xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] fix races and leaks in vfs_quota_on() users

Browse Source 
* new helper: vfs_quota_on_path(); equivalent of vfs_quota_on() sans the
  pathname resolution.
* callers of vfs_quota_on() that do their own pathname resolution and
  checks based on it are switched to vfs_quota_on_path(); that way we
  avoid the races.
* reiserfs leaked dentry/vfsmount references on several failure exits.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro
2008-08-01 04:29:18 -04:00
parent 1b7e190b47
commit 77e69dac3c
5 changed files with 35 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
fs/reiserfs/super.c
View File

@@ -2076,8 +2076,8 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
return err;
/* Quotafile not on the same filesystem? */
if (nd.path.mnt->mnt_sb != sb) {
path_put(&nd.path);
return -EXDEV;
err = -EXDEV;
goto out;
}
inode = nd.path.dentry->d_inode;
/* We must not pack tails for quota files on reiserfs for quota IO to work */
@@ -2087,8 +2087,8 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
reiserfs_warning(sb,
"reiserfs: Unpacking tail of quota file failed"
" (%d). Cannot turn on quotas.", err);
path_put(&nd.path);
return -EINVAL;
err = -EINVAL;
goto out;
}
mark_inode_dirty(inode);
}
@@ -2109,13 +2109,15 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
/* Just start temporary transaction and finish it */
err = journal_begin(&th, sb, 1);
if (err)
return err;
goto out;
err = journal_end_sync(&th, sb, 1);
if (err)
return err;
goto out;
}
err = vfs_quota_on_path(sb, type, format_id, &nd.path);
out:
path_put(&nd.path);
return vfs_quota_on(sb, type, format_id, path, 0);
return err;
}
/* Read data from quotafile - avoid pagecache and such because we cannot afford