    vfio/pci: call irq_bypass_unregister_producer() before freeing irq
    ARM: tegra: Fix FLOW_CTLR_HALT register clobbering by tegra_resume()
    ARM: dts: s3c64xx: Fix init order of clock providers
    CIFS: Respect O_SYNC and O_DIRECT flags during reconnect
    xtensa: fix TLB sanity checker
  * PCI/MSI: Fix incorrect MSI-X masking on resume
      drivers/pci/msi.c
  * PCI: Fix Intel ACS quirk UPDCR register address
      drivers/pci/quirks.c
    net: ethernet: ti: cpsw: fix extra rx interrupt
  * tcp: Protect accesses to .ts_recent_stamp with {READ,WRITE}_ONCE()
      include/net/tcp.h
  * tcp: tighten acceptance of ACKs not matching a child socket
      include/net/tcp.h
  * tcp: fix rejected syncookies due to stale timestamps
      include/linux/time.h
      include/net/tcp.h
  * inet: protect against too small mtu values.
      include/linux/netdevice.h
      include/net/ip.h
      net/core/dev.c
      net/ipv4/devinet.c
      net/ipv4/ip_output.c
    tipc: fix ordering of tipc module init and exit routine
  * tcp: md5: fix potential overestimation of TCP option space
      net/ipv4/tcp_output.c
  * net: bridge: deny dev_set_mac_address() when unregistering
      net/bridge/br_device.c
  * kernel/module.c: wakeup processes in module_wq on module unload
      kernel/module.c
    sunrpc: fix crash when cache_head become valid before update
  * workqueue: Fix missing kfree(rescuer) in destroy_workqueue()
      kernel/workqueue.c
  * blk-mq: make sure that line break can be printed
      block/blk-mq-sysfs.c
  * mm/shmem.c: cast the type of unmap_start to u64
      mm/shmem.c
    powerpc: Fix vDSO clock_getres()
    scsi: qla2xxx: Always check the qla2x00_wait_for_hba_online() return value
    scsi: qla2xxx: Fix qla24xx_process_bidir_cmd()
    scsi: qla2xxx: Fix DMA unmap leak
    pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init
    ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity
    x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models
    e100: Fix passing zero to 'PTR_ERR' warning in e100_load_ucode_wait
    scsi: lpfc: Cap NPIV vports to 256
    Btrfs: fix negative subv_writers counter and data space leak after buffered write
    iio: adis16480: Add debugfs_reg_access entry
  * xhci: make sure interrupts are restored to correct state
      drivers/usb/host/xhci-hub.c
  * xhci: Fix memory leak in xhci_add_in_port()
      drivers/usb/host/xhci-mem.c
  * usb: xhci: only set D3hot for pci device
      drivers/usb/host/xhci-pci.c
      drivers/usb/host/xhci.c
      drivers/usb/host/xhci.h
    scsi: zfcp: trace channel log even for FCP command responses
  * quota: fix livelock in dquot_writeback_dquots
      fs/quota/dquot.c
  * quota: Check that quota is not dirty before release
      fs/quota/dquot.c
      include/linux/quotaops.h
    video/hdmi: Fix AVI bar unpack
    powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB
    pinctrl: samsung: Fix device node refcount leaks in init code
    pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init
  * ACPI: PM: Avoid attaching ACPI PM domain to certain devices
      drivers/acpi/device_pm.c
  * ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data()
      drivers/acpi/bus.c
  * ACPI: OSL: only free map once in osl.c
      drivers/acpi/osl.c
  * cpuidle: Do not unset the driver if it is there already
      drivers/cpuidle/driver.c
    media: radio: wl1273: fix interrupt masking on release
    media: bdisp: fix memleak on release
    ar5523: check NULL before memcpy() in ar5523_cmd()
    cgroup: pids: use atomic64_t for pids->limit
  * blk-mq: avoid sysfs buffer overflow with too many CPU cores
      block/blk-mq-sysfs.c
  * ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report
      sound/soc/soc-jack.c
  * workqueue: Fix pwq ref leak in rescuer_thread()
      kernel/workqueue.c
  * workqueue: Fix spurious sanity check failures in destroy_workqueue()
      kernel/workqueue.c
    lib: raid6: fix awk build warnings
    rtlwifi: rtl8192de: Fix missing enable interrupt flag
    rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer
    rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address
    btrfs: Remove btrfs_bio::flags member
    btrfs: check page->mapping when loading free space cache
    virtio-balloon: fix managed page counts when migrating pages between zones
    mtd: spear_smi: Fix Write Burst mode
    usb: mon: Fix a deadlock in usbmon between mmap and read
  * usb: core: urb: fix URB structure initialization function
      drivers/usb/core/urb.c
    USB: adutux: fix interface sanity check
    USB: serial: io_edgeport: fix epic endpoint lookup
    USB: idmouse: fix interface sanity checks
    USB: atm: ueagle-atm: add missing endpoint check
    iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting
  * xhci: Increase STS_HALT timeout in xhci_suspend()
      drivers/usb/host/xhci.c
    staging: gigaset: add endpoint-type sanity check
    staging: gigaset: fix illegal free on probe errors
    staging: gigaset: fix general protection fault on probe
    staging: rtl8712: fix interface sanity check
    staging: rtl8188eu: fix interface sanity check
  * usb: Allow USB device to be warm reset in suspended state
      drivers/usb/core/hub.c
  * usb: gadget: configfs: Fix missing spin_lock_init()
      drivers/usb/gadget/configfs.c
  * fs/proc/array.c: allow reporting eip/esp for all coredumping threads
      fs/proc/array.c
  * proc: fix coredump vs read /proc/*/stat race
      fs/proc/array.c
  * fs/proc: Report eip/esp in /prod/PID/stat for coredumping
      fs/proc/array.c
  * fs/proc: Stop reporting eip and esp in /proc/PID/stat
      fs/proc/array.c
  * sched/core, x86: Make struct thread_info arch specific again
      include/linux/thread_info.h
  * sched/core: Add try_get_task_stack() and put_task_stack()
      include/linux/sched.h
      init/Kconfig
  * sched/core: Allow putting thread_info into task_struct
      include/linux/init_task.h
      include/linux/sched.h
      include/linux/thread_info.h
      init/Kconfig
      init/init_task.c
      kernel/sched/sched.h
    ALSA: hda - Fix pending unsol events at shutdown
    appletalk: Set error code if register_snap_client failed
  * appletalk: Fix potential NULL pointer dereference in unregister_snap_client
      include/linux/atalk.h
    KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID (CVE-2019-19332)
  * thermal: Fix deadlock in thermal thermal_zone_device_check
      drivers/thermal/thermal_core.c
    RDMA/qib: Validate ->show()/store() callbacks before calling them
    spi: atmel: Fix CS high support
    crypto: user - fix memory leak in crypto_report
    crypto: crypto4xx - fix double-free in crypto4xx_destroy_sdr
    KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES
    KVM: x86: do not modify masked bits of shared MSRs
    drm/i810: Prevent underflow in ioctl
  * jbd2: Fix possible overflow in jbd2_log_space_left()
      include/linux/jbd2.h
    can: slcan: Fix use-after-free Read in slcan_open
    tty: vt: keyboard: reject invalid keycodes
    CIFS: Fix SMB2 oplock break processing
    CIFS: Fix NULL-pointer dereference in smb2_push_mandatory_locks
    Input: goodix - add upside-down quirk for Teclast X89 tablet
    ALSA: pcm: oss: Avoid potential buffer overflows
  * fuse: verify attributes
      fs/fuse/dir.c
      fs/fuse/fuse_i.h
  * fuse: verify nlink
      fs/fuse/dir.c
  * sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision
      kernel/sched/fair.c
    ARM: dts: sunxi: Fix PMU compatible strings
    mlx4: Use snprintf instead of complicated strcpy
    nfsd: Return EPERM, not EACCES, in some SETATTR cases
    MIPS: OCTEON: cvmx_pko_mem_debug8: use oldest forward compatible definition
    powerpc/math-emu: Update macros from GCC
    dlm: fix invalid cluster name warning
    ARM: dts: pxa: clean up USB controller nodes
  * kbuild: fix single target build for external module
      Makefile
  * modpost: skip ELF local symbols during section mismatch check
      scripts/mod/modpost.c
  * tcp: fix off-by-one bug on aborting window-probing socket
      net/ipv4/tcp_timer.c
    ARM: dts: mmp2: fix the gpio interrupt cell number
    net/x25: fix null_x25_address handling
    net/x25: fix called/calling length calculation in x25_parse_address_block
    ARM: OMAP1/2: fix SoC name printing
    nfsd: fix a warning in __cld_pipe_upcall()
    dlm: NULL check before kmem_cache_destroy is not needed
    i2c: imx: don't print error message on probe defer
    serial: imx: fix error handling in console_setup
    altera-stapl: check for a null key before strcasecmp'ing it
  * dma-mapping: fix return type of dma_set_max_seg_size()
      include/linux/dma-mapping.h
  * ACPI: fix acpi_find_child_device() invocation in acpi_preset_companion()
      include/linux/acpi.h
    dmaengine: coh901318: Remove unused variable
    dmaengine: coh901318: Fix a double-lock bug
    ARM: dts: exynos: Use Samsung SoC specific compatible for DWC2 module
    rtc: dt-binding: abx80x: fix resistance scale
    rtc: max8997: Fix the returned value in case of error in 'max8997_rtc_read_alarm()'
    math-emu/soft-fp.h: (_FP_ROUND_ZERO) cast 0 to void to fix warning
    MIPS: OCTEON: octeon-platform: fix typing
  * regulator: Fix return value of _set_load() stub
      include/linux/regulator/consumer.h
    Staging: iio: adt7316: Fix i2c data reading, set the data field
    pinctrl: qcom: ssbi-gpio: fix gpio-hog related boot issues
    scsi: zfcp: drop default switch case which might paper over missing case
    MIPS: SiByte: Enable ZONE_DMA32 for LittleSur
    dlm: fix missing idr_destroy for recover_idr
    clk: rockchip: fix rk3188 sclk_mac_lbtest parameter ordering
    clk: rockchip: fix rk3188 sclk_smc gate data
    extcon: max8997: Fix lack of path setting in USB device mode
    ARM: 8813/1: Make aligned 2-byte getuser()/putuser() atomic on ARMv6+
    iwlwifi: mvm: Send non offchannel traffic via AP sta
  * serial: core: Allow processing sysrq at port unlock time
      include/linux/serial_core.h
    net: ep93xx_eth: fix mismatch of request_mem_region in remove
    rsxx: add missed destroy_workqueue calls in remove
  * ALSA: pcm: Fix stream lock usage in snd_pcm_period_elapsed()
      sound/core/pcm_lib.c
    Input: cyttsp4_core - fix use after free bug
    NFC: nxp-nci: Fix NULL pointer dereference after I2C communication error
    autofs: fix a leak in autofs_expire_indirect()
    serial: ifx6x60: add missed pm_runtime_disable
  * serial: serial_core: Perform NULL checks for break_ctl ops
      drivers/tty/serial/serial_core.c
    x86/PCI: Avoid AMD FCH XHCI USB PME# from D0 defect
  * tty: serial: msm_serial: Fix flow control
      drivers/tty/serial/msm_serial.c
    usb: gadget: u_serial: add missing port entry locking
    x86/apic/32: Avoid bogus LDR warnings
Linux 4.4.206
    platform/x86: hp-wmi: Fix ACPI errors caused by too small buffer
    hwrng: stm32 - fix unbalanced pm_runtime_enable
  * HID: core: check whether Usage Page item is after Usage ID items
      drivers/hid/hid-core.c
  * net: sched: fix `tc -s class show` no bstats on class with nolock subqueues
      net/sched/sch_mq.c
      net/sched/sch_multiq.c
      net/sched/sch_prio.c
    tipc: fix link name length check
    openvswitch: remove another BUG_ON()
    openvswitch: drop unneeded BUG_ON() in ovs_flow_cmd_build_info()
    slip: Fix use-after-free Read in slip_open
    openvswitch: fix flow command message size
    macvlan: schedule bc_work even if error
  * pwm: Clear chip_data in pwm_put()
      drivers/pwm/core.c
    net: macb: fix error format in dev_err()
  * media: v4l2-ctrl: fix flags for DO_WHITE_BALANCE
      drivers/media/v4l2-core/v4l2-ctrls.c
    mei: bus: prefix device names on bus with the bus name
    USB: serial: ftdi_sio: add device IDs for U-Blox C099-F9P
    staging: rtl8192e: fix potential use after free
    mtd: Remove a debug trace in mtdpart.c
    powerpc/pseries/dlpar: Fix a missing check in dlpar_parse_cc_property()
    scsi: libsas: Check SMP PHY control function result
    ACPI / APEI: Switch estatus pool to use vmalloc memory
    scsi: libsas: Support SATA PHY connection rate unmatch fixing during discovery
  * net: dev: Use unsigned integer as an argument to left-shift
      include/linux/netdevice.h
  * net: fix possible overflow in __sk_mem_raise_allocated()
      include/net/sock.h
      net/core/sock.c
    sfc: initialise found bitmap in efx_ef10_mtd_probe
    tipc: fix skb may be leaky in tipc_link_input
    decnet: fix DN_IFREQ_SIZE
    sfc: suppress duplicate nvmem partition types in efx_ef10_mtd_probe
  * net/core/neighbour: fix kmemleak minimal reference count for hash tables
      net/core/neighbour.c
  * net/core/neighbour: tell kmemleak about hash tables
      net/core/neighbour.c
    tipc: fix memory leak in tipc_nl_compat_publ_dump
    mtd: Check add_mtd_device() ret code
  * lib/genalloc.c: include vmalloc.h
      lib/genalloc.c
  * lib/genalloc.c: use vzalloc_node() to allocate the bitmap
      lib/genalloc.c
    ocfs2: clear journal dirty flag after shutdown journal
    tipc: fix a missing check of genlmsg_put
    atl1e: checking the status of atl1e_write_phy_reg
    net: stmicro: fix a missing check of clk_prepare
    um: Make GCOV depend on !KCOV
  * net/net_namespace: Check the return value of register_pernet_subsys()
      net/core/net_namespace.c
    regulator: tps65910: fix a missing check of return value
    drbd: fix print_st_err()'s prototype to match the definition
    drbd: reject attach of unsuitable uuids even if connected
    powerpc/44x/bamboo: Fix PCI range
    powerpc/mm: Make NULL pointer deferences explicit on bad page faults.
    powerpc/prom: fix early DEBUG messages
    ath6kl: Fix off by one error in scan completion
    ath6kl: Only use match sets when firmware supports it
    scsi: csiostor: fix incorrect dma device in case of vport
    scsi: qla2xxx: deadlock by configfs_depend_item
    RDMA/srp: Propagate ib_post_send() failures to the SCSI mid-layer
    openrisc: Fix broken paths to arch/or32
    serial: max310x: Fix tx_empty() callback
    drivers/regulator: fix a missing check of return value
    powerpc/xmon: fix dump_segments()
    powerpc/book3s/32: fix number of bats in p/v_block_mapped()
    IB/qib: Fix an error code in qib_sdma_verbs_send()
    xfs: Align compat attrlist_by_handle with native implementation.
    gfs2: take jdata unstuff into account in do_grow
    HID: doc: fix wrong data structure reference for UHID_OUTPUT
    pinctrl: sh-pfc: sh7734: Fix shifted values in IPSR10
    pinctrl: sh-pfc: sh7264: Fix PFCR3 and PFCR0 register configuration
    KVM: s390: unregister debug feature on failing arch init
    xen/pciback: Check dev_data before using it
    btrfs: only track ref_heads in delayed_ref_updates
    VSOCK: bind to random port for VMADDR_PORT_ANY
  * gpiolib: Fix return value of gpio_to_desc() stub if !GPIOLIB
      include/linux/gpio/consumer.h
    microblaze: move "... is ready" messages to arch/microblaze/Makefile
    microblaze: adjust the help to the real behavior
    ubi: Do not drop UBI device reference before using
    ubi: Put MTD device after it is not used
    xfs: require both realtime inodes to mount
    rtl818x: fix potential use after free
    mwifiex: debugfs: correct histogram spacing, formatting
    mwifiex: fix potential NULL dereference and use after free
    crypto: user - support incremental algorithm dumps
  * ACPI / LPSS: Ignore acpi_device_fix_up_power() return value
      drivers/acpi/acpi_lpss.c
    ARM: ks8695: fix section mismatch warning
    PM / AVS: SmartReflex: NULL check before some freeing functions is not needed
  * arm64: smp: Handle errors reported by the firmware
      arch/arm64/kernel/smp.c
    parisc: Fix HP SDC hpa address output
    parisc: Fix serio address output
    ARM: dts: imx53-voipac-dmm-668: Fix memory node duplication
    ARM: debug-imx: only define DEBUG_IMX_UART_PORT if needed
    scsi: lpfc: Fix dif and first burst use in write commands
    block: drbd: remove a stray unlock in __drbd_send_protocol()
    scripts/gdb: fix debugging modules compiled with hot/cold partitioning
    can: c_can: D_CAN: c_can_chip_config(): perform a sofware reset on open
    can: peak_usb: report bus recovery as well
  * reset: fix reset_control_ops kerneldoc comment
      include/linux/reset-controller.h
    clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
    ASoC: kirkwood: fix external clock probe defer
  * ASoC: compress: fix unsigned integer overflow check
      sound/core/compress_offload.c

Change-Id: Ieefc3442d0ce62a147d6d427b125f7b148e88c05
Signed-off-by: lucaswei <lucaswei@google.com>
2020-02-14 10:51:59 +08:00

2072 lines
51 KiB
C

/*
FUSE: Filesystem in Userspace
Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu>
This program can be distributed under the terms of the GNU GPL.
See the file COPYING.
*/
#include "fuse_i.h"
#include <linux/pagemap.h>
#include <linux/file.h>
#include <linux/sched.h>
#include <linux/namei.h>
#include <linux/slab.h>
static bool fuse_use_readdirplus(struct inode *dir, struct dir_context *ctx)
{
struct fuse_conn *fc = get_fuse_conn(dir);
struct fuse_inode *fi = get_fuse_inode(dir);
if (!fc->do_readdirplus)
return false;
if (!fc->readdirplus_auto)
return true;
if (test_and_clear_bit(FUSE_I_ADVISE_RDPLUS, &fi->state))
return true;
if (ctx->pos == 0)
return true;
return false;
}
static void fuse_advise_use_readdirplus(struct inode *dir)
{
struct fuse_inode *fi = get_fuse_inode(dir);
set_bit(FUSE_I_ADVISE_RDPLUS, &fi->state);
}
#if BITS_PER_LONG >= 64
static inline void fuse_dentry_settime(struct dentry *entry, u64 time)
{
entry->d_time = time;
}
static inline u64 fuse_dentry_time(struct dentry *entry)
{
return entry->d_time;
}
#else
/*
* On 32 bit archs store the high 32 bits of time in d_fsdata
*/
static void fuse_dentry_settime(struct dentry *entry, u64 time)
{
entry->d_time = time;
entry->d_fsdata = (void *) (unsigned long) (time >> 32);
}
static u64 fuse_dentry_time(struct dentry *entry)
{
return (u64) entry->d_time +
((u64) (unsigned long) entry->d_fsdata << 32);
}
#endif
/*
* FUSE caches dentries and attributes with separate timeout. The
* time in jiffies until the dentry/attributes are valid is stored in
* dentry->d_time and fuse_inode->i_time respectively.
*/
/*
* Calculate the time in jiffies until a dentry/attributes are valid
*/
static u64 time_to_jiffies(unsigned long sec, unsigned long nsec)
{
if (sec || nsec) {
struct timespec ts = {sec, nsec};
return get_jiffies_64() + timespec_to_jiffies(&ts);
} else
return 0;
}
/*
* Set dentry and possibly attribute timeouts from the lookup/mk*
* replies
*/
static void fuse_change_entry_timeout(struct dentry *entry,
struct fuse_entry_out *o)
{
fuse_dentry_settime(entry,
time_to_jiffies(o->entry_valid, o->entry_valid_nsec));
}
static u64 attr_timeout(struct fuse_attr_out *o)
{
return time_to_jiffies(o->attr_valid, o->attr_valid_nsec);
}
static u64 entry_attr_timeout(struct fuse_entry_out *o)
{
return time_to_jiffies(o->attr_valid, o->attr_valid_nsec);
}
/*
* Mark the attributes as stale, so that at the next call to
* ->getattr() they will be fetched from userspace
*/
void fuse_invalidate_attr(struct inode *inode)
{
get_fuse_inode(inode)->i_time = 0;
}
/**
* Mark the attributes as stale due to an atime change. Avoid the invalidate if
* atime is not used.
*/
void fuse_invalidate_atime(struct inode *inode)
{
if (!IS_RDONLY(inode))
fuse_invalidate_attr(inode);
}
/*
* Just mark the entry as stale, so that a next attempt to look it up
* will result in a new lookup call to userspace
*
* This is called when a dentry is about to become negative and the
* timeout is unknown (unlink, rmdir, rename and in some cases
* lookup)
*/
void fuse_invalidate_entry_cache(struct dentry *entry)
{
fuse_dentry_settime(entry, 0);
}
/*
* Same as fuse_invalidate_entry_cache(), but also try to remove the
* dentry from the hash
*/
static void fuse_invalidate_entry(struct dentry *entry)
{
d_invalidate(entry);
fuse_invalidate_entry_cache(entry);
}
static void fuse_lookup_init(struct fuse_conn *fc, struct fuse_args *args,
u64 nodeid, struct qstr *name,
struct fuse_entry_out *outarg)
{
memset(outarg, 0, sizeof(struct fuse_entry_out));
args->in.h.opcode = FUSE_LOOKUP;
args->in.h.nodeid = nodeid;
args->in.numargs = 1;
args->in.args[0].size = name->len + 1;
args->in.args[0].value = name->name;
args->out.numargs = 1;
args->out.args[0].size = sizeof(struct fuse_entry_out);
args->out.args[0].value = outarg;
}
u64 fuse_get_attr_version(struct fuse_conn *fc)
{
u64 curr_version;
/*
* The spin lock isn't actually needed on 64bit archs, but we
* don't yet care too much about such optimizations.
*/
spin_lock(&fc->lock);
curr_version = fc->attr_version;
spin_unlock(&fc->lock);
return curr_version;
}
/*
* Check whether the dentry is still valid
*
* If the entry validity timeout has expired and the dentry is
* positive, try to redo the lookup. If the lookup results in a
* different inode, then let the VFS invalidate the dentry and redo
* the lookup once more. If the lookup results in the same inode,
* then refresh the attributes, timeouts and mark the dentry valid.
*/
static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags)
{
struct inode *inode;
struct dentry *parent;
struct fuse_conn *fc;
struct fuse_inode *fi;
int ret;
inode = d_inode_rcu(entry);
if (inode && is_bad_inode(inode))
goto invalid;
else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) ||
(flags & LOOKUP_REVAL)) {
struct fuse_entry_out outarg;
FUSE_ARGS(args);
struct fuse_forget_link *forget;
u64 attr_version;
/* For negative dentries, always do a fresh lookup */
if (!inode)
goto invalid;
ret = -ECHILD;
if (flags & LOOKUP_RCU)
goto out;
fc = get_fuse_conn(inode);
forget = fuse_alloc_forget();
ret = -ENOMEM;
if (!forget)
goto out;
attr_version = fuse_get_attr_version(fc);
parent = dget_parent(entry);
fuse_lookup_init(fc, &args, get_node_id(d_inode(parent)),
&entry->d_name, &outarg);
ret = fuse_simple_request(fc, &args);
dput(parent);
/* Zero nodeid is same as -ENOENT */
if (!ret && !outarg.nodeid)
ret = -ENOENT;
if (!ret) {
fi = get_fuse_inode(inode);
if (outarg.nodeid != get_node_id(inode)) {
fuse_queue_forget(fc, forget, outarg.nodeid, 1);
goto invalid;
}
spin_lock(&fc->lock);
fi->nlookup++;
spin_unlock(&fc->lock);
}
kfree(forget);
if (ret == -ENOMEM)
goto out;
if (ret || fuse_invalid_attr(&outarg.attr) ||
(outarg.attr.mode ^ inode->i_mode) & S_IFMT)
goto invalid;
fuse_change_attributes(inode, &outarg.attr,
entry_attr_timeout(&outarg),
attr_version);
fuse_change_entry_timeout(entry, &outarg);
} else if (inode) {
fi = get_fuse_inode(inode);
if (flags & LOOKUP_RCU) {
if (test_bit(FUSE_I_INIT_RDPLUS, &fi->state))
return -ECHILD;
} else if (test_and_clear_bit(FUSE_I_INIT_RDPLUS, &fi->state)) {
parent = dget_parent(entry);
fuse_advise_use_readdirplus(d_inode(parent));
dput(parent);
}
}
ret = 1;
out:
return ret;
invalid:
ret = 0;
goto out;
}
/*
* Get the canonical path. Since we must translate to a path, this must be done
* in the context of the userspace daemon, however, the userspace daemon cannot
* look up paths on its own. Instead, we handle the lookup as a special case
* inside of the write request.
*/
static void fuse_dentry_canonical_path(const struct path *path, struct path *canonical_path) {
struct inode *inode = path->dentry->d_inode;
struct fuse_conn *fc = get_fuse_conn(inode);
struct fuse_req *req;
int err;
char *path_name;
req = fuse_get_req(fc, 1);
err = PTR_ERR(req);
if (IS_ERR(req))
goto default_path;
path_name = (char*)__get_free_page(GFP_KERNEL);
if (!path_name) {
fuse_put_request(fc, req);
goto default_path;
}
req->in.h.opcode = FUSE_CANONICAL_PATH;
req->in.h.nodeid = get_node_id(inode);
req->in.numargs = 0;
req->out.numargs = 1;
req->out.args[0].size = PATH_MAX;
req->out.args[0].value = path_name;
req->canonical_path = canonical_path;
req->out.argvar = 1;
fuse_request_send(fc, req);
err = req->out.h.error;
fuse_put_request(fc, req);
free_page((unsigned long)path_name);
if (!err)
return;
default_path:
canonical_path->dentry = path->dentry;
canonical_path->mnt = path->mnt;
path_get(canonical_path);
}
static int invalid_nodeid(u64 nodeid)
{
return !nodeid || nodeid == FUSE_ROOT_ID;
}
const struct dentry_operations fuse_dentry_operations = {
.d_revalidate = fuse_dentry_revalidate,
.d_canonical_path = fuse_dentry_canonical_path,
};
int fuse_valid_type(int m)
{
return S_ISREG(m) || S_ISDIR(m) || S_ISLNK(m) || S_ISCHR(m) ||
S_ISBLK(m) || S_ISFIFO(m) || S_ISSOCK(m);
}
bool fuse_invalid_attr(struct fuse_attr *attr)
{
return !fuse_valid_type(attr->mode) ||
attr->size > LLONG_MAX;
}
int fuse_lookup_name(struct super_block *sb, u64 nodeid, struct qstr *name,
struct fuse_entry_out *outarg, struct inode **inode)
{
struct fuse_conn *fc = get_fuse_conn_super(sb);
FUSE_ARGS(args);
struct fuse_forget_link *forget;
u64 attr_version;
int err;
*inode = NULL;
err = -ENAMETOOLONG;
if (name->len > FUSE_NAME_MAX)
goto out;
forget = fuse_alloc_forget();
err = -ENOMEM;
if (!forget)
goto out;
attr_version = fuse_get_attr_version(fc);
fuse_lookup_init(fc, &args, nodeid, name, outarg);
err = fuse_simple_request(fc, &args);
/* Zero nodeid is same as -ENOENT, but with valid timeout */
if (err || !outarg->nodeid)
goto out_put_forget;
err = -EIO;
if (!outarg->nodeid)
goto out_put_forget;
if (fuse_invalid_attr(&outarg->attr))
goto out_put_forget;
*inode = fuse_iget(sb, outarg->nodeid, outarg->generation,
&outarg->attr, entry_attr_timeout(outarg),
attr_version);
err = -ENOMEM;
if (!*inode) {
fuse_queue_forget(fc, forget, outarg->nodeid, 1);
goto out;
}
err = 0;
out_put_forget:
kfree(forget);
out:
return err;
}
static struct dentry *fuse_lookup(struct inode *dir, struct dentry *entry,
unsigned int flags)
{
int err;
struct fuse_entry_out outarg;
struct inode *inode;
struct dentry *newent;
bool outarg_valid = true;
err = fuse_lookup_name(dir->i_sb, get_node_id(dir), &entry->d_name,
&outarg, &inode);
if (err == -ENOENT) {
outarg_valid = false;
err = 0;
}
if (err)
goto out_err;
err = -EIO;
if (inode && get_node_id(inode) == FUSE_ROOT_ID)
goto out_iput;
newent = d_splice_alias(inode, entry);
err = PTR_ERR(newent);
if (IS_ERR(newent))
goto out_err;
entry = newent ? newent : entry;
if (outarg_valid)
fuse_change_entry_timeout(entry, &outarg);
else
fuse_invalidate_entry_cache(entry);
fuse_advise_use_readdirplus(dir);
return newent;
out_iput:
iput(inode);
out_err:
return ERR_PTR(err);
}
/*
* Atomic create+open operation
*
* If the filesystem doesn't support this, then fall back to separate
* 'mknod' + 'open' requests.
*/
static int fuse_create_open(struct inode *dir, struct dentry *entry,
struct file *file, unsigned flags,
umode_t mode, int *opened)
{
int err;
struct inode *inode;
struct fuse_conn *fc = get_fuse_conn(dir);
FUSE_ARGS(args);
struct fuse_forget_link *forget;
struct fuse_create_in inarg;
struct fuse_open_out outopen;
struct fuse_entry_out outentry;
struct fuse_file *ff;
/* Userspace expects S_IFREG in create mode */
BUG_ON((mode & S_IFMT) != S_IFREG);
forget = fuse_alloc_forget();
err = -ENOMEM;
if (!forget)
goto out_err;
err = -ENOMEM;
ff = fuse_file_alloc(fc);
if (!ff)
goto out_put_forget_req;
if (!fc->dont_mask)
mode &= ~current_umask();
flags &= ~O_NOCTTY;
memset(&inarg, 0, sizeof(inarg));
memset(&outentry, 0, sizeof(outentry));
inarg.flags = flags;
inarg.mode = mode;
inarg.umask = current_umask();
args.in.h.opcode = FUSE_CREATE;
args.in.h.nodeid = get_node_id(dir);
args.in.numargs = 2;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.in.args[1].size = entry->d_name.len + 1;
args.in.args[1].value = entry->d_name.name;
args.out.numargs = 2;
args.out.args[0].size = sizeof(outentry);
args.out.args[0].value = &outentry;
args.out.args[1].size = sizeof(outopen);
args.out.args[1].value = &outopen;
args.out.passthrough_filp = NULL;
err = fuse_simple_request(fc, &args);
if (err)
goto out_free_ff;
err = -EIO;
if (!S_ISREG(outentry.attr.mode) || invalid_nodeid(outentry.nodeid) ||
fuse_invalid_attr(&outentry.attr))
goto out_free_ff;
ff->fh = outopen.fh;
ff->nodeid = outentry.nodeid;
ff->open_flags = outopen.open_flags;
if (args.out.passthrough_filp != NULL)
ff->passthrough_filp = args.out.passthrough_filp;
inode = fuse_iget(dir->i_sb, outentry.nodeid, outentry.generation,
&outentry.attr, entry_attr_timeout(&outentry), 0);
if (!inode) {
flags &= ~(O_CREAT | O_EXCL | O_TRUNC);
fuse_sync_release(ff, flags);
fuse_queue_forget(fc, forget, outentry.nodeid, 1);
err = -ENOMEM;
goto out_err;
}
kfree(forget);
d_instantiate(entry, inode);
fuse_change_entry_timeout(entry, &outentry);
fuse_invalidate_attr(dir);
err = finish_open(file, entry, generic_file_open, opened);
if (err) {
fuse_sync_release(ff, flags);
} else {
file->private_data = fuse_file_get(ff);
fuse_finish_open(inode, file);
}
return err;
out_free_ff:
fuse_file_free(ff);
out_put_forget_req:
kfree(forget);
out_err:
return err;
}
static int fuse_mknod(struct inode *, struct dentry *, umode_t, dev_t);
static int fuse_atomic_open(struct inode *dir, struct dentry *entry,
struct file *file, unsigned flags,
umode_t mode, int *opened)
{
int err;
struct fuse_conn *fc = get_fuse_conn(dir);
struct dentry *res = NULL;
if (d_unhashed(entry)) {
res = fuse_lookup(dir, entry, 0);
if (IS_ERR(res))
return PTR_ERR(res);
if (res)
entry = res;
}
if (!(flags & O_CREAT) || d_really_is_positive(entry))
goto no_open;
/* Only creates */
*opened |= FILE_CREATED;
if (fc->no_create)
goto mknod;
err = fuse_create_open(dir, entry, file, flags, mode, opened);
if (err == -ENOSYS) {
fc->no_create = 1;
goto mknod;
}
out_dput:
dput(res);
return err;
mknod:
err = fuse_mknod(dir, entry, mode, 0);
if (err)
goto out_dput;
no_open:
return finish_no_open(file, res);
}
/*
* Code shared between mknod, mkdir, symlink and link
*/
static int create_new_entry(struct fuse_conn *fc, struct fuse_args *args,
struct inode *dir, struct dentry *entry,
umode_t mode)
{
struct fuse_entry_out outarg;
struct inode *inode;
int err;
struct fuse_forget_link *forget;
forget = fuse_alloc_forget();
if (!forget)
return -ENOMEM;
memset(&outarg, 0, sizeof(outarg));
args->in.h.nodeid = get_node_id(dir);
args->out.numargs = 1;
args->out.args[0].size = sizeof(outarg);
args->out.args[0].value = &outarg;
err = fuse_simple_request(fc, args);
if (err)
goto out_put_forget_req;
err = -EIO;
if (invalid_nodeid(outarg.nodeid) || fuse_invalid_attr(&outarg.attr))
goto out_put_forget_req;
if ((outarg.attr.mode ^ mode) & S_IFMT)
goto out_put_forget_req;
inode = fuse_iget(dir->i_sb, outarg.nodeid, outarg.generation,
&outarg.attr, entry_attr_timeout(&outarg), 0);
if (!inode) {
fuse_queue_forget(fc, forget, outarg.nodeid, 1);
return -ENOMEM;
}
kfree(forget);
err = d_instantiate_no_diralias(entry, inode);
if (err)
return err;
fuse_change_entry_timeout(entry, &outarg);
fuse_invalidate_attr(dir);
return 0;
out_put_forget_req:
kfree(forget);
return err;
}
static int fuse_mknod(struct inode *dir, struct dentry *entry, umode_t mode,
dev_t rdev)
{
struct fuse_mknod_in inarg;
struct fuse_conn *fc = get_fuse_conn(dir);
FUSE_ARGS(args);
if (!fc->dont_mask)
mode &= ~current_umask();
memset(&inarg, 0, sizeof(inarg));
inarg.mode = mode;
inarg.rdev = new_encode_dev(rdev);
inarg.umask = current_umask();
args.in.h.opcode = FUSE_MKNOD;
args.in.numargs = 2;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.in.args[1].size = entry->d_name.len + 1;
args.in.args[1].value = entry->d_name.name;
return create_new_entry(fc, &args, dir, entry, mode);
}
static int fuse_create(struct inode *dir, struct dentry *entry, umode_t mode,
bool excl)
{
return fuse_mknod(dir, entry, mode, 0);
}
static int fuse_mkdir(struct inode *dir, struct dentry *entry, umode_t mode)
{
struct fuse_mkdir_in inarg;
struct fuse_conn *fc = get_fuse_conn(dir);
FUSE_ARGS(args);
if (!fc->dont_mask)
mode &= ~current_umask();
memset(&inarg, 0, sizeof(inarg));
inarg.mode = mode;
inarg.umask = current_umask();
args.in.h.opcode = FUSE_MKDIR;
args.in.numargs = 2;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.in.args[1].size = entry->d_name.len + 1;
args.in.args[1].value = entry->d_name.name;
return create_new_entry(fc, &args, dir, entry, S_IFDIR);
}
static int fuse_symlink(struct inode *dir, struct dentry *entry,
const char *link)
{
struct fuse_conn *fc = get_fuse_conn(dir);
unsigned len = strlen(link) + 1;
FUSE_ARGS(args);
args.in.h.opcode = FUSE_SYMLINK;
args.in.numargs = 2;
args.in.args[0].size = entry->d_name.len + 1;
args.in.args[0].value = entry->d_name.name;
args.in.args[1].size = len;
args.in.args[1].value = link;
return create_new_entry(fc, &args, dir, entry, S_IFLNK);
}
static inline void fuse_update_ctime(struct inode *inode)
{
if (!IS_NOCMTIME(inode)) {
inode->i_ctime = current_fs_time(inode->i_sb);
mark_inode_dirty_sync(inode);
}
}
static int fuse_unlink(struct inode *dir, struct dentry *entry)
{
int err;
struct fuse_conn *fc = get_fuse_conn(dir);
FUSE_ARGS(args);
args.in.h.opcode = FUSE_UNLINK;
args.in.h.nodeid = get_node_id(dir);
args.in.numargs = 1;
args.in.args[0].size = entry->d_name.len + 1;
args.in.args[0].value = entry->d_name.name;
err = fuse_simple_request(fc, &args);
if (!err) {
struct inode *inode = d_inode(entry);
struct fuse_inode *fi = get_fuse_inode(inode);
spin_lock(&fc->lock);
fi->attr_version = ++fc->attr_version;
/*
* If i_nlink == 0 then unlink doesn't make sense, yet this can
* happen if userspace filesystem is careless. It would be
* difficult to enforce correct nlink usage so just ignore this
* condition here
*/
if (inode->i_nlink > 0)
drop_nlink(inode);
spin_unlock(&fc->lock);
fuse_invalidate_attr(inode);
fuse_invalidate_attr(dir);
fuse_invalidate_entry_cache(entry);
fuse_update_ctime(inode);
} else if (err == -EINTR)
fuse_invalidate_entry(entry);
return err;
}
static int fuse_rmdir(struct inode *dir, struct dentry *entry)
{
int err;
struct fuse_conn *fc = get_fuse_conn(dir);
FUSE_ARGS(args);
args.in.h.opcode = FUSE_RMDIR;
args.in.h.nodeid = get_node_id(dir);
args.in.numargs = 1;
args.in.args[0].size = entry->d_name.len + 1;
args.in.args[0].value = entry->d_name.name;
err = fuse_simple_request(fc, &args);
if (!err) {
clear_nlink(d_inode(entry));
fuse_invalidate_attr(dir);
fuse_invalidate_entry_cache(entry);
} else if (err == -EINTR)
fuse_invalidate_entry(entry);
return err;
}
static int fuse_rename_common(struct inode *olddir, struct dentry *oldent,
struct inode *newdir, struct dentry *newent,
unsigned int flags, int opcode, size_t argsize)
{
int err;
struct fuse_rename2_in inarg;
struct fuse_conn *fc = get_fuse_conn(olddir);
FUSE_ARGS(args);
memset(&inarg, 0, argsize);
inarg.newdir = get_node_id(newdir);
inarg.flags = flags;
args.in.h.opcode = opcode;
args.in.h.nodeid = get_node_id(olddir);
args.in.numargs = 3;
args.in.args[0].size = argsize;
args.in.args[0].value = &inarg;
args.in.args[1].size = oldent->d_name.len + 1;
args.in.args[1].value = oldent->d_name.name;
args.in.args[2].size = newent->d_name.len + 1;
args.in.args[2].value = newent->d_name.name;
err = fuse_simple_request(fc, &args);
if (!err) {
/* ctime changes */
fuse_invalidate_attr(d_inode(oldent));
fuse_update_ctime(d_inode(oldent));
if (flags & RENAME_EXCHANGE) {
fuse_invalidate_attr(d_inode(newent));
fuse_update_ctime(d_inode(newent));
}
fuse_invalidate_attr(olddir);
if (olddir != newdir)
fuse_invalidate_attr(newdir);
/* newent will end up negative */
if (!(flags & RENAME_EXCHANGE) && d_really_is_positive(newent)) {
fuse_invalidate_attr(d_inode(newent));
fuse_invalidate_entry_cache(newent);
fuse_update_ctime(d_inode(newent));
}
} else if (err == -EINTR) {
/* If request was interrupted, DEITY only knows if the
rename actually took place. If the invalidation
fails (e.g. some process has CWD under the renamed
directory), then there can be inconsistency between
the dcache and the real filesystem. Tough luck. */
fuse_invalidate_entry(oldent);
if (d_really_is_positive(newent))
fuse_invalidate_entry(newent);
}
return err;
}
static int fuse_rename2(struct inode *olddir, struct dentry *oldent,
struct inode *newdir, struct dentry *newent,
unsigned int flags)
{
struct fuse_conn *fc = get_fuse_conn(olddir);
int err;
if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE))
return -EINVAL;
if (flags) {
if (fc->no_rename2 || fc->minor < 23)
return -EINVAL;
err = fuse_rename_common(olddir, oldent, newdir, newent, flags,
FUSE_RENAME2,
sizeof(struct fuse_rename2_in));
if (err == -ENOSYS) {
fc->no_rename2 = 1;
err = -EINVAL;
}
} else {
err = fuse_rename_common(olddir, oldent, newdir, newent, 0,
FUSE_RENAME,
sizeof(struct fuse_rename_in));
}
return err;
}
static int fuse_link(struct dentry *entry, struct inode *newdir,
struct dentry *newent)
{
int err;
struct fuse_link_in inarg;
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
memset(&inarg, 0, sizeof(inarg));
inarg.oldnodeid = get_node_id(inode);
args.in.h.opcode = FUSE_LINK;
args.in.numargs = 2;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.in.args[1].size = newent->d_name.len + 1;
args.in.args[1].value = newent->d_name.name;
err = create_new_entry(fc, &args, newdir, newent, inode->i_mode);
/* Contrary to "normal" filesystems it can happen that link
makes two "logical" inodes point to the same "physical"
inode. We invalidate the attributes of the old one, so it
will reflect changes in the backing inode (link count,
etc.)
*/
if (!err) {
struct fuse_inode *fi = get_fuse_inode(inode);
spin_lock(&fc->lock);
fi->attr_version = ++fc->attr_version;
if (likely(inode->i_nlink < UINT_MAX))
inc_nlink(inode);
spin_unlock(&fc->lock);
fuse_invalidate_attr(inode);
fuse_update_ctime(inode);
} else if (err == -EINTR) {
fuse_invalidate_attr(inode);
}
return err;
}
static void fuse_fillattr(struct inode *inode, struct fuse_attr *attr,
struct kstat *stat)
{
unsigned int blkbits;
struct fuse_conn *fc = get_fuse_conn(inode);
/* see the comment in fuse_change_attributes() */
if (fc->writeback_cache && S_ISREG(inode->i_mode)) {
attr->size = i_size_read(inode);
attr->mtime = inode->i_mtime.tv_sec;
attr->mtimensec = inode->i_mtime.tv_nsec;
attr->ctime = inode->i_ctime.tv_sec;
attr->ctimensec = inode->i_ctime.tv_nsec;
}
stat->dev = inode->i_sb->s_dev;
stat->ino = attr->ino;
stat->mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
stat->nlink = attr->nlink;
stat->uid = make_kuid(&init_user_ns, attr->uid);
stat->gid = make_kgid(&init_user_ns, attr->gid);
stat->rdev = inode->i_rdev;
stat->atime.tv_sec = attr->atime;
stat->atime.tv_nsec = attr->atimensec;
stat->mtime.tv_sec = attr->mtime;
stat->mtime.tv_nsec = attr->mtimensec;
stat->ctime.tv_sec = attr->ctime;
stat->ctime.tv_nsec = attr->ctimensec;
stat->size = attr->size;
stat->blocks = attr->blocks;
if (attr->blksize != 0)
blkbits = ilog2(attr->blksize);
else
blkbits = inode->i_sb->s_blocksize_bits;
stat->blksize = 1 << blkbits;
}
static int fuse_do_getattr(struct inode *inode, struct kstat *stat,
struct file *file)
{
int err;
struct fuse_getattr_in inarg;
struct fuse_attr_out outarg;
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
u64 attr_version;
attr_version = fuse_get_attr_version(fc);
memset(&inarg, 0, sizeof(inarg));
memset(&outarg, 0, sizeof(outarg));
/* Directories have separate file-handle space */
if (file && S_ISREG(inode->i_mode)) {
struct fuse_file *ff = file->private_data;
inarg.getattr_flags |= FUSE_GETATTR_FH;
inarg.fh = ff->fh;
}
args.in.h.opcode = FUSE_GETATTR;
args.in.h.nodeid = get_node_id(inode);
args.in.numargs = 1;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.out.numargs = 1;
args.out.args[0].size = sizeof(outarg);
args.out.args[0].value = &outarg;
err = fuse_simple_request(fc, &args);
if (!err) {
if (fuse_invalid_attr(&outarg.attr) ||
(inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
make_bad_inode(inode);
err = -EIO;
} else {
fuse_change_attributes(inode, &outarg.attr,
attr_timeout(&outarg),
attr_version);
if (stat)
fuse_fillattr(inode, &outarg.attr, stat);
}
}
return err;
}
int fuse_update_attributes(struct inode *inode, struct kstat *stat,
struct file *file, bool *refreshed)
{
struct fuse_inode *fi = get_fuse_inode(inode);
int err;
bool r;
if (time_before64(fi->i_time, get_jiffies_64())) {
r = true;
err = fuse_do_getattr(inode, stat, file);
} else {
r = false;
err = 0;
if (stat) {
generic_fillattr(inode, stat);
stat->mode = fi->orig_i_mode;
stat->ino = fi->orig_ino;
}
}
if (refreshed != NULL)
*refreshed = r;
return err;
}
int fuse_reverse_inval_entry(struct super_block *sb, u64 parent_nodeid,
u64 child_nodeid, struct qstr *name)
{
int err = -ENOTDIR;
struct inode *parent;
struct dentry *dir;
struct dentry *entry;
parent = ilookup5(sb, parent_nodeid, fuse_inode_eq, &parent_nodeid);
if (!parent)
return -ENOENT;
mutex_lock(&parent->i_mutex);
if (!S_ISDIR(parent->i_mode))
goto unlock;
err = -ENOENT;
dir = d_find_alias(parent);
if (!dir)
goto unlock;
entry = d_lookup(dir, name);
dput(dir);
if (!entry)
goto unlock;
fuse_invalidate_attr(parent);
fuse_invalidate_entry(entry);
if (child_nodeid != 0 && d_really_is_positive(entry)) {
mutex_lock(&d_inode(entry)->i_mutex);
if (get_node_id(d_inode(entry)) != child_nodeid) {
err = -ENOENT;
goto badentry;
}
if (d_mountpoint(entry)) {
err = -EBUSY;
goto badentry;
}
if (d_is_dir(entry)) {
shrink_dcache_parent(entry);
if (!simple_empty(entry)) {
err = -ENOTEMPTY;
goto badentry;
}
d_inode(entry)->i_flags |= S_DEAD;
}
dont_mount(entry);
clear_nlink(d_inode(entry));
err = 0;
badentry:
mutex_unlock(&d_inode(entry)->i_mutex);
if (!err)
d_delete(entry);
} else {
err = 0;
}
dput(entry);
unlock:
mutex_unlock(&parent->i_mutex);
iput(parent);
return err;
}
/*
* Calling into a user-controlled filesystem gives the filesystem
* daemon ptrace-like capabilities over the current process. This
* means, that the filesystem daemon is able to record the exact
* filesystem operations performed, and can also control the behavior
* of the requester process in otherwise impossible ways. For example
* it can delay the operation for arbitrary length of time allowing
* DoS against the requester.
*
* For this reason only those processes can call into the filesystem,
* for which the owner of the mount has ptrace privilege. This
* excludes processes started by other users, suid or sgid processes.
*/
int fuse_allow_current_process(struct fuse_conn *fc)
{
const struct cred *cred;
if (fc->flags & FUSE_ALLOW_OTHER)
return 1;
cred = current_cred();
if (uid_eq(cred->euid, fc->user_id) &&
uid_eq(cred->suid, fc->user_id) &&
uid_eq(cred->uid, fc->user_id) &&
gid_eq(cred->egid, fc->group_id) &&
gid_eq(cred->sgid, fc->group_id) &&
gid_eq(cred->gid, fc->group_id))
return 1;
return 0;
}
static int fuse_access(struct inode *inode, int mask)
{
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
struct fuse_access_in inarg;
int err;
BUG_ON(mask & MAY_NOT_BLOCK);
if (fc->no_access)
return 0;
memset(&inarg, 0, sizeof(inarg));
inarg.mask = mask & (MAY_READ | MAY_WRITE | MAY_EXEC);
args.in.h.opcode = FUSE_ACCESS;
args.in.h.nodeid = get_node_id(inode);
args.in.numargs = 1;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
err = fuse_simple_request(fc, &args);
if (err == -ENOSYS) {
fc->no_access = 1;
err = 0;
}
return err;
}
static int fuse_perm_getattr(struct inode *inode, int mask)
{
if (mask & MAY_NOT_BLOCK)
return -ECHILD;
return fuse_do_getattr(inode, NULL, NULL);
}
/*
* Check permission. The two basic access models of FUSE are:
*
* 1) Local access checking ('default_permissions' mount option) based
* on file mode. This is the plain old disk filesystem permission
* modell.
*
* 2) "Remote" access checking, where server is responsible for
* checking permission in each inode operation. An exception to this
* is if ->permission() was invoked from sys_access() in which case an
* access request is sent. Execute permission is still checked
* locally based on file mode.
*/
static int fuse_permission(struct inode *inode, int mask)
{
struct fuse_conn *fc = get_fuse_conn(inode);
bool refreshed = false;
int err = 0;
if (!fuse_allow_current_process(fc))
return -EACCES;
/*
* If attributes are needed, refresh them before proceeding
*/
if ((fc->flags & FUSE_DEFAULT_PERMISSIONS) ||
((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) {
struct fuse_inode *fi = get_fuse_inode(inode);
if (time_before64(fi->i_time, get_jiffies_64())) {
refreshed = true;
err = fuse_perm_getattr(inode, mask);
if (err)
return err;
}
}
if (fc->flags & FUSE_DEFAULT_PERMISSIONS) {
err = generic_permission(inode, mask);
/* If permission is denied, try to refresh file
attributes. This is also needed, because the root
node will at first have no permissions */
if (err == -EACCES && !refreshed) {
err = fuse_perm_getattr(inode, mask);
if (!err)
err = generic_permission(inode, mask);
}
/* Note: the opposite of the above test does not
exist. So if permissions are revoked this won't be
noticed immediately, only after the attribute
timeout has expired */
} else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
err = fuse_access(inode, mask);
} else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
if (!(inode->i_mode & S_IXUGO)) {
if (refreshed)
return -EACCES;
err = fuse_perm_getattr(inode, mask);
if (!err && !(inode->i_mode & S_IXUGO))
return -EACCES;
}
}
return err;
}
static int parse_dirfile(char *buf, size_t nbytes, struct file *file,
struct dir_context *ctx)
{
while (nbytes >= FUSE_NAME_OFFSET) {
struct fuse_dirent *dirent = (struct fuse_dirent *) buf;
size_t reclen = FUSE_DIRENT_SIZE(dirent);
if (!dirent->namelen || dirent->namelen > FUSE_NAME_MAX)
return -EIO;
if (reclen > nbytes)
break;
if (memchr(dirent->name, '/', dirent->namelen) != NULL)
return -EIO;
if (!dir_emit(ctx, dirent->name, dirent->namelen,
dirent->ino, dirent->type))
break;
buf += reclen;
nbytes -= reclen;
ctx->pos = dirent->off;
}
return 0;
}
static int fuse_direntplus_link(struct file *file,
struct fuse_direntplus *direntplus,
u64 attr_version)
{
int err;
struct fuse_entry_out *o = &direntplus->entry_out;
struct fuse_dirent *dirent = &direntplus->dirent;
struct dentry *parent = file->f_path.dentry;
struct qstr name = QSTR_INIT(dirent->name, dirent->namelen);
struct dentry *dentry;
struct dentry *alias;
struct inode *dir = d_inode(parent);
struct fuse_conn *fc;
struct inode *inode;
if (!o->nodeid) {
/*
* Unlike in the case of fuse_lookup, zero nodeid does not mean
* ENOENT. Instead, it only means the userspace filesystem did
* not want to return attributes/handle for this entry.
*
* So do nothing.
*/
return 0;
}
if (name.name[0] == '.') {
/*
* We could potentially refresh the attributes of the directory
* and its parent?
*/
if (name.len == 1)
return 0;
if (name.name[1] == '.' && name.len == 2)
return 0;
}
if (invalid_nodeid(o->nodeid))
return -EIO;
if (fuse_invalid_attr(&o->attr))
return -EIO;
fc = get_fuse_conn(dir);
name.hash = full_name_hash(name.name, name.len);
dentry = d_lookup(parent, &name);
if (dentry) {
inode = d_inode(dentry);
if (!inode) {
d_drop(dentry);
} else if (get_node_id(inode) != o->nodeid ||
((o->attr.mode ^ inode->i_mode) & S_IFMT)) {
d_invalidate(dentry);
} else if (is_bad_inode(inode)) {
err = -EIO;
goto out;
} else {
struct fuse_inode *fi;
fi = get_fuse_inode(inode);
spin_lock(&fc->lock);
fi->nlookup++;
spin_unlock(&fc->lock);
fuse_change_attributes(inode, &o->attr,
entry_attr_timeout(o),
attr_version);
/*
* The other branch to 'found' comes via fuse_iget()
* which bumps nlookup inside
*/
goto found;
}
dput(dentry);
}
dentry = d_alloc(parent, &name);
err = -ENOMEM;
if (!dentry)
goto out;
inode = fuse_iget(dir->i_sb, o->nodeid, o->generation,
&o->attr, entry_attr_timeout(o), attr_version);
if (!inode)
goto out;
alias = d_splice_alias(inode, dentry);
err = PTR_ERR(alias);
if (IS_ERR(alias))
goto out;
if (alias) {
dput(dentry);
dentry = alias;
}
found:
if (fc->readdirplus_auto)
set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
fuse_change_entry_timeout(dentry, o);
err = 0;
out:
dput(dentry);
return err;
}
static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file,
struct dir_context *ctx, u64 attr_version)
{
struct fuse_direntplus *direntplus;
struct fuse_dirent *dirent;
size_t reclen;
int over = 0;
int ret;
while (nbytes >= FUSE_NAME_OFFSET_DIRENTPLUS) {
direntplus = (struct fuse_direntplus *) buf;
dirent = &direntplus->dirent;
reclen = FUSE_DIRENTPLUS_SIZE(direntplus);
if (!dirent->namelen || dirent->namelen > FUSE_NAME_MAX)
return -EIO;
if (reclen > nbytes)
break;
if (memchr(dirent->name, '/', dirent->namelen) != NULL)
return -EIO;
if (!over) {
/* We fill entries into dstbuf only as much as
it can hold. But we still continue iterating
over remaining entries to link them. If not,
we need to send a FORGET for each of those
which we did not link.
*/
over = !dir_emit(ctx, dirent->name, dirent->namelen,
dirent->ino, dirent->type);
if (!over)
ctx->pos = dirent->off;
}
buf += reclen;
nbytes -= reclen;
ret = fuse_direntplus_link(file, direntplus, attr_version);
if (ret)
fuse_force_forget(file, direntplus->entry_out.nodeid);
}
return 0;
}
static int fuse_readdir(struct file *file, struct dir_context *ctx)
{
int plus, err;
size_t nbytes;
struct page *page;
struct inode *inode = file_inode(file);
struct fuse_conn *fc = get_fuse_conn(inode);
struct fuse_req *req;
u64 attr_version = 0;
if (is_bad_inode(inode))
return -EIO;
req = fuse_get_req(fc, 1);
if (IS_ERR(req))
return PTR_ERR(req);
page = alloc_page(GFP_KERNEL);
if (!page) {
fuse_put_request(fc, req);
return -ENOMEM;
}
plus = fuse_use_readdirplus(inode, ctx);
req->out.argpages = 1;
req->num_pages = 1;
req->pages[0] = page;
req->page_descs[0].length = PAGE_SIZE;
if (plus) {
attr_version = fuse_get_attr_version(fc);
fuse_read_fill(req, file, ctx->pos, PAGE_SIZE,
FUSE_READDIRPLUS);
} else {
fuse_read_fill(req, file, ctx->pos, PAGE_SIZE,
FUSE_READDIR);
}
fuse_request_send(fc, req);
nbytes = req->out.args[0].size;
err = req->out.h.error;
fuse_put_request(fc, req);
if (!err) {
if (plus) {
err = parse_dirplusfile(page_address(page), nbytes,
file, ctx,
attr_version);
} else {
err = parse_dirfile(page_address(page), nbytes, file,
ctx);
}
}
__free_page(page);
fuse_invalidate_atime(inode);
return err;
}
static const char *fuse_follow_link(struct dentry *dentry, void **cookie)
{
struct inode *inode = d_inode(dentry);
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
char *link;
ssize_t ret;
link = (char *) __get_free_page(GFP_KERNEL);
if (!link)
return ERR_PTR(-ENOMEM);
args.in.h.opcode = FUSE_READLINK;
args.in.h.nodeid = get_node_id(inode);
args.out.argvar = 1;
args.out.numargs = 1;
args.out.args[0].size = PAGE_SIZE - 1;
args.out.args[0].value = link;
ret = fuse_simple_request(fc, &args);
if (ret < 0) {
free_page((unsigned long) link);
link = ERR_PTR(ret);
} else {
link[ret] = '\0';
*cookie = link;
}
fuse_invalidate_atime(inode);
return link;
}
static int fuse_dir_open(struct inode *inode, struct file *file)
{
return fuse_open_common(inode, file, true);
}
static int fuse_dir_release(struct inode *inode, struct file *file)
{
fuse_release_common(file, FUSE_RELEASEDIR);
return 0;
}
static int fuse_dir_fsync(struct file *file, loff_t start, loff_t end,
int datasync)
{
return fuse_fsync_common(file, start, end, datasync, 1);
}
static long fuse_dir_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
{
struct fuse_conn *fc = get_fuse_conn(file->f_mapping->host);
/* FUSE_IOCTL_DIR only supported for API version >= 7.18 */
if (fc->minor < 18)
return -ENOTTY;
return fuse_ioctl_common(file, cmd, arg, FUSE_IOCTL_DIR);
}
static long fuse_dir_compat_ioctl(struct file *file, unsigned int cmd,
unsigned long arg)
{
struct fuse_conn *fc = get_fuse_conn(file->f_mapping->host);
if (fc->minor < 18)
return -ENOTTY;
return fuse_ioctl_common(file, cmd, arg,
FUSE_IOCTL_COMPAT | FUSE_IOCTL_DIR);
}
static bool update_mtime(unsigned ivalid, bool trust_local_mtime)
{
/* Always update if mtime is explicitly set */
if (ivalid & ATTR_MTIME_SET)
return true;
/* Or if kernel i_mtime is the official one */
if (trust_local_mtime)
return true;
/* If it's an open(O_TRUNC) or an ftruncate(), don't update */
if ((ivalid & ATTR_SIZE) && (ivalid & (ATTR_OPEN | ATTR_FILE)))
return false;
/* In all other cases update */
return true;
}
static void iattr_to_fattr(struct iattr *iattr, struct fuse_setattr_in *arg,
bool trust_local_cmtime)
{
unsigned ivalid = iattr->ia_valid;
if (ivalid & ATTR_MODE)
arg->valid |= FATTR_MODE, arg->mode = iattr->ia_mode;
if (ivalid & ATTR_UID)
arg->valid |= FATTR_UID, arg->uid = from_kuid(&init_user_ns, iattr->ia_uid);
if (ivalid & ATTR_GID)
arg->valid |= FATTR_GID, arg->gid = from_kgid(&init_user_ns, iattr->ia_gid);
if (ivalid & ATTR_SIZE)
arg->valid |= FATTR_SIZE, arg->size = iattr->ia_size;
if (ivalid & ATTR_ATIME) {
arg->valid |= FATTR_ATIME;
arg->atime = iattr->ia_atime.tv_sec;
arg->atimensec = iattr->ia_atime.tv_nsec;
if (!(ivalid & ATTR_ATIME_SET))
arg->valid |= FATTR_ATIME_NOW;
}
if ((ivalid & ATTR_MTIME) && update_mtime(ivalid, trust_local_cmtime)) {
arg->valid |= FATTR_MTIME;
arg->mtime = iattr->ia_mtime.tv_sec;
arg->mtimensec = iattr->ia_mtime.tv_nsec;
if (!(ivalid & ATTR_MTIME_SET) && !trust_local_cmtime)
arg->valid |= FATTR_MTIME_NOW;
}
if ((ivalid & ATTR_CTIME) && trust_local_cmtime) {
arg->valid |= FATTR_CTIME;
arg->ctime = iattr->ia_ctime.tv_sec;
arg->ctimensec = iattr->ia_ctime.tv_nsec;
}
}
/*
* Prevent concurrent writepages on inode
*
* This is done by adding a negative bias to the inode write counter
* and waiting for all pending writes to finish.
*/
void fuse_set_nowrite(struct inode *inode)
{
struct fuse_conn *fc = get_fuse_conn(inode);
struct fuse_inode *fi = get_fuse_inode(inode);
BUG_ON(!mutex_is_locked(&inode->i_mutex));
spin_lock(&fc->lock);
BUG_ON(fi->writectr < 0);
fi->writectr += FUSE_NOWRITE;
spin_unlock(&fc->lock);
wait_event(fi->page_waitq, fi->writectr == FUSE_NOWRITE);
}
/*
* Allow writepages on inode
*
* Remove the bias from the writecounter and send any queued
* writepages.
*/
static void __fuse_release_nowrite(struct inode *inode)
{
struct fuse_inode *fi = get_fuse_inode(inode);
BUG_ON(fi->writectr != FUSE_NOWRITE);
fi->writectr = 0;
fuse_flush_writepages(inode);
}
void fuse_release_nowrite(struct inode *inode)
{
struct fuse_conn *fc = get_fuse_conn(inode);
spin_lock(&fc->lock);
__fuse_release_nowrite(inode);
spin_unlock(&fc->lock);
}
static void fuse_setattr_fill(struct fuse_conn *fc, struct fuse_args *args,
struct inode *inode,
struct fuse_setattr_in *inarg_p,
struct fuse_attr_out *outarg_p)
{
args->in.h.opcode = FUSE_SETATTR;
args->in.h.nodeid = get_node_id(inode);
args->in.numargs = 1;
args->in.args[0].size = sizeof(*inarg_p);
args->in.args[0].value = inarg_p;
args->out.numargs = 1;
args->out.args[0].size = sizeof(*outarg_p);
args->out.args[0].value = outarg_p;
}
/*
* Flush inode->i_mtime to the server
*/
int fuse_flush_times(struct inode *inode, struct fuse_file *ff)
{
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
struct fuse_setattr_in inarg;
struct fuse_attr_out outarg;
memset(&inarg, 0, sizeof(inarg));
memset(&outarg, 0, sizeof(outarg));
inarg.valid = FATTR_MTIME;
inarg.mtime = inode->i_mtime.tv_sec;
inarg.mtimensec = inode->i_mtime.tv_nsec;
if (fc->minor >= 23) {
inarg.valid |= FATTR_CTIME;
inarg.ctime = inode->i_ctime.tv_sec;
inarg.ctimensec = inode->i_ctime.tv_nsec;
}
if (ff) {
inarg.valid |= FATTR_FH;
inarg.fh = ff->fh;
}
fuse_setattr_fill(fc, &args, inode, &inarg, &outarg);
return fuse_simple_request(fc, &args);
}
/*
* Set attributes, and at the same time refresh them.
*
* Truncation is slightly complicated, because the 'truncate' request
* may fail, in which case we don't want to touch the mapping.
* vmtruncate() doesn't allow for this case, so do the rlimit checking
* and the actual truncation by hand.
*/
int fuse_do_setattr(struct inode *inode, struct iattr *attr,
struct file *file)
{
struct fuse_conn *fc = get_fuse_conn(inode);
struct fuse_inode *fi = get_fuse_inode(inode);
FUSE_ARGS(args);
struct fuse_setattr_in inarg;
struct fuse_attr_out outarg;
bool is_truncate = false;
bool is_wb = fc->writeback_cache;
loff_t oldsize;
int err;
bool trust_local_cmtime = is_wb && S_ISREG(inode->i_mode);
if (!(fc->flags & FUSE_DEFAULT_PERMISSIONS))
attr->ia_valid |= ATTR_FORCE;
err = inode_change_ok(inode, attr);
if (err)
return err;
if (attr->ia_valid & ATTR_OPEN) {
/* This is coming from open(..., ... | O_TRUNC); */
WARN_ON(!(attr->ia_valid & ATTR_SIZE));
WARN_ON(attr->ia_size != 0);
if (fc->atomic_o_trunc) {
/*
* No need to send request to userspace, since actual
* truncation has already been done by OPEN. But still
* need to truncate page cache.
*/
i_size_write(inode, 0);
truncate_pagecache(inode, 0);
return 0;
}
file = NULL;
}
if (attr->ia_valid & ATTR_SIZE)
is_truncate = true;
/* Flush dirty data/metadata before non-truncate SETATTR */
if (is_wb && S_ISREG(inode->i_mode) &&
attr->ia_valid &
(ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
ATTR_TIMES_SET)) {
err = write_inode_now(inode, true);
if (err)
return err;
fuse_set_nowrite(inode);
fuse_release_nowrite(inode);
}
if (is_truncate) {
fuse_set_nowrite(inode);
set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
if (trust_local_cmtime && attr->ia_size != inode->i_size)
attr->ia_valid |= ATTR_MTIME | ATTR_CTIME;
}
memset(&inarg, 0, sizeof(inarg));
memset(&outarg, 0, sizeof(outarg));
iattr_to_fattr(attr, &inarg, trust_local_cmtime);
if (file) {
struct fuse_file *ff = file->private_data;
inarg.valid |= FATTR_FH;
inarg.fh = ff->fh;
}
if (attr->ia_valid & ATTR_SIZE) {
/* For mandatory locking in truncate */
inarg.valid |= FATTR_LOCKOWNER;
inarg.lock_owner = fuse_lock_owner_id(fc, current->files);
}
fuse_setattr_fill(fc, &args, inode, &inarg, &outarg);
err = fuse_simple_request(fc, &args);
if (err) {
if (err == -EINTR)
fuse_invalidate_attr(inode);
goto error;
}
if (fuse_invalid_attr(&outarg.attr) ||
(inode->i_mode ^ outarg.attr.mode) & S_IFMT) {
make_bad_inode(inode);
err = -EIO;
goto error;
}
spin_lock(&fc->lock);
/* the kernel maintains i_mtime locally */
if (trust_local_cmtime) {
if (attr->ia_valid & ATTR_MTIME)
inode->i_mtime = attr->ia_mtime;
if (attr->ia_valid & ATTR_CTIME)
inode->i_ctime = attr->ia_ctime;
/* FIXME: clear I_DIRTY_SYNC? */
}
fuse_change_attributes_common(inode, &outarg.attr,
attr_timeout(&outarg));
oldsize = inode->i_size;
/* see the comment in fuse_change_attributes() */
if (!is_wb || is_truncate || !S_ISREG(inode->i_mode))
i_size_write(inode, outarg.attr.size);
if (is_truncate) {
/* NOTE: this may release/reacquire fc->lock */
__fuse_release_nowrite(inode);
}
spin_unlock(&fc->lock);
/*
* Only call invalidate_inode_pages2() after removing
* FUSE_NOWRITE, otherwise fuse_launder_page() would deadlock.
*/
if ((is_truncate || !is_wb) &&
S_ISREG(inode->i_mode) && oldsize != outarg.attr.size) {
truncate_pagecache(inode, outarg.attr.size);
invalidate_inode_pages2(inode->i_mapping);
}
clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
return 0;
error:
if (is_truncate)
fuse_release_nowrite(inode);
clear_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
return err;
}
static int fuse_setattr(struct dentry *entry, struct iattr *attr)
{
struct inode *inode = d_inode(entry);
struct file *file = (attr->ia_valid & ATTR_FILE) ? attr->ia_file : NULL;
int ret;
if (!fuse_allow_current_process(get_fuse_conn(inode)))
return -EACCES;
if (attr->ia_valid & (ATTR_KILL_SUID | ATTR_KILL_SGID)) {
int kill;
attr->ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID |
ATTR_MODE);
/*
* ia_mode calculation may have used stale i_mode. Refresh and
* recalculate.
*/
ret = fuse_do_getattr(inode, NULL, file);
if (ret)
return ret;
attr->ia_mode = inode->i_mode;
kill = should_remove_suid(entry);
if (kill & ATTR_KILL_SUID) {
attr->ia_valid |= ATTR_MODE;
attr->ia_mode &= ~S_ISUID;
}
if (kill & ATTR_KILL_SGID) {
attr->ia_valid |= ATTR_MODE;
attr->ia_mode &= ~S_ISGID;
}
}
if (!attr->ia_valid)
return 0;
ret = fuse_do_setattr(inode, attr, file);
if (!ret) {
/* Directory mode changed, may need to revalidate access */
if (d_is_dir(entry) && (attr->ia_valid & ATTR_MODE))
fuse_invalidate_entry_cache(entry);
}
return ret;
}
static int fuse_getattr(struct vfsmount *mnt, struct dentry *entry,
struct kstat *stat)
{
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
if (!fuse_allow_current_process(fc))
return -EACCES;
return fuse_update_attributes(inode, stat, NULL, NULL);
}
static int fuse_setxattr(struct dentry *entry, const char *name,
const void *value, size_t size, int flags)
{
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
struct fuse_setxattr_in inarg;
int err;
if (fc->no_setxattr)
return -EOPNOTSUPP;
memset(&inarg, 0, sizeof(inarg));
inarg.size = size;
inarg.flags = flags;
args.in.h.opcode = FUSE_SETXATTR;
args.in.h.nodeid = get_node_id(inode);
args.in.numargs = 3;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.in.args[1].size = strlen(name) + 1;
args.in.args[1].value = name;
args.in.args[2].size = size;
args.in.args[2].value = value;
err = fuse_simple_request(fc, &args);
if (err == -ENOSYS) {
fc->no_setxattr = 1;
err = -EOPNOTSUPP;
}
if (!err) {
fuse_invalidate_attr(inode);
fuse_update_ctime(inode);
}
return err;
}
static ssize_t fuse_getxattr(struct dentry *entry, const char *name,
void *value, size_t size)
{
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
struct fuse_getxattr_in inarg;
struct fuse_getxattr_out outarg;
ssize_t ret;
if (fc->no_getxattr)
return -EOPNOTSUPP;
memset(&inarg, 0, sizeof(inarg));
inarg.size = size;
args.in.h.opcode = FUSE_GETXATTR;
args.in.h.nodeid = get_node_id(inode);
args.in.numargs = 2;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
args.in.args[1].size = strlen(name) + 1;
args.in.args[1].value = name;
/* This is really two different operations rolled into one */
args.out.numargs = 1;
if (size) {
args.out.argvar = 1;
args.out.args[0].size = size;
args.out.args[0].value = value;
} else {
args.out.args[0].size = sizeof(outarg);
args.out.args[0].value = &outarg;
}
ret = fuse_simple_request(fc, &args);
if (!ret && !size)
ret = outarg.size;
if (ret == -ENOSYS) {
fc->no_getxattr = 1;
ret = -EOPNOTSUPP;
}
return ret;
}
static int fuse_verify_xattr_list(char *list, size_t size)
{
size_t origsize = size;
while (size) {
size_t thislen = strnlen(list, size);
if (!thislen || thislen == size)
return -EIO;
size -= thislen + 1;
list += thislen + 1;
}
return origsize;
}
static ssize_t fuse_listxattr(struct dentry *entry, char *list, size_t size)
{
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
struct fuse_getxattr_in inarg;
struct fuse_getxattr_out outarg;
ssize_t ret;
if (!fuse_allow_current_process(fc))
return -EACCES;
if (fc->no_listxattr)
return -EOPNOTSUPP;
memset(&inarg, 0, sizeof(inarg));
inarg.size = size;
args.in.h.opcode = FUSE_LISTXATTR;
args.in.h.nodeid = get_node_id(inode);
args.in.numargs = 1;
args.in.args[0].size = sizeof(inarg);
args.in.args[0].value = &inarg;
/* This is really two different operations rolled into one */
args.out.numargs = 1;
if (size) {
args.out.argvar = 1;
args.out.args[0].size = size;
args.out.args[0].value = list;
} else {
args.out.args[0].size = sizeof(outarg);
args.out.args[0].value = &outarg;
}
ret = fuse_simple_request(fc, &args);
if (!ret && !size)
ret = outarg.size;
if (ret > 0 && size)
ret = fuse_verify_xattr_list(list, ret);
if (ret == -ENOSYS) {
fc->no_listxattr = 1;
ret = -EOPNOTSUPP;
}
return ret;
}
static int fuse_removexattr(struct dentry *entry, const char *name)
{
struct inode *inode = d_inode(entry);
struct fuse_conn *fc = get_fuse_conn(inode);
FUSE_ARGS(args);
int err;
if (fc->no_removexattr)
return -EOPNOTSUPP;
args.in.h.opcode = FUSE_REMOVEXATTR;
args.in.h.nodeid = get_node_id(inode);
args.in.numargs = 1;
args.in.args[0].size = strlen(name) + 1;
args.in.args[0].value = name;
err = fuse_simple_request(fc, &args);
if (err == -ENOSYS) {
fc->no_removexattr = 1;
err = -EOPNOTSUPP;
}
if (!err) {
fuse_invalidate_attr(inode);
fuse_update_ctime(inode);
}
return err;
}
static const struct inode_operations fuse_dir_inode_operations = {
.lookup = fuse_lookup,
.mkdir = fuse_mkdir,
.symlink = fuse_symlink,
.unlink = fuse_unlink,
.rmdir = fuse_rmdir,
.rename2 = fuse_rename2,
.link = fuse_link,
.setattr = fuse_setattr,
.create = fuse_create,
.atomic_open = fuse_atomic_open,
.mknod = fuse_mknod,
.permission = fuse_permission,
.getattr = fuse_getattr,
.setxattr = fuse_setxattr,
.getxattr = fuse_getxattr,
.listxattr = fuse_listxattr,
.removexattr = fuse_removexattr,
};
static const struct file_operations fuse_dir_operations = {
.llseek = generic_file_llseek,
.read = generic_read_dir,
.iterate = fuse_readdir,
.open = fuse_dir_open,
.release = fuse_dir_release,
.fsync = fuse_dir_fsync,
.unlocked_ioctl = fuse_dir_ioctl,
.compat_ioctl = fuse_dir_compat_ioctl,
};
static const struct inode_operations fuse_common_inode_operations = {
.setattr = fuse_setattr,
.permission = fuse_permission,
.getattr = fuse_getattr,
.setxattr = fuse_setxattr,
.getxattr = fuse_getxattr,
.listxattr = fuse_listxattr,
.removexattr = fuse_removexattr,
};
static const struct inode_operations fuse_symlink_inode_operations = {
.setattr = fuse_setattr,
.follow_link = fuse_follow_link,
.put_link = free_page_put_link,
.readlink = generic_readlink,
.getattr = fuse_getattr,
.setxattr = fuse_setxattr,
.getxattr = fuse_getxattr,
.listxattr = fuse_listxattr,
.removexattr = fuse_removexattr,
};
void fuse_init_common(struct inode *inode)
{
inode->i_op = &fuse_common_inode_operations;
}
void fuse_init_dir(struct inode *inode)
{
inode->i_op = &fuse_dir_inode_operations;
inode->i_fop = &fuse_dir_operations;
}
void fuse_init_symlink(struct inode *inode)
{
inode->i_op = &fuse_symlink_inode_operations;
}