Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux...

[linux-2.6] / fs / proc / base.c

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 8f1f49ceebec531f68395cb32bdf6c6a491c749c..6afff725a8c922b08bb3b6bbd52bf044ecc42e6c 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -297,16 +297,20 @@ static int proc_fd_link(struct inode *inode, struct dentry **dentry, struct vfsm
 
        files = get_files_struct(task);
        if (files) {
-               rcu_read_lock();
+               /*
+                * We are not taking a ref to the file structure, so we must
+                * hold ->file_lock.
+                */
+               spin_lock(&files->file_lock);
                file = fcheck_files(files, fd);
                if (file) {
                        *mnt = mntget(file->f_vfsmnt);
                        *dentry = dget(file->f_dentry);
-                       rcu_read_unlock();
+                       spin_unlock(&files->file_lock);
                        put_files_struct(files);
                        return 0;
                }
-               rcu_read_unlock();
+               spin_unlock(&files->file_lock);
                put_files_struct(files);
        }
        return -ENOENT;
@@ -534,12 +538,15 @@ static int proc_oom_score(struct task_struct *task, char *buffer)
 
 /* If the process being read is separated by chroot from the reading process,
  * don't let the reader access the threads.
+ *
+ * note: this does dput(root) and mntput(vfsmnt) on exit.
  */
 static int proc_check_chroot(struct dentry *root, struct vfsmount *vfsmnt)
 {
        struct dentry *de, *base;
        struct vfsmount *our_vfsmnt, *mnt;
        int res = 0;
+
        read_lock(&current->fs->lock);
        our_vfsmnt = mntget(current->fs->rootmnt);
        base = dget(current->fs->root);
@@ -549,11 +556,11 @@ static int proc_check_chroot(struct dentry *root, struct vfsmount *vfsmnt)
        de = root;
        mnt = vfsmnt;
 
-       while (vfsmnt != our_vfsmnt) {
-               if (vfsmnt == vfsmnt->mnt_parent)
+       while (mnt != our_vfsmnt) {
+               if (mnt == mnt->mnt_parent)
                        goto out;
-               de = vfsmnt->mnt_mountpoint;
-               vfsmnt = vfsmnt->mnt_parent;
+               de = mnt->mnt_mountpoint;
+               mnt = mnt->mnt_parent;
        }
 
        if (!is_subdir(de, base))
@@ -564,7 +571,7 @@ exit:
        dput(base);
        mntput(our_vfsmnt);
        dput(root);
-       mntput(mnt);
+       mntput(vfsmnt);
        return res;
 out:
        spin_unlock(&vfsmount_lock);
@@ -1012,8 +1019,8 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
        if (current != task)
                return -EPERM;
 
-       if (count > PAGE_SIZE)
-               count = PAGE_SIZE;
+       if (count >= PAGE_SIZE)
+               count = PAGE_SIZE - 1;
 
        if (*ppos != 0) {
                /* No partial writes. */
@@ -1026,6 +1033,7 @@ static ssize_t proc_loginuid_write(struct file * file, const char __user * buf,
        if (copy_from_user(page, buf, count))
                goto out_free_page;
 
+       page[count] = '\0';
        loginuid = simple_strtoul(page, &tmp, 10);
        if (tmp == page) {
                length = -EINVAL;
@@ -1520,7 +1528,12 @@ static struct dentry *proc_lookupfd(struct inode * dir, struct dentry * dentry,
        if (!files)
                goto out_unlock;
        inode->i_mode = S_IFLNK;
-       rcu_read_lock();
+
+       /*
+        * We are not taking a ref to the file structure, so we must
+        * hold ->file_lock.
+        */
+       spin_lock(&files->file_lock);
        file = fcheck_files(files, fd);
        if (!file)
                goto out_unlock2;
@@ -1528,7 +1541,7 @@ static struct dentry *proc_lookupfd(struct inode * dir, struct dentry * dentry,
                inode->i_mode |= S_IRUSR | S_IXUSR;
        if (file->f_mode & 2)
                inode->i_mode |= S_IWUSR | S_IXUSR;
-       rcu_read_unlock();
+       spin_unlock(&files->file_lock);
        put_files_struct(files);
        inode->i_op = &proc_pid_link_inode_operations;
        inode->i_size = 64;
@@ -1538,7 +1551,7 @@ static struct dentry *proc_lookupfd(struct inode * dir, struct dentry * dentry,
        return NULL;
 
 out_unlock2:
-       rcu_read_unlock();
+       spin_unlock(&files->file_lock);
        put_files_struct(files);
 out_unlock:
        iput(inode);