niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

cifs: fix the race in cifs_writev()

Browse source 
O_APPEND handling there hadn't been completely fixed by Pavel's
patch; it checks the right value, but it's racy - we can't really
do that until i_mutex has been taken.

Fix by switching to __generic_file_aio_write() (open-coding
generic_file_aio_write(), actually) and pulling mutex_lock() above
inode_size_read().

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Al Viro 2014-04-03 10:27:17 -04:00
parent eab87235c0
commit 19dfc1f5f2
1 changed files with 18 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
fs/cifs/file.c
View file

@ -2579,19 +2579,32 @@ cifs_writev(struct kiocb *iocb, const struct iovec *iov,
struct cifsInodeInfo *cinode = CIFS_I(inode); struct cifsInodeInfo *cinode = CIFS_I(inode);
struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server; struct TCP_Server_Info *server = tlink_tcon(cfile->tlink)->ses->server;
ssize_t rc = -EACCES; ssize_t rc = -EACCES;
loff_t lock_pos = pos; loff_t lock_pos = iocb->ki_pos;
if (file->f_flags & O_APPEND)
lock_pos = i_size_read(inode);
/* /*
* We need to hold the sem to be sure nobody modifies lock list * We need to hold the sem to be sure nobody modifies lock list
* with a brlock that prevents writing. * with a brlock that prevents writing.
*/ */
down_read(&cinode->lock_sem); down_read(&cinode->lock_sem);
mutex_lock(&inode->i_mutex);
if (file->f_flags & O_APPEND)
lock_pos = i_size_read(inode);
if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs), if (!cifs_find_lock_conflict(cfile, lock_pos, iov_length(iov, nr_segs),
server->vals->exclusive_lock_type, NULL, server->vals->exclusive_lock_type, NULL,
CIFS_WRITE_OP)) CIFS_WRITE_OP)) {
rc = generic_file_aio_write(iocb, iov, nr_segs, pos); rc = __generic_file_aio_write(iocb, iov, nr_segs);
mutex_unlock(&inode->i_mutex);
if (rc > 0) {
ssize_t err;
err = generic_write_sync(file, iocb->ki_pos - rc, rc);
if (rc < 0)
rc = err;
}
} else {
mutex_unlock(&inode->i_mutex);
}
up_read(&cinode->lock_sem); up_read(&cinode->lock_sem);
return rc; return rc;
} }