Loading fs/fuse/file.c +7 −8 Original line number Original line Diff line number Diff line Loading @@ -1740,7 +1740,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, struct fuse_ioctl_out outarg; struct fuse_ioctl_out outarg; struct fuse_req *req = NULL; struct fuse_req *req = NULL; struct page **pages = NULL; struct page **pages = NULL; struct page *iov_page = NULL; struct iovec *iov_page = NULL; struct iovec *in_iov = NULL, *out_iov = NULL; struct iovec *in_iov = NULL, *out_iov = NULL; unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages; unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages; size_t in_size, out_size, transferred; size_t in_size, out_size, transferred; Loading @@ -1751,7 +1751,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, err = -ENOMEM; err = -ENOMEM; pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL); pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL); iov_page = alloc_page(GFP_KERNEL); iov_page = (struct iovec *) __get_free_page(GFP_KERNEL); if (!pages || !iov_page) if (!pages || !iov_page) goto out; goto out; Loading @@ -1760,7 +1760,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, * RETRY from server is not allowed. * RETRY from server is not allowed. */ */ if (!(flags & FUSE_IOCTL_UNRESTRICTED)) { if (!(flags & FUSE_IOCTL_UNRESTRICTED)) { struct iovec *iov = page_address(iov_page); struct iovec *iov = iov_page; iov->iov_base = (void __user *)arg; iov->iov_base = (void __user *)arg; iov->iov_len = _IOC_SIZE(cmd); iov->iov_len = _IOC_SIZE(cmd); Loading Loading @@ -1841,7 +1841,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, /* did it ask for retry? */ /* did it ask for retry? */ if (outarg.flags & FUSE_IOCTL_RETRY) { if (outarg.flags & FUSE_IOCTL_RETRY) { char *vaddr; void *vaddr; /* no retry if in restricted mode */ /* no retry if in restricted mode */ err = -EIO; err = -EIO; Loading @@ -1862,14 +1862,14 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, goto out; goto out; vaddr = kmap_atomic(pages[0], KM_USER0); vaddr = kmap_atomic(pages[0], KM_USER0); err = fuse_copy_ioctl_iovec(page_address(iov_page), vaddr, err = fuse_copy_ioctl_iovec(iov_page, vaddr, transferred, in_iovs + out_iovs, transferred, in_iovs + out_iovs, (flags & FUSE_IOCTL_COMPAT) != 0); (flags & FUSE_IOCTL_COMPAT) != 0); kunmap_atomic(vaddr, KM_USER0); kunmap_atomic(vaddr, KM_USER0); if (err) if (err) goto out; goto out; in_iov = page_address(iov_page); in_iov = iov_page; out_iov = in_iov + in_iovs; out_iov = in_iov + in_iovs; err = fuse_verify_ioctl_iov(in_iov, in_iovs); err = fuse_verify_ioctl_iov(in_iov, in_iovs); Loading @@ -1891,8 +1891,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, out: out: if (req) if (req) fuse_put_request(fc, req); fuse_put_request(fc, req); if (iov_page) free_page((unsigned long) iov_page); __free_page(iov_page); while (num_pages) while (num_pages) __free_page(pages[--num_pages]); __free_page(pages[--num_pages]); kfree(pages); kfree(pages); Loading Loading
fs/fuse/file.c +7 −8 Original line number Original line Diff line number Diff line Loading @@ -1740,7 +1740,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, struct fuse_ioctl_out outarg; struct fuse_ioctl_out outarg; struct fuse_req *req = NULL; struct fuse_req *req = NULL; struct page **pages = NULL; struct page **pages = NULL; struct page *iov_page = NULL; struct iovec *iov_page = NULL; struct iovec *in_iov = NULL, *out_iov = NULL; struct iovec *in_iov = NULL, *out_iov = NULL; unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages; unsigned int in_iovs = 0, out_iovs = 0, num_pages = 0, max_pages; size_t in_size, out_size, transferred; size_t in_size, out_size, transferred; Loading @@ -1751,7 +1751,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, err = -ENOMEM; err = -ENOMEM; pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL); pages = kzalloc(sizeof(pages[0]) * FUSE_MAX_PAGES_PER_REQ, GFP_KERNEL); iov_page = alloc_page(GFP_KERNEL); iov_page = (struct iovec *) __get_free_page(GFP_KERNEL); if (!pages || !iov_page) if (!pages || !iov_page) goto out; goto out; Loading @@ -1760,7 +1760,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, * RETRY from server is not allowed. * RETRY from server is not allowed. */ */ if (!(flags & FUSE_IOCTL_UNRESTRICTED)) { if (!(flags & FUSE_IOCTL_UNRESTRICTED)) { struct iovec *iov = page_address(iov_page); struct iovec *iov = iov_page; iov->iov_base = (void __user *)arg; iov->iov_base = (void __user *)arg; iov->iov_len = _IOC_SIZE(cmd); iov->iov_len = _IOC_SIZE(cmd); Loading Loading @@ -1841,7 +1841,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, /* did it ask for retry? */ /* did it ask for retry? */ if (outarg.flags & FUSE_IOCTL_RETRY) { if (outarg.flags & FUSE_IOCTL_RETRY) { char *vaddr; void *vaddr; /* no retry if in restricted mode */ /* no retry if in restricted mode */ err = -EIO; err = -EIO; Loading @@ -1862,14 +1862,14 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, goto out; goto out; vaddr = kmap_atomic(pages[0], KM_USER0); vaddr = kmap_atomic(pages[0], KM_USER0); err = fuse_copy_ioctl_iovec(page_address(iov_page), vaddr, err = fuse_copy_ioctl_iovec(iov_page, vaddr, transferred, in_iovs + out_iovs, transferred, in_iovs + out_iovs, (flags & FUSE_IOCTL_COMPAT) != 0); (flags & FUSE_IOCTL_COMPAT) != 0); kunmap_atomic(vaddr, KM_USER0); kunmap_atomic(vaddr, KM_USER0); if (err) if (err) goto out; goto out; in_iov = page_address(iov_page); in_iov = iov_page; out_iov = in_iov + in_iovs; out_iov = in_iov + in_iovs; err = fuse_verify_ioctl_iov(in_iov, in_iovs); err = fuse_verify_ioctl_iov(in_iov, in_iovs); Loading @@ -1891,8 +1891,7 @@ long fuse_do_ioctl(struct file *file, unsigned int cmd, unsigned long arg, out: out: if (req) if (req) fuse_put_request(fc, req); fuse_put_request(fc, req); if (iov_page) free_page((unsigned long) iov_page); __free_page(iov_page); while (num_pages) while (num_pages) __free_page(pages[--num_pages]); __free_page(pages[--num_pages]); kfree(pages); kfree(pages); Loading