Skip to content

Commit

Permalink
Fix nasty ncpfs symlink handling bug.
Browse files Browse the repository at this point in the history 
This bug could cause oopses and page state corruption, because ncpfs
used the generic page-cache symlink handlign functions.  But those
functions only work if the page cache is guaranteed to be "stable", ie a
page that was installed when the symlink walk was started has to still
be installed in the page cache at the end of the walk.

We could have fixed ncpfs to not use the generic helper routines, but it
is in many ways much cleaner to instead improve on the symlink walking
helper routines so that they don't require that absolute stability.

We do this by allowing "follow_link()" to return a error-pointer as a
cookie, which is fed back to the cleanup "put_link()" routine.  This
also simplifies NFS symlink handling.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
  • Loading branch information
Linus Torvalds committed Aug 20, 2005
1 parent 2fb1e30 commit cc314ee
Show file tree
Hide file tree
Showing 10 changed files with 54 additions and 77 deletions.
5 changes: 3 additions & 2 deletions fs/autofs/symlink.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -12,11 +12,12 @@

#include "autofs_i.h"

static int autofs_follow_link(struct dentry *dentry, struct nameidata *nd)
/* Nothing to release.. */
static void *autofs_follow_link(struct dentry *dentry, struct nameidata *nd)
{
char *s=((struct autofs_symlink *)dentry->d_inode->u.generic_ip)->data;
nd_set_link(nd, s);
return 0;
return NULL;
}

struct inode_operations autofs_symlink_inode_operations = {
Expand Down
4 changes: 2 additions & 2 deletions fs/cifs/cifsfs.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,8 +83,8 @@ extern int cifs_dir_notify(struct file *, unsigned long arg);
extern struct dentry_operations cifs_dentry_ops;

/* Functions related to symlinks */
extern int cifs_follow_link(struct dentry *direntry, struct nameidata *nd);
extern void cifs_put_link(struct dentry *direntry, struct nameidata *nd);
extern void *cifs_follow_link(struct dentry *direntry, struct nameidata *nd);
extern void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *);
extern int cifs_readlink(struct dentry *direntry, char __user *buffer,
int buflen);
extern int cifs_symlink(struct inode *inode, struct dentry *direntry,
Expand Down
6 changes: 3 additions & 3 deletions fs/cifs/link.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ cifs_hardlink(struct dentry *old_file, struct inode *inode,
return rc;
}

int
void *
cifs_follow_link(struct dentry *direntry, struct nameidata *nd)
{
struct inode *inode = direntry->d_inode;
Expand Down Expand Up @@ -148,7 +148,7 @@ cifs_follow_link(struct dentry *direntry, struct nameidata *nd)
out_no_free:
FreeXid(xid);
nd_set_link(nd, target_path);
return 0;
return NULL; /* No cookie */
}

int
Expand Down Expand Up @@ -330,7 +330,7 @@ cifs_readlink(struct dentry *direntry, char __user *pBuffer, int buflen)
return rc;
}

void cifs_put_link(struct dentry *direntry, struct nameidata *nd)
void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
{
char *p = nd_get_link(nd);
if (!IS_ERR(p))
Expand Down
4 changes: 2 additions & 2 deletions fs/ext2/symlink.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@
#include "xattr.h"
#include <linux/namei.h>

static int ext2_follow_link(struct dentry *dentry, struct nameidata *nd)
static void *ext2_follow_link(struct dentry *dentry, struct nameidata *nd)
{
struct ext2_inode_info *ei = EXT2_I(dentry->d_inode);
nd_set_link(nd, (char *)ei->i_data);
return 0;
return NULL;
}

struct inode_operations ext2_symlink_inode_operations = {
Expand Down
4 changes: 2 additions & 2 deletions fs/ext3/symlink.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,11 +23,11 @@
#include <linux/namei.h>
#include "xattr.h"

static int ext3_follow_link(struct dentry *dentry, struct nameidata *nd)
static void * ext3_follow_link(struct dentry *dentry, struct nameidata *nd)
{
struct ext3_inode_info *ei = EXT3_I(dentry->d_inode);
nd_set_link(nd, (char*)ei->i_data);
return 0;
return NULL;
}

struct inode_operations ext3_symlink_inode_operations = {
Expand Down
40 changes: 21 additions & 19 deletions fs/namei.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -501,20 +501,23 @@ struct path {
static inline int __do_follow_link(struct path *path, struct nameidata *nd)
{
int error;
void *cookie;
struct dentry *dentry = path->dentry;

touch_atime(path->mnt, dentry);
nd_set_link(nd, NULL);

if (path->mnt == nd->mnt)
mntget(path->mnt);
error = dentry->d_inode->i_op->follow_link(dentry, nd);
if (!error) {
cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
error = PTR_ERR(cookie);
if (!IS_ERR(cookie)) {
char *s = nd_get_link(nd);
error = 0;
if (s)
error = __vfs_follow_link(nd, s);
if (dentry->d_inode->i_op->put_link)
dentry->d_inode->i_op->put_link(dentry, nd);
dentry->d_inode->i_op->put_link(dentry, nd, cookie);
}
dput(dentry);
mntput(path->mnt);
Expand Down Expand Up @@ -2344,15 +2347,17 @@ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const c
int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
{
struct nameidata nd;
int res;
void *cookie;

nd.depth = 0;
res = dentry->d_inode->i_op->follow_link(dentry, &nd);
if (!res) {
res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
if (!IS_ERR(cookie)) {
int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
if (dentry->d_inode->i_op->put_link)
dentry->d_inode->i_op->put_link(dentry, &nd);
dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
cookie = ERR_PTR(res);
}
return res;
return PTR_ERR(cookie);
}

int vfs_follow_link(struct nameidata *nd, const char *link)
Expand Down Expand Up @@ -2395,23 +2400,20 @@ int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
return res;
}

int page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
{
struct page *page;
struct page *page = NULL;
nd_set_link(nd, page_getlink(dentry, &page));
return 0;
return page;
}

void page_put_link(struct dentry *dentry, struct nameidata *nd)
void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
{
if (!IS_ERR(nd_get_link(nd))) {
struct page *page;
page = find_get_page(dentry->d_inode->i_mapping, 0);
if (!page)
BUG();
struct page *page = cookie;

if (page) {
kunmap(page);
page_cache_release(page);
page_cache_release(page);
}
}

Expand Down
37 changes: 8 additions & 29 deletions fs/nfs/symlink.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -27,26 +27,14 @@

/* Symlink caching in the page cache is even more simplistic
* and straight-forward than readdir caching.
*
* At the beginning of the page we store pointer to struct page in question,
* simplifying nfs_put_link() (if inode got invalidated we can't find the page
* to be freed via pagecache lookup).
* The NUL-terminated string follows immediately thereafter.
*/

struct nfs_symlink {
struct page *page;
char body[0];
};

static int nfs_symlink_filler(struct inode *inode, struct page *page)
{
const unsigned int pgbase = offsetof(struct nfs_symlink, body);
const unsigned int pglen = PAGE_SIZE - pgbase;
int error;

lock_kernel();
error = NFS_PROTO(inode)->readlink(inode, page, pgbase, pglen);
error = NFS_PROTO(inode)->readlink(inode, page, 0, PAGE_SIZE);
unlock_kernel();
if (error < 0)
goto error;
Expand All @@ -60,11 +48,10 @@ static int nfs_symlink_filler(struct inode *inode, struct page *page)
return -EIO;
}

static int nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
static void *nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
{
struct inode *inode = dentry->d_inode;
struct page *page;
struct nfs_symlink *p;
void *err = ERR_PTR(nfs_revalidate_inode(NFS_SERVER(inode), inode));
if (err)
goto read_failed;
Expand All @@ -78,28 +65,20 @@ static int nfs_follow_link(struct dentry *dentry, struct nameidata *nd)
err = ERR_PTR(-EIO);
goto getlink_read_error;
}
p = kmap(page);
p->page = page;
nd_set_link(nd, p->body);
return 0;
nd_set_link(nd, kmap(page));
return page;

getlink_read_error:
page_cache_release(page);
read_failed:
nd_set_link(nd, err);
return 0;
return NULL;
}

static void nfs_put_link(struct dentry *dentry, struct nameidata *nd)
static void nfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
{
char *s = nd_get_link(nd);
if (!IS_ERR(s)) {
struct nfs_symlink *p;
struct page *page;

p = container_of(s, struct nfs_symlink, body[0]);
page = p->page;

if (cookie) {
struct page *page = cookie;
kunmap(page);
page_cache_release(page);
}
Expand Down
6 changes: 3 additions & 3 deletions fs/sysfs/symlink.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,17 +151,17 @@ static int sysfs_getlink(struct dentry *dentry, char * path)

}

static int sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
static void *sysfs_follow_link(struct dentry *dentry, struct nameidata *nd)
{
int error = -ENOMEM;
unsigned long page = get_zeroed_page(GFP_KERNEL);
if (page)
error = sysfs_getlink(dentry, (char *) page);
nd_set_link(nd, error ? ERR_PTR(error) : (char *)page);
return 0;
return NULL;
}

static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd)
static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
{
char *page = nd_get_link(nd);
if (!IS_ERR(page))
Expand Down
8 changes: 4 additions & 4 deletions include/linux/fs.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -993,8 +993,8 @@ struct inode_operations {
int (*rename) (struct inode *, struct dentry *,
struct inode *, struct dentry *);
int (*readlink) (struct dentry *, char __user *,int);
int (*follow_link) (struct dentry *, struct nameidata *);
void (*put_link) (struct dentry *, struct nameidata *);
void * (*follow_link) (struct dentry *, struct nameidata *);
void (*put_link) (struct dentry *, struct nameidata *, void *);
void (*truncate) (struct inode *);
int (*permission) (struct inode *, int, struct nameidata *);
int (*setattr) (struct dentry *, struct iattr *);
Expand Down Expand Up @@ -1602,8 +1602,8 @@ extern struct file_operations generic_ro_fops;
extern int vfs_readlink(struct dentry *, char __user *, int, const char *);
extern int vfs_follow_link(struct nameidata *, const char *);
extern int page_readlink(struct dentry *, char __user *, int);
extern int page_follow_link_light(struct dentry *, struct nameidata *);
extern void page_put_link(struct dentry *, struct nameidata *);
extern void *page_follow_link_light(struct dentry *, struct nameidata *);
extern void page_put_link(struct dentry *, struct nameidata *, void *);
extern int page_symlink(struct inode *inode, const char *symname, int len);
extern struct inode_operations page_symlink_inode_operations;
extern int generic_readlink(struct dentry *, char __user *, int);
Expand Down
17 changes: 6 additions & 11 deletions mm/shmem.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1773,32 +1773,27 @@ static int shmem_symlink(struct inode *dir, struct dentry *dentry, const char *s
return 0;
}

static int shmem_follow_link_inline(struct dentry *dentry, struct nameidata *nd)
static void *shmem_follow_link_inline(struct dentry *dentry, struct nameidata *nd)
{
nd_set_link(nd, (char *)SHMEM_I(dentry->d_inode));
return 0;
return NULL;
}

static int shmem_follow_link(struct dentry *dentry, struct nameidata *nd)
static void *shmem_follow_link(struct dentry *dentry, struct nameidata *nd)
{
struct page *page = NULL;
int res = shmem_getpage(dentry->d_inode, 0, &page, SGP_READ, NULL);
nd_set_link(nd, res ? ERR_PTR(res) : kmap(page));
return 0;
return page;
}

static void shmem_put_link(struct dentry *dentry, struct nameidata *nd)
static void shmem_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
{
if (!IS_ERR(nd_get_link(nd))) {
struct page *page;

page = find_get_page(dentry->d_inode->i_mapping, 0);
if (!page)
BUG();
struct page *page = cookie;
kunmap(page);
mark_page_accessed(page);
page_cache_release(page);
page_cache_release(page);
}
}

Expand Down

0 comments on commit cc314ee

Please sign in to comment.