Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cd874237 authored by Kirill A. Shutemov's avatar Kirill A. Shutemov Committed by David Woodhouse
Browse files

mtd: mtdchar: Do not corrupt backing device of device node inode 



We cannot modify file->f_mapping->backing_dev_info, because it will corrupt
backing device of device node inode, since file->f_mapping is equal to
inode->i_mapping (see __dentry_open() in fs/open.c).

Let's introduce separate inode for MTD device with appropriate backing
device.

[dwmw2: Refactor to keep it all entirely within mtdchar.c; use iget_locked()]

Signed-off-by: default avatarKirill A. Shutemov <kirill@shutemov.name>
Acked-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent 11c93605

drivers/mtd/mtdchar.c

+87 −8
Original line number Diff line number Diff line
@@ -15,12 +15,15 @@ 
#include <linux/smp_lock.h>

#include <linux/backing-dev.h>

#include <linux/compat.h>

#include <linux/mount.h>



#include <linux/mtd/mtd.h>

#include <linux/mtd/compatmac.h>



#include <asm/uaccess.h>



#define MTD_INODE_FS_MAGIC 0x11307854

static struct vfsmount *mtd_inode_mnt __read_mostly;



/*

 * Data structure to hold the pointer to the mtd device as well
@@ -28,6 +31,7 @@ 
 */

struct mtd_file_info {

	struct mtd_info *mtd;

	struct inode *ino;

	enum mtd_file_modes mode;

};
@@ -64,6 +68,7 @@ static int mtd_open(struct inode *inode, struct file *file) 
	int ret = 0;

	struct mtd_info *mtd;

	struct mtd_file_info *mfi;

	struct inode *mtd_ino;



	DEBUG(MTD_DEBUG_LEVEL0, "MTD_open\n");
@@ -85,11 +90,23 @@ static int mtd_open(struct inode *inode, struct file *file) 
		goto out;

	}



	if (mtd->backing_dev_info)

		file->f_mapping->backing_dev_info = mtd->backing_dev_info;

	mtd_ino = iget_locked(mtd_inode_mnt->mnt_sb, devnum);

	if (!mtd_ino) {

		put_mtd_device(mtd);

		ret = -ENOMEM;

		goto out;

	}

	if (mtd_ino->i_state & I_NEW) {

		mtd_ino->i_private = mtd;

		mtd_ino->i_mode = S_IFCHR;

		mtd_ino->i_data.backing_dev_info = mtd->backing_dev_info;

		unlock_new_inode(mtd_ino);

	}

	file->f_mapping = mtd_ino->i_mapping;



	/* You can't open it RW if it's not a writeable device */

	if ((file->f_mode & FMODE_WRITE) && !(mtd->flags & MTD_WRITEABLE)) {

		iput(mtd_ino);

		put_mtd_device(mtd);

		ret = -EACCES;

		goto out;
@@ -97,10 +114,12 @@ static int mtd_open(struct inode *inode, struct file *file) 


	mfi = kzalloc(sizeof(*mfi), GFP_KERNEL);

	if (!mfi) {

		iput(mtd_ino);

		put_mtd_device(mtd);

		ret = -ENOMEM;

		goto out;

	}

	mfi->ino = mtd_ino;

	mfi->mtd = mtd;

	file->private_data = mfi;
@@ -122,6 +141,8 @@ static int mtd_close(struct inode *inode, struct file *file) 
	if ((file->f_mode & FMODE_WRITE) && mtd->sync)

		mtd->sync(mtd);



	iput(mfi->ino);



	put_mtd_device(mtd);

	file->private_data = NULL;

	kfree(mfi);
@@ -951,22 +972,80 @@ static const struct file_operations mtd_fops = { 
#endif

};



static int mtd_inodefs_get_sb(struct file_system_type *fs_type, int flags,

                               const char *dev_name, void *data,

                               struct vfsmount *mnt)

{

        return get_sb_pseudo(fs_type, "mtd_inode:", NULL, MTD_INODE_FS_MAGIC,

                             mnt);

}



static struct file_system_type mtd_inodefs_type = {

       .name = "mtd_inodefs",

       .get_sb = mtd_inodefs_get_sb,

       .kill_sb = kill_anon_super,

};



static void mtdchar_notify_add(struct mtd_info *mtd)

{

}



static void mtdchar_notify_remove(struct mtd_info *mtd)

{

	struct inode *mtd_ino = ilookup(mtd_inode_mnt->mnt_sb, mtd->index);



	if (mtd_ino) {

		/* Destroy the inode if it exists */

		mtd_ino->i_nlink = 0;

		iput(mtd_ino);

	}

}



static struct mtd_notifier mtdchar_notifier = {

	.add = mtdchar_notify_add,

	.remove = mtdchar_notify_remove,

};



static int __init init_mtdchar(void)

{

	int status;

	int ret;



	status = __register_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS,

	ret = __register_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS,

				   "mtd", &mtd_fops);

	if (status < 0) {

		printk(KERN_NOTICE "Can't allocate major number %d for Memory Technology Devices.\n",

		       MTD_CHAR_MAJOR);

	if (ret < 0) {

		pr_notice("Can't allocate major number %d for "

				"Memory Technology Devices.\n", MTD_CHAR_MAJOR);

		return ret;

	}



	return status;

	ret = register_filesystem(&mtd_inodefs_type);

	if (ret) {

		pr_notice("Can't register mtd_inodefs filesystem: %d\n", ret);

		goto err_unregister_chdev;

	}



	mtd_inode_mnt = kern_mount(&mtd_inodefs_type);

	if (IS_ERR(mtd_inode_mnt)) {

		ret = PTR_ERR(mtd_inode_mnt);

		pr_notice("Error mounting mtd_inodefs filesystem: %d\n", ret);

		goto err_unregister_filesystem;

	}

	register_mtd_user(&mtdchar_notifier);



	return ret;



err_unregister_filesystem:

	unregister_filesystem(&mtd_inodefs_type);

err_unregister_chdev:

	__unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd");

	return ret;

}



static void __exit cleanup_mtdchar(void)

{

	unregister_mtd_user(&mtdchar_notifier);

	mntput(mtd_inode_mnt);

	unregister_filesystem(&mtd_inodefs_type);

	__unregister_chrdev(MTD_CHAR_MAJOR, 0, 1 << MINORBITS, "mtd");

}