提交 2db1125d 编写于 作者: L Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  mount_subtree() pointless use-after-free
  iio: fix a leak due to improper use of anon_inode_getfd()
  microblaze: bury asm/namei.h
/*
* Copyright (C) 2006 Atmark Techno, Inc.
*
* This file is subject to the terms and conditions of the GNU General Public
* License. See the file "COPYING" in the main directory of this archive
* for more details.
*/
#ifndef _ASM_MICROBLAZE_NAMEI_H
#define _ASM_MICROBLAZE_NAMEI_H
#ifdef __KERNEL__
/* This dummy routine maybe changed to something useful
* for /usr/gnemul/ emulation stuff.
* Look at asm-sparc/namei.h for details.
*/
#define __emul_prefix() NULL
#endif /* __KERNEL__ */
#endif /* _ASM_MICROBLAZE_NAMEI_H */
......@@ -242,6 +242,8 @@ static const struct file_operations iio_event_chrdev_fileops = {
static int iio_event_getfd(struct iio_dev *indio_dev)
{
int fd;
if (indio_dev->event_interface == NULL)
return -ENODEV;
......@@ -252,9 +254,15 @@ static int iio_event_getfd(struct iio_dev *indio_dev)
return -EBUSY;
}
mutex_unlock(&indio_dev->event_interface->event_list_lock);
return anon_inode_getfd("iio:event",
fd = anon_inode_getfd("iio:event",
&iio_event_chrdev_fileops,
indio_dev->event_interface, O_RDONLY);
if (fd < 0) {
mutex_lock(&indio_dev->event_interface->event_list_lock);
clear_bit(IIO_BUSY_BIT_POS, &ev_int->flags);
mutex_unlock(&indio_dev->event_interface->event_list_lock);
}
return fd;
}
static int __init iio_init(void)
......
......@@ -2493,6 +2493,7 @@ EXPORT_SYMBOL(create_mnt_ns);
struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
{
struct mnt_namespace *ns;
struct super_block *s;
struct path path;
int err;
......@@ -2509,10 +2510,11 @@ struct dentry *mount_subtree(struct vfsmount *mnt, const char *name)
return ERR_PTR(err);
/* trade a vfsmount reference for active sb one */
atomic_inc(&path.mnt->mnt_sb->s_active);
s = path.mnt->mnt_sb;
atomic_inc(&s->s_active);
mntput(path.mnt);
/* lock the sucker */
down_write(&path.mnt->mnt_sb->s_umount);
down_write(&s->s_umount);
/* ... and return the root of (sub)tree on it */
return path.dentry;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册