Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1761713AbXKAXMc (ORCPT ); Thu, 1 Nov 2007 19:12:32 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1758701AbXKAXIt (ORCPT ); Thu, 1 Nov 2007 19:08:49 -0400 Received: from e1.ny.us.ibm.com ([32.97.182.141]:33963 "EHLO e1.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756994AbXKAXIr (ORCPT ); Thu, 1 Nov 2007 19:08:47 -0400 Subject: [PATCH 13/27] r-o-bind-mounts-elevate-write-count-for-do_utimes To: akpm@osdl.org Cc: linux-kernel@vger.kernel.org, miklos@szeredi.hu, hch@infradead.org, Dave Hansen From: Dave Hansen Date: Thu, 01 Nov 2007 16:08:43 -0700 References: <20071101230826.9A4F6E00@kernel> In-Reply-To: <20071101230826.9A4F6E00@kernel> Message-Id: <20071101230843.AB6A629C@kernel> Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3067 Lines: 104 Now includes fix for oops seen by akpm. "never let a libc developer write your kernel code" - hch "nor, apparently, a kernel developer" - akpm Acked-by: Christoph Hellwig Signed-off-by: Dave Hansen Signed-off-by: Andrew Morton Cc: Christoph Hellwig Cc: Valdis Kletnieks Cc: Balbir Singh Signed-off-by: Andrew Morton --- linux-2.6.git-dave/fs/utimes.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff -puN fs/utimes.c~r-o-bind-mounts-elevate-write-count-for-do_utimes fs/utimes.c --- linux-2.6.git/fs/utimes.c~r-o-bind-mounts-elevate-write-count-for-do_utimes 2007-11-01 14:46:13.000000000 -0700 +++ linux-2.6.git-dave/fs/utimes.c 2007-11-01 14:46:13.000000000 -0700 @@ -2,6 +2,7 @@ #include #include #include +#include #include #include #include @@ -58,6 +59,7 @@ long do_utimes(int dfd, char __user *fil struct inode *inode; struct iattr newattrs; struct file *f = NULL; + struct vfsmount *mnt; error = -EINVAL; if (times && (!nsec_valid(times[0].tv_nsec) || @@ -78,18 +80,20 @@ long do_utimes(int dfd, char __user *fil if (!f) goto out; dentry = f->f_path.dentry; + mnt = f->f_path.mnt; } else { error = __user_walk_fd(dfd, filename, (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW, &nd); if (error) goto out; dentry = nd.dentry; + mnt = nd.mnt; } inode = dentry->d_inode; - error = -EROFS; - if (IS_RDONLY(inode)) + error = mnt_want_write(mnt); + if (error) goto dput_and_out; /* Don't worry, the checks are done in inode_change_ok() */ @@ -97,7 +101,7 @@ long do_utimes(int dfd, char __user *fil if (times) { error = -EPERM; if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) - goto dput_and_out; + goto mnt_drop_write_and_out; if (times[0].tv_nsec == UTIME_OMIT) newattrs.ia_valid &= ~ATTR_ATIME; @@ -117,22 +121,24 @@ long do_utimes(int dfd, char __user *fil } else { error = -EACCES; if (IS_IMMUTABLE(inode)) - goto dput_and_out; + goto mnt_drop_write_and_out; if (!is_owner_or_cap(inode)) { if (f) { if (!(f->f_mode & FMODE_WRITE)) - goto dput_and_out; + goto mnt_drop_write_and_out; } else { error = vfs_permission(&nd, MAY_WRITE); if (error) - goto dput_and_out; + goto mnt_drop_write_and_out; } } } mutex_lock(&inode->i_mutex); error = notify_change(dentry, &newattrs); mutex_unlock(&inode->i_mutex); +mnt_drop_write_and_out: + mnt_drop_write(mnt); dput_and_out: if (f) fput(f); _ - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/