Patch "locks: have flock_lock_file take an inode pointer instead of a filp" has been added to the 4.1-stable tree

PATCH [email protected] 1 participant 1 message Oct 23, 2015

Subsystems (3)

Stable branch VFS File locking (flock() and fcntl()/lockf())

lore

Share & tools

lore

[email protected]

author maintainer Applied

2015-10-23 17:42 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

locks: have flock_lock_file take an inode pointer instead of a filp

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
locks-have-flock_lock_file-take-an-inode-pointer-instead-of-a-filp.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From bcd7f78d078ff6197715c1ed070c92aca57ec12c Mon Sep 17 00:00:00 2001

From: Jeff Layton <[email protected]>
Date: Sat, 11 Jul 2015 06:43:02 -0400
Subject: locks: have flock_lock_file take an inode pointer instead of a filp

From: Jeff Layton <[email protected]>

commit bcd7f78d078ff6197715c1ed070c92aca57ec12c upstream.

...and rename it to better describe how it works.

In order to fix a use-after-free in NFS, we need to be able to remove locks from an inode after the filp associated with them may have already been freed. flock_lock_file already only dereferences the filp to get to the inode, so just change it so the callers do that.

All of the callers already pass in a lock request that has the fl_file set properly, so we don't need to pass it in individually. With that change it now only dereferences the filp to get to the inode, so just push that out to the callers.

Signed-off-by Jeff Layton <[email protected]>

Reviewed-by "J. Bruce Fields" <[email protected]>

Tested-by "J. Bruce Fields" <[email protected]>

Cc William Dauchy <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 fs/locks.c |   12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

fs/locks.c +6 -6

@@ -862,12 +862,11 @@ static int posix_locks_deadlock(struct f
  * whether or not a lock was successfully freed by testing the return
  * value for -ENOENT.
  */
-static int flock_lock_file(struct file *filp, struct file_lock *request)
+static int flock_lock_inode(struct inode *inode, struct file_lock *request)
 {
 	struct file_lock *new_fl = NULL;
 	struct file_lock *fl;
 	struct file_lock_context *ctx;
-	struct inode *inode = file_inode(filp);
 	int error = 0;
 	bool found = false;
 	LIST_HEAD(dispose);

@@ -890,7 +889,7 @@ static int flock_lock_file(struct file *
 		goto find_conflict;
 
 	list_for_each_entry(fl, &ctx->flc_flock, fl_list) {
-		if (filp != fl->fl_file)
+		if (request->fl_file != fl->fl_file)
 			continue;
 		if (request->fl_type == fl->fl_type)
 			goto out;

@@ -1862,7 +1861,7 @@ int flock_lock_file_wait(struct file *fi
 	int error;
 	might_sleep();
 	for (;;) {
-		error = flock_lock_file(filp, fl);
+		error = flock_lock_inode(file_inode(filp), fl);
 		if (error != FILE_LOCK_DEFERRED)
 			break;
 		error = wait_event_interruptible(fl->fl_wait, !fl->fl_next);

@@ -2401,7 +2400,8 @@ locks_remove_flock(struct file *filp)
 		.fl_type = F_UNLCK,
 		.fl_end = OFFSET_MAX,
 	};
-	struct file_lock_context *flctx = file_inode(filp)->i_flctx;
+	struct inode *inode = file_inode(filp);
+	struct file_lock_context *flctx = inode->i_flctx;
 
 	if (list_empty(&flctx->flc_flock))
 		return;

@@ -2409,7 +2409,7 @@ locks_remove_flock(struct file *filp)
 	if (filp->f_op->flock)
 		filp->f_op->flock(filp, F_SETLKW, &fl);
 	else
-		flock_lock_file(filp, &fl);
+		flock_lock_inode(inode, &fl);
 
 	if (fl.fl_ops && fl.fl_ops->fl_release_private)
 		fl.fl_ops->fl_release_private(&fl);

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/locks-new-helpers-flock_lock_inode_wait-and-posix_lock_inode_wait.patch queue-4.1/locks-have-flock_lock_file-take-an-inode-pointer-instead-of-a-filp.patch queue-4.1/locks-inline-posix_lock_file_wait-and-flock_lock_file_wait.patch queue-4.1/nfs4-have-do_vfs_lock-take-an-inode-pointer.patch