Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2bdf67eb authored by OGAWA Hirofumi's avatar OGAWA Hirofumi Committed by Linus Torvalds
Browse files

fat: mmu_private race fix 



mmu_private is 64bits value, hence it's not atomic to update.

So, the access rule for mmu_private is we must hold ->i_mutex.  But,
fat_get_block() path doesn't follow the rule on non-allocation path.

This fixes by using i_size instead if non-allocation path.

Signed-off-by: default avatarOGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 0e75f5da

fs/fat/cache.c

+18 −5
Original line number Diff line number Diff line
@@ -293,10 +293,12 @@ static int fat_bmap_cluster(struct inode *inode, int cluster) 
}



int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,

	     unsigned long *mapped_blocks)

	     unsigned long *mapped_blocks, int create)

{

	struct super_block *sb = inode->i_sb;

	struct msdos_sb_info *sbi = MSDOS_SB(sb);

	const unsigned long blocksize = sb->s_blocksize;

	const unsigned char blocksize_bits = sb->s_blocksize_bits;

	sector_t last_block;

	int cluster, offset;
@@ -309,10 +311,21 @@ int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys, 
		}

		return 0;

	}

	last_block = (MSDOS_I(inode)->mmu_private + (sb->s_blocksize - 1))

		>> sb->s_blocksize_bits;



	last_block = (i_size_read(inode) + (blocksize - 1)) >> blocksize_bits;

	if (sector >= last_block) {

		if (!create)

			return 0;



		/*

		 * ->mmu_private can access on only allocation path.

		 * (caller must hold ->i_mutex)

		 */

		last_block = (MSDOS_I(inode)->mmu_private + (blocksize - 1))

			>> blocksize_bits;

		if (sector >= last_block)

			return 0;

	}



	cluster = sector >> (sbi->cluster_bits - sb->s_blocksize_bits);

	offset  = sector & (sbi->sec_per_clus - 1);

fs/fat/dir.c

+1 −1
Original line number Diff line number Diff line
@@ -77,7 +77,7 @@ static int fat__get_entry(struct inode *dir, loff_t *pos, 


	*bh = NULL;

	iblock = *pos >> sb->s_blocksize_bits;

	err = fat_bmap(dir, iblock, &phys, &mapped_blocks);

	err = fat_bmap(dir, iblock, &phys, &mapped_blocks, 0);

	if (err || !phys)

		return -1;	/* beyond EOF or error */

fs/fat/fat.h

+4 −2
Original line number Diff line number Diff line
@@ -91,7 +91,9 @@ struct msdos_inode_info { 
	/* for avoiding the race between fat_free() and fat_get_cluster() */

	unsigned int cache_valid_id;



	loff_t mmu_private;

	/* NOTE: mmu_private is 64bits, so must hold ->i_mutex to access */

	loff_t mmu_private;	/* physically allocated size */



	int i_start;		/* first cluster or 0 */

	int i_logstart;		/* logical first cluster */

	int i_attrs;		/* unused attribute bits */
@@ -222,7 +224,7 @@ extern void fat_cache_inval_inode(struct inode *inode); 
extern int fat_get_cluster(struct inode *inode, int cluster,

			   int *fclus, int *dclus);

extern int fat_bmap(struct inode *inode, sector_t sector, sector_t *phys,

		    unsigned long *mapped_blocks);

		    unsigned long *mapped_blocks, int create);



/* fat/dir.c */

extern const struct file_operations fat_dir_operations;

fs/fat/inode.c

+2 −2
Original line number Diff line number Diff line
@@ -64,7 +64,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock, 
	sector_t phys;

	int err, offset;



	err = fat_bmap(inode, iblock, &phys, &mapped_blocks);

	err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create);

	if (err)

		return err;

	if (phys) {
@@ -94,7 +94,7 @@ static inline int __fat_get_block(struct inode *inode, sector_t iblock, 
	*max_blocks = min(mapped_blocks, *max_blocks);

	MSDOS_I(inode)->mmu_private += *max_blocks << sb->s_blocksize_bits;



	err = fat_bmap(inode, iblock, &phys, &mapped_blocks);

	err = fat_bmap(inode, iblock, &phys, &mapped_blocks, create);

	if (err)

		return err;