[PATCH] f_count may wrap around (516e0cc5) · Commits · e / devices / android_kernel_teracube_2e

drivers/net/ppp_generic.c

+3 −3

Original line number	Original line	Diff line number	Diff line
	@@ -581,12 +581,12 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
	if (file == ppp->owner)		if (file == ppp->owner)
	ppp_shutdown_interface(ppp);		ppp_shutdown_interface(ppp);
	}		}
	if (atomic_read(&file->f_count) <= 2) {		if (atomic_long_read(&file->f_count) <= 2) {
	ppp_release(NULL, file);		ppp_release(NULL, file);
	err = 0;		err = 0;
	} else		} else
	printk(KERN_DEBUG "PPPIOCDETACH file->f_count=%d\n",		printk(KERN_DEBUG "PPPIOCDETACH file->f_count=%ld\n",
	atomic_read(&file->f_count));		atomic_long_read(&file->f_count));
	unlock_kernel();		unlock_kernel();
	return err;		return err;
	}		}

fs/affs/file.c

+0 −4

Original line number	Original line	Diff line number	Diff line
	@@ -46,8 +46,6 @@ const struct inode_operations affs_file_inode_operations = {
	static int		static int
	affs_file_open(struct inode inode, struct file filp)		affs_file_open(struct inode inode, struct file filp)
	{		{
	if (atomic_read(&filp->f_count) != 1)
	return 0;
	pr_debug("AFFS: open(%lu,%d)\n",		pr_debug("AFFS: open(%lu,%d)\n",
	inode->i_ino, atomic_read(&AFFS_I(inode)->i_opencnt));		inode->i_ino, atomic_read(&AFFS_I(inode)->i_opencnt));
	atomic_inc(&AFFS_I(inode)->i_opencnt);		atomic_inc(&AFFS_I(inode)->i_opencnt);
	@@ -57,8 +55,6 @@ affs_file_open(struct inode inode, struct file filp)
	static int		static int
	affs_file_release(struct inode inode, struct file filp)		affs_file_release(struct inode inode, struct file filp)
	{		{
	if (atomic_read(&filp->f_count) != 0)
	return 0;
	pr_debug("AFFS: release(%lu, %d)\n",		pr_debug("AFFS: release(%lu, %d)\n",
	inode->i_ino, atomic_read(&AFFS_I(inode)->i_opencnt));		inode->i_ino, atomic_read(&AFFS_I(inode)->i_opencnt));

fs/aio.c

+3 −3

Original line number	Original line	Diff line number	Diff line
	@@ -512,8 +512,8 @@ static void aio_fput_routine(struct work_struct *data)
	*/		*/
	static int __aio_put_req(struct kioctx ctx, struct kiocb req)		static int __aio_put_req(struct kioctx ctx, struct kiocb req)
	{		{
	dprintk(KERN_DEBUG "aio_put(%p): f_count=%d\n",		dprintk(KERN_DEBUG "aio_put(%p): f_count=%ld\n",
	req, atomic_read(&req->ki_filp->f_count));		req, atomic_long_read(&req->ki_filp->f_count));

	assert_spin_locked(&ctx->ctx_lock);		assert_spin_locked(&ctx->ctx_lock);

	@@ -528,7 +528,7 @@ static int __aio_put_req(struct kioctx ctx, struct kiocb req)
	/* Must be done under the lock to serialise against cancellation.		/* Must be done under the lock to serialise against cancellation.
	* Call this aio_fput as it duplicates fput via the fput_work.		* Call this aio_fput as it duplicates fput via the fput_work.
	*/		*/
	if (unlikely(atomic_dec_and_test(&req->ki_filp->f_count))) {		if (unlikely(atomic_long_dec_and_test(&req->ki_filp->f_count))) {
	get_ioctx(ctx);		get_ioctx(ctx);
	spin_lock(&fput_lock);		spin_lock(&fput_lock);
	list_add(&req->ki_list, &fput_head);		list_add(&req->ki_list, &fput_head);

fs/file_table.c

+5 −5

Original line number	Original line	Diff line number	Diff line
	@@ -120,7 +120,7 @@ struct file *get_empty_filp(void)

	tsk = current;		tsk = current;
	INIT_LIST_HEAD(&f->f_u.fu_list);		INIT_LIST_HEAD(&f->f_u.fu_list);
	atomic_set(&f->f_count, 1);		atomic_long_set(&f->f_count, 1);
	rwlock_init(&f->f_owner.lock);		rwlock_init(&f->f_owner.lock);
	f->f_uid = tsk->fsuid;		f->f_uid = tsk->fsuid;
	f->f_gid = tsk->fsgid;		f->f_gid = tsk->fsgid;
	@@ -219,7 +219,7 @@ EXPORT_SYMBOL(init_file);

	void fput(struct file *file)		void fput(struct file *file)
	{		{
	if (atomic_dec_and_test(&file->f_count))		if (atomic_long_dec_and_test(&file->f_count))
	__fput(file);		__fput(file);
	}		}

	@@ -294,7 +294,7 @@ struct file *fget(unsigned int fd)
	rcu_read_lock();		rcu_read_lock();
	file = fcheck_files(files, fd);		file = fcheck_files(files, fd);
	if (file) {		if (file) {
	if (!atomic_inc_not_zero(&file->f_count)) {		if (!atomic_long_inc_not_zero(&file->f_count)) {
	/* File object ref couldn't be taken */		/* File object ref couldn't be taken */
	rcu_read_unlock();		rcu_read_unlock();
	return NULL;		return NULL;
	@@ -326,7 +326,7 @@ struct file fget_light(unsigned int fd, int fput_needed)
	rcu_read_lock();		rcu_read_lock();
	file = fcheck_files(files, fd);		file = fcheck_files(files, fd);
	if (file) {		if (file) {
	if (atomic_inc_not_zero(&file->f_count))		if (atomic_long_inc_not_zero(&file->f_count))
	*fput_needed = 1;		*fput_needed = 1;
	else		else
	/* Didn't get the reference, someone's freed */		/* Didn't get the reference, someone's freed */
	@@ -341,7 +341,7 @@ struct file fget_light(unsigned int fd, int fput_needed)

	void put_filp(struct file *file)		void put_filp(struct file *file)
	{		{
	if (atomic_dec_and_test(&file->f_count)) {		if (atomic_long_dec_and_test(&file->f_count)) {
	security_file_free(file);		security_file_free(file);
	file_kill(file);		file_kill(file);
	file_free(file);		file_free(file);

fs/hfs/inode.c

+0 −4

Original line number	Original line	Diff line number	Diff line
	@@ -522,8 +522,6 @@ static int hfs_file_open(struct inode inode, struct file file)
	{		{
	if (HFS_IS_RSRC(inode))		if (HFS_IS_RSRC(inode))
	inode = HFS_I(inode)->rsrc_inode;		inode = HFS_I(inode)->rsrc_inode;
	if (atomic_read(&file->f_count) != 1)
	return 0;
	atomic_inc(&HFS_I(inode)->opencnt);		atomic_inc(&HFS_I(inode)->opencnt);
	return 0;		return 0;
	}		}
	@@ -534,8 +532,6 @@ static int hfs_file_release(struct inode inode, struct file file)

	if (HFS_IS_RSRC(inode))		if (HFS_IS_RSRC(inode))
	inode = HFS_I(inode)->rsrc_inode;		inode = HFS_I(inode)->rsrc_inode;
	if (atomic_read(&file->f_count) != 0)
	return 0;
	if (atomic_dec_and_test(&HFS_I(inode)->opencnt)) {		if (atomic_dec_and_test(&HFS_I(inode)->opencnt)) {
	mutex_lock(&inode->i_mutex);		mutex_lock(&inode->i_mutex);
	hfs_file_truncate(inode);		hfs_file_truncate(inode);