diff options
| -rw-r--r-- | fs/notify/inotify/inotify_user.c | 194 |
1 files changed, 139 insertions, 55 deletions
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c index e46ca685b9be..653c507b1bb3 100644 --- a/fs/notify/inotify/inotify_user.c +++ b/fs/notify/inotify/inotify_user.c @@ -357,6 +357,77 @@ static int inotify_find_inode(const char __user *dirname, struct path *path, uns return error; } +static int inotify_add_to_idr(struct idr *idr, spinlock_t *idr_lock, + int last_wd, + struct inotify_inode_mark_entry *ientry) +{ + int ret; + + do { + if (unlikely(!idr_pre_get(idr, GFP_KERNEL))) + return -ENOMEM; + + spin_lock(idr_lock); + ret = idr_get_new_above(idr, ientry, last_wd + 1, + &ientry->wd); + /* we added the mark to the idr, take a reference */ + if (!ret) + fsnotify_get_mark(&ientry->fsn_entry); + spin_unlock(idr_lock); + } while (ret == -EAGAIN); + + return ret; +} + +static struct inotify_inode_mark_entry *inotify_idr_find_locked(struct fsnotify_group *group, + int wd) +{ + struct idr *idr = &group->inotify_data.idr; + spinlock_t *idr_lock = &group->inotify_data.idr_lock; + struct inotify_inode_mark_entry *ientry; + + assert_spin_locked(idr_lock); + + ientry = idr_find(idr, wd); + if (ientry) { + struct fsnotify_mark_entry *fsn_entry = &ientry->fsn_entry; + + fsnotify_get_mark(fsn_entry); + /* One ref for being in the idr, one ref we just took */ + BUG_ON(atomic_read(&fsn_entry->refcnt) < 2); + } + + return ientry; +} + +static struct inotify_inode_mark_entry *inotify_idr_find(struct fsnotify_group *group, + int wd) +{ + struct inotify_inode_mark_entry *ientry; + spinlock_t *idr_lock = &group->inotify_data.idr_lock; + + spin_lock(idr_lock); + ientry = inotify_idr_find_locked(group, wd); + spin_unlock(idr_lock); + + return ientry; +} + +static void do_inotify_remove_from_idr(struct fsnotify_group *group, + struct inotify_inode_mark_entry *ientry) +{ + struct idr *idr = &group->inotify_data.idr; + spinlock_t *idr_lock = &group->inotify_data.idr_lock; + int wd = ientry->wd; + + assert_spin_locked(idr_lock); + + idr_remove(idr, wd); + + /* removed from the idr, drop that ref */ + fsnotify_put_mark(&ientry->fsn_entry); +} + /* * Remove the mark from the idr (if present) and drop the reference * on the mark because it was in the idr. @@ -364,42 +435,72 @@ static int inotify_find_inode(const char __user *dirname, struct path *path, uns static void inotify_remove_from_idr(struct fsnotify_group *group, struct inotify_inode_mark_entry *ientry) { - struct idr *idr; - struct fsnotify_mark_entry *entry; - struct inotify_inode_mark_entry *found_ientry; + spinlock_t *idr_lock = &group->inotify_data.idr_lock; + struct inotify_inode_mark_entry *found_ientry = NULL; int wd; - spin_lock(&group->inotify_data.idr_lock); - idr = &group->inotify_data.idr; + spin_lock(idr_lock); wd = ientry->wd; - if (wd == -1) + /* + * does this ientry think it is in the idr? we shouldn't get called + * if it wasn't.... + */ + if (wd == -1) { + printk(KERN_WARNING "%s: ientry=%p ientry->wd=%d ientry->group=%p" + " ientry->inode=%p\n", __func__, ientry, ientry->wd, + ientry->fsn_entry.group, ientry->fsn_entry.inode); + WARN_ON(1); goto out; + } - entry = idr_find(&group->inotify_data.idr, wd); - if (unlikely(!entry)) + /* Lets look in the idr to see if we find it */ + found_ientry = inotify_idr_find_locked(group, wd); + if (unlikely(!found_ientry)) { + printk(KERN_WARNING "%s: ientry=%p ientry->wd=%d ientry->group=%p" + " ientry->inode=%p\n", __func__, ientry, ientry->wd, + ientry->fsn_entry.group, ientry->fsn_entry.inode); + WARN_ON(1); goto out; + } - found_ientry = container_of(entry, struct inotify_inode_mark_entry, fsn_entry); + /* + * We found an entry in the idr at the right wd, but it's + * not the entry we were told to remove. eparis seriously + * fucked up somewhere. + */ if (unlikely(found_ientry != ientry)) { - /* We found an entry in the idr with the right wd, but it's - * not the entry we were told to remove. eparis seriously - * fucked up somewhere. */ WARN_ON(1); - ientry->wd = -1; + printk(KERN_WARNING "%s: ientry=%p ientry->wd=%d ientry->group=%p " + "entry->inode=%p found_ientry=%p found_ientry->wd=%d " + "found_ientry->group=%p found_ientry->inode=%p\n", + __func__, ientry, ientry->wd, ientry->fsn_entry.group, + ientry->fsn_entry.inode, found_ientry, found_ientry->wd, + found_ientry->fsn_entry.group, + found_ientry->fsn_entry.inode); goto out; } - /* One ref for being in the idr, one ref held by the caller */ - BUG_ON(atomic_read(&entry->refcnt) < 2); - - idr_remove(idr, wd); - ientry->wd = -1; + /* + * One ref for being in the idr + * one ref held by the caller trying to kill us + * one ref grabbed by inotify_idr_find + */ + if (unlikely(atomic_read(&ientry->fsn_entry.refcnt) < 3)) { + printk(KERN_WARNING "%s: ientry=%p ientry->wd=%d ientry->group=%p" + " ientry->inode=%p\n", __func__, ientry, ientry->wd, + ientry->fsn_entry.group, ientry->fsn_entry.inode); + /* we can't really recover with bad ref cnting.. */ + BUG(); + } - /* removed from the idr, drop that ref */ - fsnotify_put_mark(entry); + do_inotify_remove_from_idr(group, ientry); out: - spin_unlock(&group->inotify_data.idr_lock); + /* match the ref taken by inotify_idr_find_locked() */ + if (found_ientry) + fsnotify_put_mark(&found_ientry->fsn_entry); + ientry->wd = -1; + spin_unlock(idr_lock); } /* @@ -524,6 +625,8 @@ static int inotify_new_watch(struct fsnotify_group *group, struct inotify_inode_mark_entry *tmp_ientry; __u32 mask; int ret; + struct idr *idr = &group->inotify_data.idr; + spinlock_t *idr_lock = &group->inotify_data.idr_lock; /* don't allow invalid bits: we don't want flags set */ mask = inotify_arg_to_mask(arg); @@ -541,28 +644,11 @@ static int inotify_new_watch(struct fsnotify_group *group, ret = -ENOSPC; if (atomic_read(&group->inotify_data.user->inotify_watches) >= inotify_max_user_watches) goto out_err; -retry: - ret = -ENOMEM; - if (unlikely(!idr_pre_get(&group->inotify_data.idr, GFP_KERNEL))) - goto out_err; - - /* we are putting the mark on the idr, take a reference */ - fsnotify_get_mark(&tmp_ientry->fsn_entry); - - spin_lock(&group->inotify_data.idr_lock); - ret = idr_get_new_above(&group->inotify_data.idr, &tmp_ientry->fsn_entry, - group->inotify_data.last_wd+1, - &tmp_ientry->wd); - spin_unlock(&group->inotify_data.idr_lock); - if (ret) { - /* we didn't get on the idr, drop the idr reference */ - fsnotify_put_mark(&tmp_ientry->fsn_entry); - /* idr was out of memory allocate and try again */ - if (ret == -EAGAIN) - goto retry; + ret = inotify_add_to_idr(idr, idr_lock, group->inotify_data.last_wd, + tmp_ientry); + if (ret) goto out_err; - } /* we are on the idr, now get on the inode */ ret = fsnotify_add_mark(&tmp_ientry->fsn_entry, group, inode); @@ -726,7 +812,7 @@ fput_and_out: SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd) { struct fsnotify_group *group; - struct fsnotify_mark_entry *entry; + struct inotify_inode_mark_entry *ientry; struct file *filp; int ret = 0, fput_needed; @@ -735,25 +821,23 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd) return -EBADF; /* verify that this is indeed an inotify instance */ - if (unlikely(filp->f_op != &inotify_fops)) { - ret = -EINVAL; + ret = -EINVAL; + if (unlikely(filp->f_op != &inotify_fops)) goto out; - } group = filp->private_data; - spin_lock(&group->inotify_data.idr_lock); - entry = idr_find(&group->inotify_data.idr, wd); - if (unlikely(!entry)) { - spin_unlock(&group->inotify_data.idr_lock); - ret = -EINVAL; + ret = -EINVAL; + ientry = inotify_idr_find(group, wd); + if (unlikely(!ientry)) goto out; - } - fsnotify_get_mark(entry); - spin_unlock(&group->inotify_data.idr_lock); - fsnotify_destroy_mark_by_entry(entry); - fsnotify_put_mark(entry); + ret = 0; + + fsnotify_destroy_mark_by_entry(&ientry->fsn_entry); + + /* match ref taken by inotify_idr_find */ + fsnotify_put_mark(&ientry->fsn_entry); out: fput_light(filp, fput_needed); |