fuse_file_alloc(): fix NULL dereferences

[linux-2.6] / fs / fuse / file.c

diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 471ea70be48daadca5619dc7957d8cc319f1e507..535b37399009128df2413d3b7632160390113b9c 100644 (file)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -55,8 +55,10 @@ struct fuse_file *fuse_file_alloc(void)
                if (!ff->reserved_req) {
                        kfree(ff);
                        ff = NULL;
+               } else {
+                       INIT_LIST_HEAD(&ff->write_entry);
+                       atomic_set(&ff->count, 0);
                }
-               atomic_set(&ff->count, 0);
        }
        return ff;
 }
@@ -150,12 +152,18 @@ int fuse_release_common(struct inode *inode, struct file *file, int isdir)
 {
        struct fuse_file *ff = file->private_data;
        if (ff) {
+               struct fuse_conn *fc = get_fuse_conn(inode);
+
                fuse_release_fill(ff, get_node_id(inode), file->f_flags,
                                  isdir ? FUSE_RELEASEDIR : FUSE_RELEASE);
 
                /* Hold vfsmount and dentry until release is finished */
                ff->reserved_req->vfsmount = mntget(file->f_path.mnt);
                ff->reserved_req->dentry = dget(file->f_path.dentry);
+
+               spin_lock(&fc->lock);
+               list_del(&ff->write_entry);
+               spin_unlock(&fc->lock);
                /*
                 * Normally this will send the RELEASE request,
                 * however if some asynchronous READ or WRITE requests
@@ -182,7 +190,7 @@ static int fuse_release(struct inode *inode, struct file *file)
  * Scramble the ID space with XTEA, so that the value of the files_struct
  * pointer is not exposed to userspace.
  */
-static u64 fuse_lock_owner_id(struct fuse_conn *fc, fl_owner_t id)
+u64 fuse_lock_owner_id(struct fuse_conn *fc, fl_owner_t id)
 {
        u32 *k = fc->scramble_key;
        u64 v = (unsigned long) id;
@@ -301,11 +309,19 @@ void fuse_read_fill(struct fuse_req *req, struct fuse_file *ff,
 }
 
 static size_t fuse_send_read(struct fuse_req *req, struct file *file,
-                            struct inode *inode, loff_t pos, size_t count)
+                            struct inode *inode, loff_t pos, size_t count,
+                            fl_owner_t owner)
 {
        struct fuse_conn *fc = get_fuse_conn(inode);
        struct fuse_file *ff = file->private_data;
+
        fuse_read_fill(req, ff, inode, pos, count, FUSE_READ);
+       if (owner != NULL) {
+               struct fuse_read_in *inarg = &req->misc.read_in;
+
+               inarg->read_flags |= FUSE_READ_LOCKOWNER;
+               inarg->lock_owner = fuse_lock_owner_id(fc, owner);
+       }
        request_send(fc, req);
        return req->out.args[0].size;
 }
@@ -329,7 +345,8 @@ static int fuse_readpage(struct file *file, struct page *page)
        req->out.page_zeroing = 1;
        req->num_pages = 1;
        req->pages[0] = page;
-       fuse_send_read(req, file, inode, page_offset(page), PAGE_CACHE_SIZE);
+       fuse_send_read(req, file, inode, page_offset(page), PAGE_CACHE_SIZE,
+                      NULL);
        err = req->out.h.error;
        fuse_put_request(fc, req);
        if (!err)
@@ -436,30 +453,47 @@ out:
        return err;
 }
 
-static size_t fuse_send_write(struct fuse_req *req, struct file *file,
-                             struct inode *inode, loff_t pos, size_t count)
+static void fuse_write_fill(struct fuse_req *req, struct fuse_file *ff,
+                           struct inode *inode, loff_t pos, size_t count,
+                           int writepage)
 {
        struct fuse_conn *fc = get_fuse_conn(inode);
-       struct fuse_file *ff = file->private_data;
-       struct fuse_write_in inarg;
-       struct fuse_write_out outarg;
+       struct fuse_write_in *inarg = &req->misc.write.in;
+       struct fuse_write_out *outarg = &req->misc.write.out;
 
-       memset(&inarg, 0, sizeof(struct fuse_write_in));
-       inarg.fh = ff->fh;
-       inarg.offset = pos;
-       inarg.size = count;
+       memset(inarg, 0, sizeof(struct fuse_write_in));
+       inarg->fh = ff->fh;
+       inarg->offset = pos;
+       inarg->size = count;
+       inarg->write_flags = writepage ? FUSE_WRITE_CACHE : 0;
        req->in.h.opcode = FUSE_WRITE;
        req->in.h.nodeid = get_node_id(inode);
        req->in.argpages = 1;
        req->in.numargs = 2;
-       req->in.args[0].size = sizeof(struct fuse_write_in);
-       req->in.args[0].value = &inarg;
+       if (fc->minor < 9)
+               req->in.args[0].size = FUSE_COMPAT_WRITE_IN_SIZE;
+       else
+               req->in.args[0].size = sizeof(struct fuse_write_in);
+       req->in.args[0].value = inarg;
        req->in.args[1].size = count;
        req->out.numargs = 1;
        req->out.args[0].size = sizeof(struct fuse_write_out);
-       req->out.args[0].value = &outarg;
+       req->out.args[0].value = outarg;
+}
+
+static size_t fuse_send_write(struct fuse_req *req, struct file *file,
+                             struct inode *inode, loff_t pos, size_t count,
+                             fl_owner_t owner)
+{
+       struct fuse_conn *fc = get_fuse_conn(inode);
+       fuse_write_fill(req, file->private_data, inode, pos, count, 0);
+       if (owner != NULL) {
+               struct fuse_write_in *inarg = &req->misc.write.in;
+               inarg->write_flags |= FUSE_WRITE_LOCKOWNER;
+               inarg->lock_owner = fuse_lock_owner_id(fc, owner);
+       }
        request_send(fc, req);
-       return outarg.size;
+       return req->misc.write.out.size;
 }
 
 static int fuse_write_begin(struct file *file, struct address_space *mapping,
@@ -494,7 +528,7 @@ static int fuse_buffered_write(struct file *file, struct inode *inode,
        req->num_pages = 1;
        req->pages[0] = page;
        req->page_offset = offset;
-       nres = fuse_send_write(req, file, inode, pos, count);
+       nres = fuse_send_write(req, file, inode, pos, count, NULL);
        err = req->out.h.error;
        fuse_put_request(fc, req);
        if (!err && !nres)
@@ -595,9 +629,11 @@ static ssize_t fuse_direct_io(struct file *file, const char __user *buf,
                nbytes = (req->num_pages << PAGE_SHIFT) - req->page_offset;
                nbytes = min(count, nbytes);
                if (write)
-                       nres = fuse_send_write(req, file, inode, pos, nbytes);
+                       nres = fuse_send_write(req, file, inode, pos, nbytes,
+                                              current->files);
                else
-                       nres = fuse_send_read(req, file, inode, pos, nbytes);
+                       nres = fuse_send_read(req, file, inode, pos, nbytes,
+                                             current->files);
                fuse_release_user_pages(req, !write);
                if (req->out.h.error) {
                        if (!res)