Al Viro
90ef231ba5
epoll: EPOLL_CTL_ADD: close the race in decision to take fast path ...
commit fe0a916c1eae8e17e86c3753d13919177d63ed7e upstream.
Checking for the lack of epitems refering to the epoll we want to insert into
is not enough; we might have an insertion of that epoll into another one that
has already collected the set of files to recheck for excessive reverse paths,
but hasn't gotten to creating/inserting the epitem for it.
However, any such insertion in progress can be detected - it will update the
generation count in our epoll when it's done looking through it for files
to check. That gets done under ->mtx of our epoll and that allows us to
detect that safely.
We are *not* holding epmutex here, so the generation count is not stable.
However, since both the update of ep->gen by loop check and (later)
insertion into ->f_ep_link are done with ep->mtx held, we are fine -
the sequence is
grab epmutex
bump loop_check_gen
...
grab tep->mtx // 1
tep->gen = loop_check_gen
...
drop tep->mtx // 2
...
grab tep->mtx // 3
...
insert into ->f_ep_link
...
drop tep->mtx // 4
bump loop_check_gen
drop epmutex
and if the fastpath check in another thread happens for that
eventpoll, it can come
* before (1) - in that case fastpath is just fine
* after (4) - we'll see non-empty ->f_ep_link, slow path
taken
* between (2) and (3) - loop_check_gen is stable,
with ->mtx providing barriers and we end up taking slow path.
Note that ->f_ep_link emptiness check is slightly racy - we are protected
against insertions into that list, but removals can happen right under us.
Not a problem - in the worst case we'll end up taking a slow path for
no good reason.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2020-10-07 08:00:09 +02:00
9p: Fix memory leak in v9fs_mount
2020-08-19 08:15:06 +02:00
fs/adfs: super: fix use-after-free bug
2019-08-06 19:06:49 +02:00
affs: fix basic permission bits to actually work
2020-09-09 19:04:30 +02:00
afs: Fix NULL deref in afs_dynroot_depopulate()
2020-08-26 10:31:05 +02:00
autofs: fix a leak in autofs_expire_indirect()
2019-12-13 08:51:01 +01:00
fix a series of Documentation/ broken file name references
2018-06-15 18:10:01 -03:00
bfs: add sanity check at bfs_fill_super()
2018-12-01 09:37:27 +01:00
btrfs: qgroup: fix data leak caused by race between writeback and truncate
2020-10-01 13:14:49 +02:00
cachefiles: Fix race between read_waiter and read_copier involving op->to_do
2020-06-03 08:19:29 +02:00
ceph: fix potential race in ceph_check_caps
2020-10-01 13:14:47 +02:00
cifs: Fix double add page to memcg when cifs_readpages
2020-10-01 13:14:48 +02:00
coda: add error handling for fget
2019-08-06 19:06:51 +02:00
configfs: fix config_item refcnt leak in configfs_rmdir()
2020-05-27 17:37:32 +02:00
Cramfs: fix abad comparison when wrap-arounds occur
2018-11-13 11:08:55 -08:00
fscrypt: clean up some BUG_ON()s in block encryption/decryption
2019-07-26 09:14:02 +02:00
debugfs: fix use-after-free on symlink traversal
2019-05-08 07:21:48 +02:00
fs/devpts: always delete dcache dentry-s in dput()
2019-03-23 20:09:59 +01:00
dlm: Fix kobject memleak
2020-08-19 08:15:02 +02:00
ecryptfs: replace BUG_ON with error handling code
2020-02-28 16:38:59 +01:00
efivars: Call guid_parse() against guid_t type of variable
2018-07-22 14:13:44 +02:00
exofs_mount(): fix leaks on failure exits
2019-12-05 09:20:32 +01:00
exportfs: fix 'passing zero to ERR_PTR()' warning
2020-01-27 14:50:02 +01:00
ext2: don't update mtime on COW faults
2020-09-09 19:04:28 +02:00
ext4: mark block bitmap corrupted when found instead of BUGON
2020-10-01 13:14:37 +02:00
f2fs: Return EOF on unaligned end of file DIO read
2020-09-23 12:10:59 +02:00
fat: don't allow to mount if the FAT length == 0
2020-06-22 09:05:08 +02:00
fscache: fix race between enablement and dropping of object
2018-12-17 09:24:40 +01:00
fuse: don't check refcount after stealing page
2020-10-01 13:14:44 +02:00
gfs2: clean up iopen glock mess in gfs2_create_inode
2020-10-01 13:14:28 +02:00
fs/hfs/extent.c: fix array out of bounds read of array extent
2019-12-01 09:17:10 +01:00
hfsplus: fix crash and filesystem corruption when deleting files
2020-04-17 10:48:52 +02:00
vfs: discard ATTR_ATTR_FLAG
2018-08-17 16:20:28 -07:00
hpfs: remove unnecessary checks on the value of r when assigning error code
2018-08-25 12:42:33 -07:00
hugetlb: use same fault hash key for shared and private mappings
2019-05-22 07:37:40 +02:00
isofs: reject hardware sector size > 2048 bytes
2018-08-21 11:37:41 +02:00
jbd2: abort journal if free a async write error metadata buffer
2020-09-03 11:24:24 +02:00
jffs2: fix UAF problem
2020-08-26 10:31:01 +02:00
jfs: fix bogus variable self-initialization
2020-01-27 14:50:33 +01:00
kernfs: fix ino wrap-around detection
2019-12-13 08:52:43 +01:00
lockd: fix decoding of TEST results
2019-12-13 08:51:59 +01:00
fs/minix: remove expected error message in block_to_path()
2020-08-21 11:05:38 +02:00
nfs: Fix security label length not being reset
2020-10-07 08:00:07 +02:00
nfsd: Don't add locks to closed or closing open stateids
2020-10-01 13:14:38 +02:00
nilfs2: fix null pointer dereference at nilfs_segctor_do_construct()
2020-06-22 09:05:03 +02:00
fanotify: fix ignore mask logic for events on child and on dir
2020-06-30 23:17:00 -04:00
ntfs: mft: remove VLA usage
2018-08-17 16:20:27 -07:00
ocfs2: change slot number type s16 to u16
2020-08-21 11:05:33 +02:00
help_next should increase position index
2020-02-24 08:34:53 +01:00
ovl: fix unneeded call to ovl_change_flags()
2020-07-22 09:32:10 +02:00
proc: Use new_inode not new_inode_pseudo
2020-06-22 09:05:06 +02:00
pstore: Fix linking when crypto API disabled
2020-08-19 08:15:04 +02:00
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:17:20 +01:00
reiserfs: prevent NULL pointer dereference in reiserfs_insert_item()
2020-02-24 08:34:52 +01:00
romfs: fix uninitialized memory leak in romfs_dev_read()
2020-08-26 10:30:59 +02:00
Squashfs: Compute expected length from inode size rather than block length
2018-08-02 09:34:02 -07:00
Driver core patches for 4.19-rc1
2018-08-18 11:44:53 -07:00
sysv: return 'err' instead of 0 in __sysv_write_inode
2018-12-17 09:24:30 +01:00
tracefs: Annotate tracefs_ops with __ro_after_init
2018-07-31 11:32:44 -04:00
ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len
2020-10-01 13:14:40 +02:00
udf: Fix free space reporting for metadata and virtual partitions
2020-02-24 08:34:45 +01:00
fs/ufs: avoid potential u32 multiplication overflow
2020-08-21 11:05:38 +02:00
xfs: mark dir corrupt when lookup-by-hash fails
2020-10-01 13:14:37 +02:00
aio: fix async fsync creds
2020-06-22 09:05:01 +02:00
anon_inode_getfile(): switch to alloc_file_pseudo()
2018-07-12 10:04:27 -04:00
fs: Fix attr.c kernel-doc
2018-07-03 16:44:45 -04:00
get rid of 'opened' argument of ->atomic_open() - part 3
2018-07-12 10:04:20 -04:00
fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
2020-06-03 08:19:41 +02:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
fs/binfmt_flat.c: make load_flat_shared_library() work
2019-07-03 13:14:44 +02:00
turn filp_clone_open() into inline wrapper for dentry_open()
2018-07-10 23:29:03 -04:00
exec: load_script: Do not exec truncated interpreter path
2019-11-06 13:05:37 +01:00
bdev: Reduce time holding bd_mutex in sync in blkdev_close()
2020-10-01 13:14:42 +02:00
fs: prevent BUG_ON in submit_bh_wbc()
2020-09-03 11:24:24 +02:00
chardev: Avoid potential use-after-free in 'chrdev_open()'
2020-01-14 20:06:57 +01:00
fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP
2020-01-09 10:19:07 +01:00
coredump: fix crash when umh is disabled
2020-05-14 07:57:21 +02:00
dax: pass NOWAIT flag to iomap_apply
2020-03-05 16:42:12 +01:00
fix dget_parent() fastpath race
2020-10-01 13:14:27 +02:00
direct-io: allow direct writes to empty inodes
2019-03-05 17:58:50 +01:00
fs: avoid softlockups in s_inodes iterators
2020-01-12 12:17:20 +01:00
eventfd: track eventfd_signal() recursion depth
2020-02-11 04:34:08 -08:00
epoll: EPOLL_CTL_ADD: close the race in decision to take fast path
2020-10-07 08:00:09 +02:00
exec: Move would_dump into flush_old_exec
2020-05-20 08:18:50 +02:00
signal: Don't send signals to tasks that don't exist
2018-08-15 23:03:20 -05:00
fix multiplication overflow in copy_fdtable()
2020-05-27 17:37:29 +02:00
overlayfs update for 4.19
2018-08-21 18:19:09 -07:00
fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once()
2020-04-17 10:48:51 +02:00
writeback: Fix sync livelock due to b_dirty_time processing
2020-09-03 11:24:28 +02:00
futex: Fix inode life-time issue
2020-03-25 08:06:14 +01:00
acct_on(): don't mess with freeze protection
2019-05-31 06:46:05 -07:00
vfs: fix FIGETBSZ ioctl on an overlayfs file
2018-11-21 09:19:14 +01:00
iomap: partially revert 4721a601099 (simulated directio short read on EFAULT)
2019-12-13 08:52:56 +01:00
autofs: remove left-over autofs4 stubs
2018-06-11 08:22:34 -07:00
kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt
2018-08-02 08:06:55 +09:00
libfs: fix infoleak in simple_attr_read()
2020-04-02 15:28:21 +02:00
locks: print unsigned ino in /proc/locks
2020-01-09 10:19:00 +01:00
autofs: remove left-over autofs4 stubs
2018-06-11 08:22:34 -07:00
treewide: kmalloc() -> kmalloc_array()
2018-06-12 16:19:22 -07:00
mpage: mpage_readpages() should submit IO as read-ahead
2018-08-17 16:20:29 -07:00
namei: only return -ECHILD from follow_dotdot_rcu()
2020-03-05 16:42:20 +01:00
fs/namespace.c: fix mountpoint reference counter race
2020-04-29 16:31:26 +02:00
dcache: sort the freeing-without-RCU-delay mess for good.
2019-05-25 18:23:26 +02:00
cifs_atomic_open(): fix double-put on late allocation failure
2020-03-18 07:14:21 +01:00
fs: prevent page refcount overflow in pipe_buf_get
2019-05-04 09:20:11 +02:00
propagate_one(): mnt_set_mountpoint() needs mount_lock
2020-05-02 17:26:01 +02:00
vfs: avoid problematic remapping requests into partial EOF block
2019-12-01 09:17:04 +01:00
filldir[64]: remove WARN_ON_ONCE() for bad directory entries
2020-01-04 19:13:26 +01:00
Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL
2018-06-28 10:40:47 -07:00
seq_file: fix problem when seeking mid-record
2019-08-25 10:47:43 +02:00
fs/signalfd.c: fix inconsistent return codes for signalfd4
2020-08-26 10:31:02 +02:00
splice: only read in as much information as there is pipe buffer space
2019-12-17 20:35:43 +01:00
vfs: Fix EOVERFLOW testing in put_compat_statfs64
2019-10-11 18:21:39 +02:00
Merge branch 'ida-4.19' of git://git.infradead.org/users/willy/linux-dax
2018-08-26 11:48:42 -07:00
Merge branch 'work.aio' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2018-08-13 20:56:23 -07:00
userfaultfd: require CAP_SYS_PTRACE for UFFD_FEATURE_EVENT_FORK
2020-01-04 19:13:18 +01:00
xattr: break delegations in {set,remove}xattr
2020-08-11 15:32:34 +02:00
90ef231ba5