https://source.android.com/docs/security/bulletin/2024-06-01 CVE-2024-26926 * tag 'ASB-2024-06-05_11-5.4' of https://android.googlesource.com/kernel/common: ANDROID: ABI fixup for abi break in struct dst_ops BACKPORT: net: fix __dst_negative_advice() race UPSTREAM: selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior Revert "timers: Rename del_timer_sync() to timer_delete_sync()" Reapply "media: ttpci: fix two memleaks in budget_av_attach" Revert "media: rename VFL_TYPE_GRABBER to _VIDEO" Revert "media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO" Revert "media: ttpci: fix two memleaks in budget_av_attach" Revert "net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()" Revert "regmap: allow to define reg_update_bits for no bus configuration" Revert "regmap: Add bulk read/write callbacks into regmap_config" Revert "serial: max310x: fix IO data corruption in batched operations" Revert "geneve: make sure to pull inner header in geneve_rx()" Linux 5.4.274 firmware: meson_sm: fix to avoid potential NULL pointer dereference ip_gre: do not report erspan version on GRE interface erspan: Check IFLA_GRE_ERSPAN_VER is set. VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() Bluetooth: btintel: Fixe build regression x86/alternative: Don't call text_poke() in lazy TLB mode drm/i915/gt: Reset queue_priority_hint on parking x86/mm/pat: fix VM_PAT handling in COW mappings virtio: reenable config if freezing device failed drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put() tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc netfilter: nf_tables: discard table flag update with pending basechain deletion netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path netfilter: nf_tables: release batch on table validation from abort path netfilter: nf_tables: reject new basechain after table flag update fbmon: prevent division by zero in fb_videomode_from_videomode() fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined usb: typec: tcpci: add generic tcpci fallback compatible tools: iio: replace seekdir() in iio_generic_buffer ktest: force $buildonly = 1 for 'make_warnings_file' test type Input: allocate keycode for Display refresh rate toggle block: prevent division by zero in blk_rq_stat_sum() Revert "ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default" SUNRPC: increase size of rpc_wait_queue.qlen from unsigned short to unsigned int drm/amd/display: Fix nanosec stat overflow media: sta2x11: fix irq handler cast isofs: handle CDs with bad root inode but good Joliet root directory scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() sysv: don't call sb_bread() with pointers_lock held Input: synaptics-rmi4 - fail probing if memory allocation for "phys" fails Bluetooth: btintel: Fix null ptr deref in btintel_read_version btrfs: send: handle path ref underflow in header iterate_inode_ref() btrfs: export: handle invalid inode or root reference in btrfs_get_parent() btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() tools/power x86_energy_perf_policy: Fix file leak in get_pkg_num() ionic: set adminq irq affinity arm64: dts: rockchip: fix rk3399 hdmi ports node arm64: dts: rockchip: fix rk3328 hdmi ports node panic: Flush kernel log buffer at the end VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() wifi: ath9k: fix LNA selection in ath_ant_try_scan() s390/entry: align system call table on 8 bytes x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() ALSA: hda/realtek: Update Panasonic CF-SZ6 quirk to support headset with microphone ata: sata_mv: Fix PCI device ID table declaration compilation warning scsi: mylex: Fix sysfs buffer lengths ata: sata_sx4: fix pdc20621_get_from_dimm() on 64-bit ASoC: ops: Fix wraparound for mask in snd_soc_get_volsw net: ravb: Always process TX descriptor ring erspan: make sure erspan_base_hdr is present in skb->head erspan: Add type I version 0 support. init: open /initrd.image with O_LARGEFILE initramfs: switch initramfs unpacking to struct file based APIs fs: add a vfs_fchmod helper fs: add a vfs_fchown helper staging: vc04_services: fix information leak in create_component() staging: vc04_services: changen strncpy() to strscpy_pad() staging: mmal-vchiq: Fix client_component for 64 bit kernel staging: mmal-vchiq: Allocate and free components as required i40e: fix vf may be used uninitialized in this function warning ipv6: Fix infinite recursion in fib6_dump_done(). selftests: reuseaddr_conflict: add missing new line at the end of the output net: stmmac: fix rx queue priority assignment net/sched: act_skbmod: prevent kernel-infoleak bpf, sockmap: Prevent lock inversion deadlock in map delete elem netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() netfilter: nf_tables: flush pending destroy work before exit_net release mm, vmscan: prevent infinite loop for costly GFP_NOIO | __GFP_RETRY_MAYFAIL allocations Revert "x86/mm/ident_map: Use gbpages only where full GB page should be mapped." vfio/platform: Create persistent IRQ handlers vfio/pci: Create persistent INTx handler vfio: Introduce interface to flush virqfd inject workqueue vfio/pci: Lock external INTx masking ops vfio/pci: Disable auto-enable of exclusive INTx IRQ net/rds: fix possible cp null dereference netfilter: nf_tables: disallow timeout for anonymous sets Bluetooth: Fix TOCTOU in HCI debugfs implementation Bluetooth: hci_event: set the conn encrypted before conn establishes x86/cpufeatures: Add new word for scattered features r8169: fix issue caused by buggy BIOS on certain boards with RTL8168d dm integrity: fix out-of-range warning tcp: properly terminate timers for kernel sockets ixgbe: avoid sleeping allocation in ixgbe_ipsec_vf_add_sa() nfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet USB: core: Fix deadlock in usb_deauthorize_interface() scsi: lpfc: Correct size for wqe for memset() x86/cpu: Enable STIBP on AMD if Automatic IBRS is enabled scsi: qla2xxx: Fix command flush on cable pull usb: udc: remove warning when queue disabled ep usb: dwc2: gadget: LPM flow fix usb: dwc2: host: Fix ISOC flow in DDMA mode usb: dwc2: host: Fix hibernation flow usb: dwc2: host: Fix remote wakeup from hibernation scsi: core: Fix unremoved procfs host directory regression ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs usb: cdc-wdm: close race between read and workqueue mmc: core: Avoid negative index with array access mmc: core: Initialize mmc_blk_ioc_data exec: Fix NOMMU linux_binprm::exec in transfer_args_to_stack() wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes mm/migrate: set swap entry values of THP tail pages properly. mm/memory-failure: fix an incorrect use of tail pages vt: fix memory overlapping when deleting chars in the buffer bounds: support non-power-of-two CONFIG_NR_CPUS powerpc: xor_vmx: Add '-mhard-float' to CFLAGS efivarfs: Request at most 512 bytes for variable names perf/core: Fix reentry problem in perf_output_read_group() loop: loop_set_status_from_info() check before assignment loop: Check for overflow while configuring loop loop: Factor out configuring loop from status loop: Refactor loop_set_status() size calculation loop: Factor out setting loop device size loop: Remove sector_t truncation checks loop: Call loop_config_discard() only after new config is applied Revert "loop: Check for overflow while configuring loop" btrfs: allocate btrfs_ioctl_defrag_range_args on stack printk: Update @console_may_schedule in console_trylock_spinning() xen/events: close evtchn after mapping cleanup x86/speculation: Support intra-function call validation objtool: Add support for intra-function calls objtool: is_fentry_call() crashes if call has no destination fs/aio: Check IOCB_AIO_RW before the struct aio_kiocb conversion vt: fix unicode buffer corruption when deleting characters tty: serial: fsl_lpuart: avoid idle preamble pending if CTS is enabled usb: port: Don't try to peer unused USB ports based on location usb: gadget: ncm: Fix handling of zero block length packets USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command ALSA: hda/realtek - Fix headset Mic no show at resume back for Lenovo ALC897 platform xfrm: Avoid clang fortify warning in copy_to_user_tmpl() netfilter: nf_tables: reject constant set with timeout netfilter: nf_tables: disallow anonymous set with timeout flag netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout comedi: comedi_test: Prevent timers rescheduling during deletion dm snapshot: fix lockup in dm_exception_table_exit ahci: asm1064: asm1166: don't limit reported ports ahci: asm1064: correct count of reported ports x86/CPU/AMD: Update the Zenbleed microcode revisions nilfs2: prevent kernel bug at submit_bh_wbc() nilfs2: use a more common logging style nilfs2: fix failure to detect DAT corruption in btree and direct mappings memtest: use {READ,WRITE}_ONCE in memory scanning drm/vc4: hdmi: do not return negative values from .get_modes() drm/imx/ipuv3: do not return negative values from .get_modes() drm/exynos: do not return negative values from .get_modes() s390/zcrypt: fix reference counting on zcrypt card objects soc: fsl: qbman: Use raw spinlock for cgr_lock soc: fsl: qbman: Add CGR update function soc: fsl: qbman: Add helper for sanity checking cgr ops soc: fsl: qbman: Always disable interrupts when taking cgr_lock ring-buffer: Fix full_waiters_pending in poll ring-buffer: Fix resetting of shortest_full vfio/platform: Disable virqfds on cleanup kbuild: Move -Wenum-{compare-conditional,enum-conversion} into W=1 speakup: Fix 8bit characters from direct synth slimbus: core: Remove usage of the deprecated ida_simple_xx() API nvmem: meson-efuse: fix function pointer type mismatch firmware: meson_sm: Rework driver as a proper platform driver ext4: fix corruption during on-line resize hwmon: (amc6821) add of_match table mmc: core: Fix switch on gp3 partition dm-raid: fix lockdep waring in "pers->hot_add_disk" Revert "Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"" PCI/PM: Drain runtime-idle callbacks before driver removal PCI: Drop pci_device_remove() test of pci_dev->driver btrfs: fix off-by-one chunk length calculation at contains_pending_extent() fuse: don't unhash root mmc: tmio: avoid concurrent runs of mmc_request_done() PM: sleep: wakeirq: fix wake irq warning in system suspend USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M USB: serial: option: add MeiG Smart SLM320 product USB: serial: cp210x: add ID for MGP Instruments PDS100 USB: serial: add device ID for VeriFone adapter USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB powerpc/fsl: Fix mfpmr build errors with newer binutils clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays PM: suspend: Set mem_sleep_current during kernel command line setup parisc: Strip upper 32 bit of sum in csum_ipv6_magic for 64-bit builds parisc: Fix csum_ipv6_magic on 64-bit systems parisc: Fix csum_ipv6_magic on 32-bit systems parisc: Fix ip_fast_csum parisc: Do not hardcode registers in checksum functions mtd: rawnand: meson: fix scrambling mode value in command macro ubi: correct the calculation of fastmap size ubi: Check for too small LEB size in VTBL code ubifs: Set page uptodate in the correct place fat: fix uninitialized field in nostale filehandles ext4: correct best extent lstart adjustment logic selftests/mqueue: Set timeout to 180 seconds crypto: qat - resolve race condition during AER recovery crypto: qat - fix double free during reset sparc: vDSO: fix return value of __setup handler sparc64: NMI watchdog: fix return value of __setup handler KVM: Always flush async #PF workqueue when vCPU is being destroyed media: xc4000: Fix atomicity violation in xc4000_get_frequency serial: max310x: fix NULL pointer dereference in I2C instantiation arm: dts: marvell: Fix maxium->maxim typo in brownstone dts ARM: dts: mmp2-brownstone: Don't redeclare phandle references smack: Handle SMACK64TRANSMUTE in smack_inode_setsecurity() smack: Set SMACK64TRANSMUTE only for dirs in smack_inode_setxattr() clk: qcom: gcc-sdm845: Add soft dependency on rpmhpd media: staging: ipu3-imgu: Set fields before media_entity_pads_init() wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach timers: Rename del_timer_sync() to timer_delete_sync() timers: Use del_timer_sync() even on UP timers: Update kernel-doc for various functions x86/bugs: Use sysfs_emit() x86/cpu: Support AMD Automatic IBRS Documentation/hw-vuln: Update spectre doc amdkfd: use calloc instead of kzalloc to avoid integer overflow Linux 5.4.273 regmap: Add missing map->bus check spi: spi-mt65xx: Fix NULL pointer access in interrupt handler bpf: report RCU QS in cpumap kthread rcu: add a helper to report consolidated flavor QS netfilter: nf_tables: do not compare internal table flags on updates ARM: dts: sun8i-h2-plus-bananapi-m2-zero: add regulator nodes vcc-dram and vcc1v2 octeontx2-af: Use separate handlers for interrupts net/bnx2x: Prevent access to a freed page in page_pool hsr: Handle failures in module init rds: introduce acquire/release ordering in acquire/release_in_xmit() packet: annotate data-races around ignore_outgoing hsr: Fix uninit-value access in hsr_get_node() s390/vtime: fix average steal time calculation octeontx2-af: Use matching wake_up API variant in CGX command interface usb: gadget: net2272: Use irqflags in the call to net2272_probe_fin staging: greybus: fix get_channel_from_mode() failure path serial: 8250_exar: Don't remove GPIO device on suspend rtc: mt6397: select IRQ_DOMAIN instead of depending on it kconfig: fix infinite loop when expanding a macro at the end of file tty: serial: samsung: fix tx_empty() to return TIOCSER_TEMT serial: max310x: fix syntax error in IRQ error message tty: vt: fix 20 vs 0x20 typo in EScsiignore afs: Revert "afs: Hide silly-rename files from userspace" NFS: Fix an off by one in root_nfs_cat() watchdog: stm32_iwdg: initialize default timeout net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr() scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn RDMA/device: Fix a race between mad_client and cm_client init scsi: csiostor: Avoid function pointer casts ALSA: usb-audio: Stop parsing channels bits when all channels are found. clk: Fix clk_core_get NULL dereference sparc32: Fix section mismatch in leon_pci_grpci backlight: lp8788: Fully initialize backlight_properties during probe backlight: lm3639: Fully initialize backlight_properties during probe backlight: da9052: Fully initialize backlight_properties during probe backlight: lm3630a: Don't set bl->props.brightness in get_brightness backlight: lm3630a: Initialize backlight_properties on init powerpc/embedded6xx: Fix no previous prototype for avr_uart_send() etc. drm/msm/dpu: add division of drm_display_mode's hskew parameter powerpc/hv-gpci: Fix the H_GET_PERF_COUNTER_INFO hcall return value checks drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip media: ttpci: fix two memleaks in budget_av_attach media: media/pci: rename VFL_TYPE_GRABBER to _VIDEO media: rename VFL_TYPE_GRABBER to _VIDEO media: v4l2-core: correctly validate video and metadata ioctls media: go7007: fix a memleak in go7007_load_encoder media: dvb-frontends: avoid stack overflow warnings with clang media: pvrusb2: fix uaf in pvr2_context_set_notify drm/amdgpu: Fix missing break in ATOM_ARG_IMM Case of atom_get_src_int() ASoC: meson: axg-tdm-interface: fix mclk setup without mclk-fs mtd: rawnand: lpc32xx_mlc: fix irq handler prototype mtd: maps: physmap-core: fix flash size larger than 32-bit crypto: arm/sha - fix function cast warnings mfd: altera-sysmgr: Call of_node_put() only when of_parse_phandle() takes a ref mfd: syscon: Call of_node_put() only when of_parse_phandle() takes a ref drm/tegra: put drm_gem_object ref on error in tegra_fb_create clk: hisilicon: hi3519: Release the correct number of gates in hi3519_clk_unregister() PCI: Mark 3ware-9650SE Root Port Extended Tags as broken drm/mediatek: dsi: Fix DSI RGB666 formats and definitions clk: qcom: dispcc-sdm845: Adjust internal GDSC wait times media: pvrusb2: fix pvr2_stream_callback casts media: pvrusb2: remove redundant NULL check media: go7007: add check of return value of go7007_read_addr() media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak perf stat: Avoid metric-only segv ALSA: seq: fix function cast warnings drm/radeon/ni: Fix wrong firmware size logging in ni_init_microcode() perf thread_map: Free strlist on normal path in thread_map__new_by_tid_str() PCI: switchtec: Fix an error handling path in switchtec_pci_probe() quota: Fix rcu annotations of inode dquot pointers quota: Fix potential NULL pointer dereference quota: simplify drop_dquot_ref() clk: qcom: reset: Ensure write completion on reset de/assertion clk: qcom: reset: Commonize the de/assert functions clk: qcom: reset: support resetting multiple bits clk: qcom: reset: Allow specifying custom reset delay media: edia: dvbdev: fix a use-after-free media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity media: v4l2-tpg: fix some memleaks in tpg_alloc media: em28xx: annotate unchecked call to media_device_register() perf evsel: Fix duplicate initialization of data->id in evsel__parse_sample() drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' perf record: Fix possible incorrect free in record__switch_output() PCI/DPC: Print all TLP Prefixes, not just the first media: tc358743: register v4l2 async device only after successful setup dmaengine: tegra210-adma: Update dependency to ARCH_TEGRA drm/rockchip: lvds: do not overwrite error code drm: Don't treat 0 as -1 in drm_fixp2int_ceil drm/rockchip: inno_hdmi: Fix video timing drm/tegra: output: Fix missing i2c_put_adapter() in the error handling paths of tegra_output_probe() drm/tegra: dsi: Fix missing pm_runtime_disable() in the error handling path of tegra_dsi_probe() drm/tegra: dsi: Fix some error handling paths in tegra_dsi_probe() drm/tegra: dsi: Make use of the helper function dev_err_probe() gpu: host1x: mipi: Update tegra_mipi_request() to be node based drm/tegra: dsi: Add missing check for of_find_device_by_node dm: call the resume method on internal suspend dm raid: fix false positive for requeue needed during reshape nfp: flower: handle acti_netdevs allocation failure net/x25: fix incorrect parameter validation in the x25_getsockopt() function net: kcm: fix incorrect parameter validation in the kcm_getsockopt) function udp: fix incorrect parameter validation in the udp_lib_getsockopt() function l2tp: fix incorrect parameter validation in the pppol2tp_getsockopt() function tcp: fix incorrect parameter validation in the do_tcp_getsockopt() function net: hns3: fix port duplex configure error in IMP reset net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() ipv6: fib6_rules: flush route cache when rule is changed bpf: Fix stackmap overflow check on 32-bit arches bpf: Fix hashtab overflow check on 32-bit arches sr9800: Add check for usbnet_get_endpoints Bluetooth: hci_core: Fix possible buffer overflow Bluetooth: Remove superfluous call to hci_conn_check_pending() igb: Fix missing time sync events igb: move PEROUT and EXTTS isr logic to separate functions mmc: wmt-sdmmc: remove an incorrect release_mem_region() call in the .remove function SUNRPC: fix some memleaks in gssx_dec_option_array x86, relocs: Ignore relocations in .notes section ACPI: scan: Fix device check notification handling ARM: dts: imx6dl-yapp4: Move the internal switch PHYs under the switch node ARM: dts: imx6dl-yapp4: Fix typo in the QCA switch register address ARM: dts: imx6dl-yapp4: Move phy reset into switch node ARM: dts: arm: realview: Fix development chip ROM compatible value net: ena: Remove ena_select_queue net: ena: cosmetic: fix line break issues wifi: brcmsmac: avoid function pointer casts iommu/amd: Mark interrupt as managed bus: tegra-aconnect: Update dependency to ARCH_TEGRA ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() arm64: dts: qcom: msm8996: Pad addresses arm64: dts: qcom: msm8996: Move regulator consumers to db820c arm64: dts: qcom: msm8996: Use node references in db820c arm64: dts: qcom: db820c: Move non-soc entries out of /soc bpf: Mark bpf_spin_{lock,unlock}() helpers with notrace correctly bpf: Factor out bpf_spin_lock into helpers. bpf: Add typecast to bpf helpers to help BTF generation arm64: dts: mediatek: mt7622: add missing "device_type" to memory nodes wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() net: blackhole_dev: fix build warning for ethh set but not used af_unix: Annotate data-race of gc_in_progress in wait_for_unix_gc(). sock_diag: annotate data-races around sock_diag_handlers[family] wifi: mwifiex: debugfs: Drop unnecessary error check for debugfs_create_dir() wifi: wilc1000: fix RCU usage in connect path wifi: wilc1000: fix declarations ordering wifi: b43: Disable QoS for bcm4331 wifi: b43: Stop correct queue in DMA worker when QoS is disabled b43: main: Fix use true/false for bool type wifi: b43: Stop/wake correct queue in PIO Tx path when QoS is disabled wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled b43: dma: Fix use true/false for bool type variable wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() timekeeping: Fix cross-timestamp interpolation for non-x86 timekeeping: Fix cross-timestamp interpolation corner case decision timekeeping: Fix cross-timestamp interpolation on counter wrap aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts fs/select: rework stack allocation hack for clang nbd: null check for nla_nest_start do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak ASoC: wm8962: Fix up incorrect error message in wm8962_set_fll ASoC: wm8962: Enable both SPKOUTR_ENA and SPKOUTL_ENA in mono mode ASoC: wm8962: Enable oscillator if selecting WM8962_FLL_OSC Input: gpio_keys_polled - suppress deferred probe error for gpio ASoC: Intel: bytcr_rt5640: Add an extra entry for the Chuwi Vi8 tablet firewire: core: use long bus reset on gap count error Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security scsi: mpt3sas: Prevent sending diag_reset when the controller is ready btrfs: fix data race at btrfs_use_block_rsv() when accessing block reserve dm-verity, dm-crypt: align "struct bvec_iter" correctly block: sed-opal: handle empty atoms when parsing response parisc/ftrace: add missing CONFIG_DYNAMIC_FTRACE check net/iucv: fix the allocation size of iucv_path_table array RDMA/mlx5: Relax DEVX access upon modify commands HID: multitouch: Add required quirk for Synaptics 0xcddc device MIPS: Clear Cause.BD in instruction_pointer_set x86/xen: Add some null pointer checking to smp.c ASoC: rt5645: Make LattePanda board DMI match more precise selftests: tls: use exact comparison in recv_partial io_uring: drop any code related to SCM_RIGHTS io_uring/unix: drop usage of io_uring socket UPSTREAM: arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts UPSTREAM: arm64: dts: qcom: add PDC interrupt controller for SDM845 Linux 5.4.272 arm64: dts: qcom: sdm845: fix USB DP/DM HS PHY interrupts arm64: dts: qcom: add PDC interrupt controller for SDM845 serial: max310x: fix IO data corruption in batched operations serial: max310x: implement I2C support serial: max310x: make accessing revision id interface-agnostic regmap: Add bulk read/write callbacks into regmap_config regmap: allow to define reg_update_bits for no bus configuration serial: max310x: Unprepare and disable clock in error path getrusage: use sig->stats_lock rather than lock_task_sighand() getrusage: use __for_each_thread() getrusage: move thread_group_cputime_adjusted() outside of lock_task_sighand() getrusage: add the "signal_struct *sig" local variable y2038: rusage: use __kernel_old_timeval hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed hv_netvsc: use netif_is_bond_master() instead of open code hv_netvsc: Make netvsc/VF binding check both MAC and serial number Input: i8042 - fix strange behavior of touchpad on Clevo NS70PU serial: max310x: prevent infinite while() loop in port startup serial: max310x: use a separate regmap for each port serial: max310x: use regmap methods for SPI batch operations serial: max310x: Make use of device properties serial: max310x: fail probe if clock crystal is unstable serial: max310x: Try to get crystal clock rate from property serial: max310x: Use devm_clk_get_optional() to get the input clock um: allow not setting extra rpaths in the linux binary selftests: mm: fix map_hugetlb failure on 64K page size systems netrom: Fix data-races around sysctl_net_busy_read netrom: Fix a data-race around sysctl_netrom_link_fails_count netrom: Fix a data-race around sysctl_netrom_routing_control netrom: Fix a data-race around sysctl_netrom_transport_no_activity_timeout netrom: Fix a data-race around sysctl_netrom_transport_requested_window_size netrom: Fix a data-race around sysctl_netrom_transport_busy_delay netrom: Fix a data-race around sysctl_netrom_transport_acknowledge_delay netrom: Fix a data-race around sysctl_netrom_transport_maximum_tries netrom: Fix a data-race around sysctl_netrom_transport_timeout netrom: Fix data-races around sysctl_netrom_network_ttl_initialiser netrom: Fix a data-race around sysctl_netrom_obsolescence_count_initialiser netrom: Fix a data-race around sysctl_netrom_default_path_quality netfilter: nf_conntrack_h323: Add protection for bmp length out of range netfilter: nft_ct: fix l3num expectations with inet pseudo family net/rds: fix WARNING in rds_conn_connect_if_down net/ipv6: avoid possible UAF in ip6_route_mpath_notify() net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() geneve: make sure to pull inner header in geneve_rx() ixgbe: {dis, en}able irqs in ixgbe_txrx_ring_{dis, en}able net: lan78xx: fix runtime PM count underflow on link stop lan78xx: Fix race conditions in suspend/resume handling lan78xx: Fix partial packet errors on suspend/resume lan78xx: Add missing return code checks lan78xx: Fix white space and style issues Linux 5.4.271 gpio: 74x164: Enable output pins after registers are reset fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super cachefiles: fix memory leak in cachefiles_add_cache() x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers mmc: core: Fix eMMC initialization with 1-bit bus connection dmaengine: fsl-qdma: init irq after reg initialization dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read btrfs: dev-replace: properly validate device names wifi: nl80211: reject iftype change with mesh ID change gtp: fix use-after-free and null-ptr-deref in gtp_newlink() afs: Fix endless loop in directory parsing ALSA: Drop leftover snd-rtctimer stuff from Makefile power: supply: bq27xxx-i2c: Do not free non existing IRQ efi/capsule-loader: fix incorrect allocation size rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate() Bluetooth: Enforce validation on max value of connection interval Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST Bluetooth: Avoid potential use-after-free in hci_error_reset net: usb: dm9601: fix wrong return value in dm9601_mdio_read lan78xx: enable auto speed configuration for LAN7850 if no EEPROM is detected ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() tun: Fix xdp_rxq_info's queue_index when detaching net: ip_tunnel: prevent perpetual headroom growth netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter ANDROID: GKI: update .xml file due to USB changes in 5.4.270 Revert "bpf: Add map and need_defer parameters to .map_fd_put_ptr()" Revert "hrtimer: Report offline hrtimer enqueue" Revert "drm/mipi-dsi: Fix detach call without attach" Linux 5.4.270 scripts/bpf: Fix xdp_md forward declaration typo fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio drm/syncobj: call drm_syncobj_fence_add_wait when WAIT_AVAILABLE flag is set drm/syncobj: make lockdep complain on WAIT_FOR_SUBMIT v3 netfilter: nf_tables: set dormant flag on hook register failure tls: stop recv() if initial process_rx_list gave us non-DATA tls: rx: drop pointless else after goto tls: rx: jump to a more appropriate label s390: use the correct count for __iowrite64_copy() packet: move from strlcpy with unused retval to strscpy ipv6: sr: fix possible use-after-free and null-ptr-deref afs: Increase buffer size in afs_update_volume_status() ipv6: properly combine dev_base_seq and ipv6.dev_addr_genid ipv4: properly combine dev_base_seq and ipv4.dev_addr_genid nouveau: fix function cast warnings scsi: jazz_esp: Only build if SCSI core is builtin bpf, scripts: Correct GPL license name scripts/bpf: teach bpf_helpers_doc.py to dump BPF helper definitions RDMA/srpt: fix function pointer cast warnings RDMA/srpt: Make debug output more detailed RDMA/bnxt_re: Return error for SRQ resize IB/hfi1: Fix a memleak in init_credit_return usb: roles: don't get/set_role() when usb_role_switch is unregistered usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs usb: cdns3: fix memory double free when handle zero packet usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() ARM: ep93xx: Add terminator to gpiod_lookup_table l2tp: pass correct message length to ip6_append_data PCI/MSI: Prevent MSI hardware interrupt number truncation gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() dm-crypt: don't modify the data when using authenticated encryption IB/hfi1: Fix sdma.h tx->num_descs off-by-one error PCI: tegra: Fix OF node reference leak PCI: tegra: Fix reporting GPIO error value arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node drm/amdgpu: Fix type of second parameter in trans_msg() callback iomap: Set all uptodate bits for an Uptodate page dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata() x86/alternatives: Disable KASAN in apply_alternatives() drm/amdgpu: Check for valid number of registers to read Revert "drm/sun4i: dsi: Change the start delay calculation" ALSA: hda/realtek - Enable micmute LED on and HP system selftests/bpf: Avoid running unprivileged tests with alignment requirements net: bridge: clear bridge's private skb space on xmit spi: mt7621: Fix an error message in mt7621_spi_probe() pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc misdemeanours tcp: add annotations around sk->sk_shutdown accesses tcp: return EPOLLOUT from tcp_poll only when notsent_bytes is half the limit tcp: factor out __tcp_close() helper pmdomain: renesas: r8a77980-sysc: CR7 must be always on s390/qeth: Fix potential loss of L3-IP@ in case of network issues virtio-blk: Ensure no requests in virtqueues before deleting vqs. firewire: core: send bus reset promptly on gap count error scsi: lpfc: Use unsigned type for num_sge hwmon: (coretemp) Enlarge per package core count limit nvmet-fc: abort command when there is no binding netfilter: conntrack: check SCTP_CID_SHUTDOWN_ACK for vtag setting in sctp_new ASoC: sunxi: sun4i-spdif: Add support for Allwinner H616 nvmet-tcp: fix nvme tcp ida memory leak regulator: pwm-regulator: Add validity checks in continuous .get_voltage ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() ahci: add 43-bit DMA address quirk for ASMedia ASM1061 controllers ahci: asm1166: correct count of reported ports fbdev: sis: Error out if pixclock equals zero fbdev: savage: Error out if pixclock equals zero wifi: mac80211: fix race condition on enabling fast-xmit wifi: cfg80211: fix missing interfaces when dumping dmaengine: fsl-qdma: increase size of 'irq_name' dmaengine: shdma: increase size of 'dev_id' scsi: target: core: Add TMF to tmr_list handling sched/rt: Disallow writing invalid values to sched_rt_period_us sched/rt: Fix sysctl_sched_rr_timeslice intial value userfaultfd: fix mmap_changing checking in mfill_atomic_hugetlb nilfs2: replace WARN_ONs for invalid DAT metadata block requests memcg: add refcnt for pcpu stock to avoid UAF problem in drain_all_stock() sched/rt: sysctl_sched_rr_timeslice show default timeslice after reset net/sched: Retire dsmark qdisc net/sched: Retire ATM qdisc net/sched: Retire CBQ qdisc KVM: arm64: vgic-its: Test for valid IRQ in MOVALL handler KVM: arm64: vgic-its: Test for valid IRQ in its_sync_lpi_pending_table() Linux 5.4.269 of: gpio unittest kfree() wrong object of: unittest: fix EXPECT text for gpio hog errors net: bcmgenet: Fix EEE implementation Revert "Revert "mtd: rawnand: gpmi: Fix setting busy timeout setting"" netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() lsm: new security_file_ioctl_compat() hook drm/msm/dsi: Enable runtime PM PM: runtime: Have devm_pm_runtime_enable() handle pm_runtime_dont_use_autosuspend() PM: runtime: add devm_pm_runtime_enable helper nilfs2: fix potential bug in end_buffer_async_write sched/membarrier: reduce the ability to hammer on sys_membarrier net: prevent mss overflow in skb_segment() netfilter: ipset: Missing gc cancellations fixed netfilter: ipset: fix performance regression in swap operation KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache mips: Fix max_mapnr being uninitialized on early stages arch, mm: remove stale mentions of DISCONIGMEM bus: moxtet: Add spi device table Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" tracing: Inform kmemleak of saved_cmdlines allocation pmdomain: core: Move the unused cleanup to a _sync initcall can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) irqchip/irq-brcmstb-l2: Add write memory barrier before exit nfp: flower: prevent re-adding mac index for bonded port nfp: use correct macro for LengthSelect in BAR config nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() nilfs2: fix data corruption in dsync block recovery for small block sizes ALSA: hda/conexant: Add quirk for SWS JS201D mmc: slot-gpio: Allow non-sleeping GPIO ro x86/mm/ident_map: Use gbpages only where full GB page should be mapped. x86/Kconfig: Transmeta Crusoe is CPU family 5, not 6 serial: max310x: improve crystal stable clock detection serial: max310x: set default value when reading clock ready bit ring-buffer: Clean ring_buffer_poll_wait() error return iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC staging: iio: ad5933: fix type mismatch regression tracing: Fix wasted memory in saved_cmdlines logic ext4: fix double-free of blocks due to wrong extents moved_len misc: fastrpc: Mark all sessions as invalid in cb_remove binder: signal epoll threads of self-work ALSA: hda/realtek: Enable headset mic on Vaio VJFE-ADL xen-netback: properly sync TX responses nfc: nci: free rx_data_reassembly skb on NCI device cleanup kbuild: Fix changing ELF file type for output of gen_btf for big endian firewire: core: correct documentation of fw_csr_string() kernel API scsi: Revert "scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock" i2c: i801: Fix block process call transactions i2c: i801: Remove i801_set_block_buffer_mode usb: f_mass_storage: forbid async queue when shutdown happen USB: hub: check for alternate port before enabling A_ALT_HNP_SUPPORT HID: wacom: Do not register input devices until after hid_hw_start HID: wacom: generic: Avoid reporting a serial of '0' to userspace mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again tracing/trigger: Fix to return error if failed to alloc snapshot i40e: Fix waiting for queues of all VSIs to be disabled MIPS: Add 'memory' clobber to csum_ipv6_magic() inline assembler ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() spi: ppc4xx: Drop write-only variable of: unittest: Fix compile in the non-dynamic case of: unittest: add overlay gpio test to catch gpio hog problem btrfs: send: return EOPNOTSUPP on unknown flags btrfs: forbid deleting live subvol qgroup btrfs: forbid creating subvol qgroups netfilter: nft_set_rbtree: skip end interval element from gc net: stmmac: xgmac: fix a typo of register name in DPP safety handling net: stmmac: xgmac: use #define for string constants vhost: use kzalloc() instead of kmalloc() followed by memset() Input: atkbd - skip ATKBD_CMD_SETLEDS when skipping ATKBD_CMD_GETID hrtimer: Report offline hrtimer enqueue USB: serial: cp210x: add ID for IMST iM871A-USB USB: serial: option: add Fibocom FM101-GL variant USB: serial: qcserial: add new usb-id for Dell Wireless DW5826e net/af_iucv: clean up a try_then_request_module() netfilter: nft_ct: reject direction for ct id netfilter: nft_compat: restrict match/target protocol to u16 netfilter: nft_compat: reject unused compat flag ppp_async: limit MRU to 64K tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() rxrpc: Fix response to PING RESPONSE ACKs to a dead call inet: read sk->sk_family once in inet_recv_error() hwmon: (coretemp) Fix bogus core_id to attr name mapping hwmon: (coretemp) Fix out-of-bounds memory access hwmon: (aspeed-pwm-tacho) mutex for tach reading atm: idt77252: fix a memleak in open_card_ubr0 selftests: net: avoid just another constant wait net: stmmac: xgmac: fix handling of DPP safety error for DMA channels phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP dmaengine: fix is_slave_direction() return false when DMA_DEV_TO_DEV phy: renesas: rcar-gen3-usb2: Fix returning wrong error code dmaengine: fsl-qdma: Fix a memory leak related to the queue command DMA dmaengine: fsl-qdma: Fix a memory leak related to the status queue DMA bonding: remove print in bond_verify_device_path HID: apple: Add 2021 magic keyboard FN key mapping HID: apple: Swap the Fn and Left Control keys on Apple keyboards HID: apple: Add support for the 2021 Magic Keyboard net: sysfs: Fix /sys/class/net/<iface> path af_unix: fix lockdep positive in sk_diag_dump_icons() net: ipv4: fix a memleak in ip_setup_cork netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations netfilter: nf_log: replace BUG_ON by WARN_ON_ONCE when putting logger llc: call sock_orphan() at release time ipv6: Ensure natural alignment of const ipv6 loopback and router addresses ixgbe: Fix an error handling path in ixgbe_read_iosf_sb_reg_x550() ixgbe: Refactor overtemp event handling ixgbe: Refactor returning internal error codes ixgbe: Remove non-inclusive language net: remove unneeded break scsi: isci: Fix an error code problem in isci_io_request_build() wifi: cfg80211: fix RCU dereference in __cfg80211_bss_update perf: Fix the nr_addr_filters fix drm/amdgpu: Release 'adev->pm.fw' before return in 'amdgpu_device_need_post()' ceph: fix deadlock or deadcode of misusing dget() blk-mq: fix IO hang from sbitmap wakeup race virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings libsubcmd: Fix memory leak in uniq() PCI/AER: Decode Requester ID when no error info found fs/kernfs/dir: obey S_ISGID usb: hub: Replace hardcoded quirk value with BIT() macro PCI: switchtec: Fix stdev_release() crash after surprise hot remove PCI: Only override AMD USB controller if required mfd: ti_am335x_tscadc: Fix TI SoC dependencies i3c: master: cdns: Update maximum prescaler value for i2c clock um: net: Fix return type of uml_net_start_xmit() um: Don't use vfprintf() for os_info() um: Fix naming clash between UML and scheduler leds: trigger: panic: Don't register panic notifier if creating the trigger failed drm/amdgpu: Drop 'fence' check in 'to_amdgpu_amdkfd_fence()' drm/amdgpu: Let KFD sync with VM fences clk: mmp: pxa168: Fix memory leak in pxa168_clk_init() clk: hi3620: Fix memory leak in hi3620_mmc_clk_init() drm/msm/dpu: Ratelimit framedone timeout msgs media: ddbridge: fix an error code problem in ddb_probe IB/ipoib: Fix mcast list locking drm/exynos: Call drm_atomic_helper_shutdown() at shutdown/unbind time ALSA: hda: Intel: add HDA_ARL PCI ID support PCI: add INTEL_HDA_ARL to pci_ids.h media: rockchip: rga: fix swizzling for RGB formats media: stk1160: Fixed high volume of stk1160_dbg messages drm/mipi-dsi: Fix detach call without attach drm/framebuffer: Fix use of uninitialized variable drm/drm_file: fix use of uninitialized variable RDMA/IPoIB: Fix error code return in ipoib_mcast_join fast_dput(): handle underflows gracefully ASoC: doc: Fix undefined SND_SOC_DAPM_NOPM argument f2fs: fix to check return value of f2fs_reserve_new_block() wifi: cfg80211: free beacon_ies when overridden from hidden BSS wifi: rtlwifi: rtl8723{be,ae}: using calculate_bit_shift() wifi: rtl8xxxu: Add additional USB IDs for RTL8192EU devices arm64: dts: qcom: msm8998: Fix 'out-ports' is a required property arm64: dts: qcom: msm8996: Fix 'in-ports' is a required property md: Whenassemble the array, consult the superblock of the freshest device block: prevent an integer overflow in bvec_try_merge_hw_page ARM: dts: imx23/28: Fix the DMA controller node name ARM: dts: imx23-sansa: Use preferred i2c-gpios properties ARM: dts: imx27-apf27dev: Fix LED name ARM: dts: imx25/27: Pass timing0 ARM: dts: imx1: Fix sram node ARM: dts: imx27: Fix sram node ARM: dts: imx: Use flash@0,0 pattern ARM: dts: imx25/27-eukrea: Fix RTC node name ARM: dts: rockchip: fix rk3036 hdmi ports node scsi: libfc: Fix up timeout error in fc_fcp_rec_error() scsi: libfc: Don't schedule abort twice bpf: Add map and need_defer parameters to .map_fd_put_ptr() wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() ARM: dts: imx7s: Fix nand-controller #size-cells ARM: dts: imx7s: Fix lcdif compatible ARM: dts: imx7d: Fix coresight funnel ports bonding: return -ENOMEM instead of BUG in alb_upper_dev_walk PCI: Add no PM reset quirk for NVIDIA Spectrum devices scsi: lpfc: Fix possible file string name overflow when updating firmware selftests/bpf: Fix pyperf180 compilation failure with clang18 selftests/bpf: satisfy compiler by having explicit return in btf test wifi: rt2x00: restart beacon queue when hardware reset ext4: avoid online resizing failures due to oversized flex bg ext4: remove unnecessary check from alloc_flex_gd() ext4: unify the type of flexbg_size to unsigned int ext4: fix inconsistent between segment fstrim and full fstrim ecryptfs: Reject casefold directory inodes SUNRPC: Fix a suspicious RCU usage warning KVM: s390: fix setting of fpc register s390/ptrace: handle setting of fpc register correctly jfs: fix array-index-out-of-bounds in diNewExt rxrpc_find_service_conn_rcu: fix the usage of read_seqbegin_or_lock() afs: fix the usage of read_seqbegin_or_lock() in afs_find_server*() crypto: stm32/crc32 - fix parsing list of devices pstore/ram: Fix crash when setting number of cpus to an odd number jfs: fix uaf in jfs_evict_inode jfs: fix array-index-out-of-bounds in dbAdjTree jfs: fix slab-out-of-bounds Read in dtSearch UBSAN: array-index-out-of-bounds in dtSplitRoot FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree ACPI: extlog: fix NULL pointer dereference check PNP: ACPI: fix fortify warning ACPI: video: Add quirk for the Colorful X15 AT 23 Laptop audit: Send netlink ACK before setting connection in auditd_set regulator: core: Only increment use_count when enable_count changes perf/core: Fix narrow startup race when creating the perf nr_addr_filters sysfs file x86/mce: Mark fatal MCE's page as poison to avoid panic in the kdump kernel powerpc/lib: Validate size for vector operations powerpc: pmd_move_must_withdraw() is only needed for CONFIG_TRANSPARENT_HUGEPAGE powerpc/mm: Fix build failures due to arch_reserved_kernel_pages() powerpc: Fix build error due to is_valid_bugaddr() powerpc/mm: Fix null-pointer dereference in pgtable_cache_add x86/entry/ia32: Ensure s32 is sign extended to s64 tick/sched: Preserve number of idle sleeps across CPU hotplug events mips: Call lose_fpu(0) before initializing fcr31 in mips_set_personality_nan spi: bcm-qspi: fix SFDP BFPT read by usig mspi read gpio: eic-sprd: Clear interrupt after set the interrupt type drm/exynos: gsc: minor fix for loop iteration in gsc_runtime_resume drm/exynos: fix accidental on-stack copy of exynos_drm_plane drm/bridge: nxp-ptn3460: simplify some error checking drm/bridge: nxp-ptn3460: fix i2c_master_send() error checking drm: Don't unref the same fb many times by mistake due to deadlock handling gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04 netfilter: nf_tables: reject QUEUE/DROP verdict parameters rbd: don't move requests to the running list on errors btrfs: defrag: reject unknown flags of btrfs_ioctl_defrag_range_args btrfs: don't warn if discard range is not aligned to sector btrfs: tree-checker: fix inline ref size in error messages btrfs: ref-verify: free ref cache before clearing mount opt net: fec: fix the unhandled context fault from smmu fjes: fix memleaks in fjes_hw_setup netfilter: nf_tables: validate NFPROTO_* family netfilter: nf_tables: restrict anonymous set and map names to 16 bytes net/mlx5e: fix a double-free in arfs_create_groups net/mlx5: Use kfree(ft->g) in arfs_create_groups() net/mlx5: DR, Use the right GVMI number for drop action netlink: fix potential sleeping issue in mqueue_flush_file tcp: Add memory barrier to tcp_push() afs: Hide silly-rename files from userspace tracing: Ensure visibility when inserting an element into tracing_map net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv llc: Drop support for ETH_P_TR_802_2. llc: make llc_ui_sendmsg() more robust against bonding changes vlan: skip nested type that is not IFLA_VLAN_QOS_MAPPING net/smc: fix illegal rmb_desc access in SMC-D connection dump x86/CPU/AMD: Fix disabling XSAVES on AMD family 0x17 due to erratum powerpc: Use always instead of always-y in for crtsavres.o fs: move S_ISGID stripping into the vfs_*() helpers fs: add mode_strip_sgid() helper mtd: spinand: macronix: Fix MX35LFxGE4AD page size block: Remove special-casing of compound pages rename(): fix the locking of subdirectories ubifs: ubifs_symlink: Fix memleak of inode->i_link in error path nouveau/vmm: don't set addr on the fail path to avoid warning mmc: core: Use mrq.sbc in close-ended ffu arm64: dts: qcom: sdm845: fix USB wakeup interrupt types parisc/firmware: Fix F-extend for PDC addresses rpmsg: virtio: Free driver_override when rpmsg_remove() hwrng: core - Fix page fault dead lock on mmap-ed hwrng PM: hibernate: Enforce ordering during image compression/decompression crypto: api - Disallow identical driver names ext4: allow for the last group to be marked as trimmed serial: sc16is7xx: add check for unsupported SPI modes during probe spi: introduce SPI_MODE_X_MASK macro serial: sc16is7xx: set safe default SPI clock frequency units: add the HZ macros units: change from 'L' to 'UL' units: Add Watt units include/linux/units.h: add helpers for kelvin to/from Celsius conversion PCI: mediatek: Clear interrupt status before dispatching handler Conflicts: include/linux/timer.h mm/memory-failure.c Change-Id: I4974903c79ecddc3d9225b0b723a30b6c83ef572
1568 lines
37 KiB
C
1568 lines
37 KiB
C
/*
|
|
FUSE: Filesystem in Userspace
|
|
Copyright (C) 2001-2008 Miklos Szeredi <miklos@szeredi.hu>
|
|
|
|
This program can be distributed under the terms of the GNU GPL.
|
|
See the file COPYING.
|
|
*/
|
|
|
|
#include "fuse_i.h"
|
|
|
|
#include <linux/pagemap.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/file.h>
|
|
#include <linux/seq_file.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/moduleparam.h>
|
|
#include <linux/fs_context.h>
|
|
#include <linux/fs_parser.h>
|
|
#include <linux/statfs.h>
|
|
#include <linux/random.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/exportfs.h>
|
|
#include <linux/posix_acl.h>
|
|
#include <linux/pid_namespace.h>
|
|
|
|
MODULE_AUTHOR("Miklos Szeredi <miklos@szeredi.hu>");
|
|
MODULE_DESCRIPTION("Filesystem in Userspace");
|
|
MODULE_LICENSE("GPL");
|
|
|
|
static struct kmem_cache *fuse_inode_cachep;
|
|
struct list_head fuse_conn_list;
|
|
DEFINE_MUTEX(fuse_mutex);
|
|
|
|
static int set_global_limit(const char *val, const struct kernel_param *kp);
|
|
|
|
unsigned max_user_bgreq;
|
|
module_param_call(max_user_bgreq, set_global_limit, param_get_uint,
|
|
&max_user_bgreq, 0644);
|
|
__MODULE_PARM_TYPE(max_user_bgreq, "uint");
|
|
MODULE_PARM_DESC(max_user_bgreq,
|
|
"Global limit for the maximum number of backgrounded requests an "
|
|
"unprivileged user can set");
|
|
|
|
unsigned max_user_congthresh;
|
|
module_param_call(max_user_congthresh, set_global_limit, param_get_uint,
|
|
&max_user_congthresh, 0644);
|
|
__MODULE_PARM_TYPE(max_user_congthresh, "uint");
|
|
MODULE_PARM_DESC(max_user_congthresh,
|
|
"Global limit for the maximum congestion threshold an "
|
|
"unprivileged user can set");
|
|
|
|
#define FUSE_SUPER_MAGIC 0x65735546
|
|
|
|
#define FUSE_DEFAULT_BLKSIZE 512
|
|
|
|
/** Maximum number of outstanding background requests */
|
|
#define FUSE_DEFAULT_MAX_BACKGROUND 12
|
|
|
|
/** Congestion starts at 75% of maximum */
|
|
#define FUSE_DEFAULT_CONGESTION_THRESHOLD (FUSE_DEFAULT_MAX_BACKGROUND * 3 / 4)
|
|
|
|
#ifdef CONFIG_BLOCK
|
|
static struct file_system_type fuseblk_fs_type;
|
|
#endif
|
|
|
|
struct fuse_forget_link *fuse_alloc_forget(void)
|
|
{
|
|
return kzalloc(sizeof(struct fuse_forget_link), GFP_KERNEL_ACCOUNT);
|
|
}
|
|
|
|
static struct inode *fuse_alloc_inode(struct super_block *sb)
|
|
{
|
|
struct fuse_inode *fi;
|
|
|
|
fi = kmem_cache_alloc(fuse_inode_cachep, GFP_KERNEL);
|
|
if (!fi)
|
|
return NULL;
|
|
|
|
fi->i_time = 0;
|
|
fi->inval_mask = 0;
|
|
fi->nodeid = 0;
|
|
fi->nlookup = 0;
|
|
fi->attr_version = 0;
|
|
fi->orig_ino = 0;
|
|
fi->state = 0;
|
|
mutex_init(&fi->mutex);
|
|
spin_lock_init(&fi->lock);
|
|
fi->forget = fuse_alloc_forget();
|
|
if (!fi->forget) {
|
|
kmem_cache_free(fuse_inode_cachep, fi);
|
|
return NULL;
|
|
}
|
|
|
|
return &fi->inode;
|
|
}
|
|
|
|
static void fuse_free_inode(struct inode *inode)
|
|
{
|
|
struct fuse_inode *fi = get_fuse_inode(inode);
|
|
|
|
mutex_destroy(&fi->mutex);
|
|
kfree(fi->forget);
|
|
kmem_cache_free(fuse_inode_cachep, fi);
|
|
}
|
|
|
|
static void fuse_evict_inode(struct inode *inode)
|
|
{
|
|
struct fuse_inode *fi = get_fuse_inode(inode);
|
|
|
|
truncate_inode_pages_final(&inode->i_data);
|
|
clear_inode(inode);
|
|
if (inode->i_sb->s_flags & SB_ACTIVE) {
|
|
struct fuse_conn *fc = get_fuse_conn(inode);
|
|
fuse_queue_forget(fc, fi->forget, fi->nodeid, fi->nlookup);
|
|
fi->forget = NULL;
|
|
}
|
|
if (S_ISREG(inode->i_mode) && !fuse_is_bad(inode)) {
|
|
WARN_ON(!list_empty(&fi->write_files));
|
|
WARN_ON(!list_empty(&fi->queued_writes));
|
|
}
|
|
}
|
|
|
|
static int fuse_reconfigure(struct fs_context *fc)
|
|
{
|
|
struct super_block *sb = fc->root->d_sb;
|
|
|
|
sync_filesystem(sb);
|
|
if (fc->sb_flags & SB_MANDLOCK)
|
|
return -EINVAL;
|
|
|
|
return 0;
|
|
}
|
|
|
|
/*
|
|
* ino_t is 32-bits on 32-bit arch. We have to squash the 64-bit value down
|
|
* so that it will fit.
|
|
*/
|
|
static ino_t fuse_squash_ino(u64 ino64)
|
|
{
|
|
ino_t ino = (ino_t) ino64;
|
|
if (sizeof(ino_t) < sizeof(u64))
|
|
ino ^= ino64 >> (sizeof(u64) - sizeof(ino_t)) * 8;
|
|
return ino;
|
|
}
|
|
|
|
void fuse_change_attributes_common(struct inode *inode, struct fuse_attr *attr,
|
|
u64 attr_valid)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn(inode);
|
|
struct fuse_inode *fi = get_fuse_inode(inode);
|
|
|
|
lockdep_assert_held(&fi->lock);
|
|
|
|
fi->attr_version = atomic64_inc_return(&fc->attr_version);
|
|
fi->i_time = attr_valid;
|
|
WRITE_ONCE(fi->inval_mask, 0);
|
|
|
|
inode->i_ino = fuse_squash_ino(attr->ino);
|
|
inode->i_mode = (inode->i_mode & S_IFMT) | (attr->mode & 07777);
|
|
set_nlink(inode, attr->nlink);
|
|
inode->i_uid = make_kuid(fc->user_ns, attr->uid);
|
|
inode->i_gid = make_kgid(fc->user_ns, attr->gid);
|
|
inode->i_blocks = attr->blocks;
|
|
|
|
/* Sanitize nsecs */
|
|
attr->atimensec = min_t(u32, attr->atimensec, NSEC_PER_SEC - 1);
|
|
attr->mtimensec = min_t(u32, attr->mtimensec, NSEC_PER_SEC - 1);
|
|
attr->ctimensec = min_t(u32, attr->ctimensec, NSEC_PER_SEC - 1);
|
|
|
|
inode->i_atime.tv_sec = attr->atime;
|
|
inode->i_atime.tv_nsec = attr->atimensec;
|
|
/* mtime from server may be stale due to local buffered write */
|
|
if (!fc->writeback_cache || !S_ISREG(inode->i_mode)) {
|
|
inode->i_mtime.tv_sec = attr->mtime;
|
|
inode->i_mtime.tv_nsec = attr->mtimensec;
|
|
inode->i_ctime.tv_sec = attr->ctime;
|
|
inode->i_ctime.tv_nsec = attr->ctimensec;
|
|
}
|
|
|
|
if (attr->blksize != 0)
|
|
inode->i_blkbits = ilog2(attr->blksize);
|
|
else
|
|
inode->i_blkbits = inode->i_sb->s_blocksize_bits;
|
|
|
|
/*
|
|
* Don't set the sticky bit in i_mode, unless we want the VFS
|
|
* to check permissions. This prevents failures due to the
|
|
* check in may_delete().
|
|
*/
|
|
fi->orig_i_mode = inode->i_mode;
|
|
if (!fc->default_permissions)
|
|
inode->i_mode &= ~S_ISVTX;
|
|
|
|
fi->orig_ino = attr->ino;
|
|
}
|
|
|
|
void fuse_change_attributes(struct inode *inode, struct fuse_attr *attr,
|
|
u64 attr_valid, u64 attr_version)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn(inode);
|
|
struct fuse_inode *fi = get_fuse_inode(inode);
|
|
bool is_wb = fc->writeback_cache;
|
|
loff_t oldsize;
|
|
struct timespec64 old_mtime;
|
|
|
|
spin_lock(&fi->lock);
|
|
if ((attr_version != 0 && fi->attr_version > attr_version) ||
|
|
test_bit(FUSE_I_SIZE_UNSTABLE, &fi->state)) {
|
|
spin_unlock(&fi->lock);
|
|
return;
|
|
}
|
|
|
|
old_mtime = inode->i_mtime;
|
|
fuse_change_attributes_common(inode, attr, attr_valid);
|
|
|
|
oldsize = inode->i_size;
|
|
/*
|
|
* In case of writeback_cache enabled, the cached writes beyond EOF
|
|
* extend local i_size without keeping userspace server in sync. So,
|
|
* attr->size coming from server can be stale. We cannot trust it.
|
|
*/
|
|
if (!is_wb || !S_ISREG(inode->i_mode))
|
|
i_size_write(inode, attr->size);
|
|
spin_unlock(&fi->lock);
|
|
|
|
if (!is_wb && S_ISREG(inode->i_mode)) {
|
|
bool inval = false;
|
|
|
|
if (oldsize != attr->size) {
|
|
truncate_pagecache(inode, attr->size);
|
|
if (!fc->explicit_inval_data)
|
|
inval = true;
|
|
} else if (fc->auto_inval_data) {
|
|
struct timespec64 new_mtime = {
|
|
.tv_sec = attr->mtime,
|
|
.tv_nsec = attr->mtimensec,
|
|
};
|
|
|
|
/*
|
|
* Auto inval mode also checks and invalidates if mtime
|
|
* has changed.
|
|
*/
|
|
if (!timespec64_equal(&old_mtime, &new_mtime))
|
|
inval = true;
|
|
}
|
|
|
|
if (inval)
|
|
invalidate_inode_pages2(inode->i_mapping);
|
|
}
|
|
}
|
|
|
|
static void fuse_init_inode(struct inode *inode, struct fuse_attr *attr)
|
|
{
|
|
inode->i_mode = attr->mode & S_IFMT;
|
|
inode->i_size = attr->size;
|
|
inode->i_mtime.tv_sec = attr->mtime;
|
|
inode->i_mtime.tv_nsec = attr->mtimensec;
|
|
inode->i_ctime.tv_sec = attr->ctime;
|
|
inode->i_ctime.tv_nsec = attr->ctimensec;
|
|
if (S_ISREG(inode->i_mode)) {
|
|
fuse_init_common(inode);
|
|
fuse_init_file_inode(inode);
|
|
} else if (S_ISDIR(inode->i_mode))
|
|
fuse_init_dir(inode);
|
|
else if (S_ISLNK(inode->i_mode))
|
|
fuse_init_symlink(inode);
|
|
else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
|
|
S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
|
|
fuse_init_common(inode);
|
|
init_special_inode(inode, inode->i_mode,
|
|
new_decode_dev(attr->rdev));
|
|
} else
|
|
BUG();
|
|
}
|
|
|
|
int fuse_inode_eq(struct inode *inode, void *_nodeidp)
|
|
{
|
|
u64 nodeid = *(u64 *) _nodeidp;
|
|
if (get_node_id(inode) == nodeid)
|
|
return 1;
|
|
else
|
|
return 0;
|
|
}
|
|
|
|
static int fuse_inode_set(struct inode *inode, void *_nodeidp)
|
|
{
|
|
u64 nodeid = *(u64 *) _nodeidp;
|
|
get_fuse_inode(inode)->nodeid = nodeid;
|
|
return 0;
|
|
}
|
|
|
|
struct inode *fuse_iget(struct super_block *sb, u64 nodeid,
|
|
int generation, struct fuse_attr *attr,
|
|
u64 attr_valid, u64 attr_version)
|
|
{
|
|
struct inode *inode;
|
|
struct fuse_inode *fi;
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
|
|
retry:
|
|
inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set, &nodeid);
|
|
if (!inode)
|
|
return NULL;
|
|
|
|
if ((inode->i_state & I_NEW)) {
|
|
inode->i_flags |= S_NOATIME;
|
|
if (!fc->writeback_cache || !S_ISREG(attr->mode))
|
|
inode->i_flags |= S_NOCMTIME;
|
|
inode->i_generation = generation;
|
|
fuse_init_inode(inode, attr);
|
|
unlock_new_inode(inode);
|
|
} else if ((inode->i_mode ^ attr->mode) & S_IFMT) {
|
|
/* Inode has changed type, any I/O on the old should fail */
|
|
fuse_make_bad(inode);
|
|
if (inode != d_inode(sb->s_root)) {
|
|
remove_inode_hash(inode);
|
|
iput(inode);
|
|
goto retry;
|
|
}
|
|
}
|
|
|
|
fi = get_fuse_inode(inode);
|
|
spin_lock(&fi->lock);
|
|
fi->nlookup++;
|
|
spin_unlock(&fi->lock);
|
|
fuse_change_attributes(inode, attr, attr_valid, attr_version);
|
|
|
|
return inode;
|
|
}
|
|
|
|
int fuse_reverse_inval_inode(struct super_block *sb, u64 nodeid,
|
|
loff_t offset, loff_t len)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
struct fuse_inode *fi;
|
|
struct inode *inode;
|
|
pgoff_t pg_start;
|
|
pgoff_t pg_end;
|
|
|
|
inode = ilookup5(sb, nodeid, fuse_inode_eq, &nodeid);
|
|
if (!inode)
|
|
return -ENOENT;
|
|
|
|
fi = get_fuse_inode(inode);
|
|
spin_lock(&fi->lock);
|
|
fi->attr_version = atomic64_inc_return(&fc->attr_version);
|
|
spin_unlock(&fi->lock);
|
|
|
|
fuse_invalidate_attr(inode);
|
|
forget_all_cached_acls(inode);
|
|
if (offset >= 0) {
|
|
pg_start = offset >> PAGE_SHIFT;
|
|
if (len <= 0)
|
|
pg_end = -1;
|
|
else
|
|
pg_end = (offset + len - 1) >> PAGE_SHIFT;
|
|
invalidate_inode_pages2_range(inode->i_mapping,
|
|
pg_start, pg_end);
|
|
}
|
|
iput(inode);
|
|
return 0;
|
|
}
|
|
|
|
bool fuse_lock_inode(struct inode *inode)
|
|
{
|
|
bool locked = false;
|
|
|
|
if (!get_fuse_conn(inode)->parallel_dirops) {
|
|
mutex_lock(&get_fuse_inode(inode)->mutex);
|
|
locked = true;
|
|
}
|
|
|
|
return locked;
|
|
}
|
|
|
|
void fuse_unlock_inode(struct inode *inode, bool locked)
|
|
{
|
|
if (locked)
|
|
mutex_unlock(&get_fuse_inode(inode)->mutex);
|
|
}
|
|
|
|
static void fuse_umount_begin(struct super_block *sb)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
|
|
if (!fc->no_force_umount)
|
|
fuse_abort_conn(fc);
|
|
}
|
|
|
|
static void fuse_send_destroy(struct fuse_conn *fc)
|
|
{
|
|
if (fc->conn_init) {
|
|
FUSE_ARGS(args);
|
|
|
|
args.opcode = FUSE_DESTROY;
|
|
args.force = true;
|
|
args.nocreds = true;
|
|
fuse_simple_request(fc, &args);
|
|
}
|
|
}
|
|
|
|
static void fuse_put_super(struct super_block *sb)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
|
|
mutex_lock(&fuse_mutex);
|
|
list_del(&fc->entry);
|
|
fuse_ctl_remove_conn(fc);
|
|
mutex_unlock(&fuse_mutex);
|
|
|
|
fuse_conn_put(fc);
|
|
}
|
|
|
|
static void convert_fuse_statfs(struct kstatfs *stbuf, struct fuse_kstatfs *attr)
|
|
{
|
|
stbuf->f_type = FUSE_SUPER_MAGIC;
|
|
stbuf->f_bsize = attr->bsize;
|
|
stbuf->f_frsize = attr->frsize;
|
|
stbuf->f_blocks = attr->blocks;
|
|
stbuf->f_bfree = attr->bfree;
|
|
stbuf->f_bavail = attr->bavail;
|
|
stbuf->f_files = attr->files;
|
|
stbuf->f_ffree = attr->ffree;
|
|
stbuf->f_namelen = attr->namelen;
|
|
/* fsid is left zero */
|
|
}
|
|
|
|
static int fuse_statfs(struct dentry *dentry, struct kstatfs *buf)
|
|
{
|
|
struct super_block *sb = dentry->d_sb;
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
FUSE_ARGS(args);
|
|
struct fuse_statfs_out outarg;
|
|
int err;
|
|
|
|
if (!fuse_allow_current_process(fc)) {
|
|
buf->f_type = FUSE_SUPER_MAGIC;
|
|
return 0;
|
|
}
|
|
|
|
memset(&outarg, 0, sizeof(outarg));
|
|
args.in_numargs = 0;
|
|
args.opcode = FUSE_STATFS;
|
|
args.nodeid = get_node_id(d_inode(dentry));
|
|
args.out_numargs = 1;
|
|
args.out_args[0].size = sizeof(outarg);
|
|
args.out_args[0].value = &outarg;
|
|
err = fuse_simple_request(fc, &args);
|
|
if (!err)
|
|
convert_fuse_statfs(buf, &outarg.st);
|
|
return err;
|
|
}
|
|
|
|
enum {
|
|
OPT_SOURCE,
|
|
OPT_SUBTYPE,
|
|
OPT_FD,
|
|
OPT_ROOTMODE,
|
|
OPT_USER_ID,
|
|
OPT_GROUP_ID,
|
|
OPT_DEFAULT_PERMISSIONS,
|
|
OPT_ALLOW_OTHER,
|
|
OPT_MAX_READ,
|
|
OPT_BLKSIZE,
|
|
OPT_ERR
|
|
};
|
|
|
|
static const struct fs_parameter_spec fuse_param_specs[] = {
|
|
fsparam_string ("source", OPT_SOURCE),
|
|
fsparam_u32 ("fd", OPT_FD),
|
|
fsparam_u32oct ("rootmode", OPT_ROOTMODE),
|
|
fsparam_u32 ("user_id", OPT_USER_ID),
|
|
fsparam_u32 ("group_id", OPT_GROUP_ID),
|
|
fsparam_flag ("default_permissions", OPT_DEFAULT_PERMISSIONS),
|
|
fsparam_flag ("allow_other", OPT_ALLOW_OTHER),
|
|
fsparam_u32 ("max_read", OPT_MAX_READ),
|
|
fsparam_u32 ("blksize", OPT_BLKSIZE),
|
|
fsparam_string ("subtype", OPT_SUBTYPE),
|
|
{}
|
|
};
|
|
|
|
static const struct fs_parameter_description fuse_fs_parameters = {
|
|
.name = "fuse",
|
|
.specs = fuse_param_specs,
|
|
};
|
|
|
|
static int fuse_parse_param(struct fs_context *fc, struct fs_parameter *param)
|
|
{
|
|
struct fs_parse_result result;
|
|
struct fuse_fs_context *ctx = fc->fs_private;
|
|
int opt;
|
|
|
|
/*
|
|
* Ignore options coming from mount(MS_REMOUNT) for backward
|
|
* compatibility.
|
|
*/
|
|
if (fc->purpose == FS_CONTEXT_FOR_RECONFIGURE)
|
|
return 0;
|
|
|
|
opt = fs_parse(fc, &fuse_fs_parameters, param, &result);
|
|
if (opt < 0)
|
|
return opt;
|
|
|
|
switch (opt) {
|
|
case OPT_SOURCE:
|
|
if (fc->source)
|
|
return invalf(fc, "fuse: Multiple sources specified");
|
|
fc->source = param->string;
|
|
param->string = NULL;
|
|
break;
|
|
|
|
case OPT_SUBTYPE:
|
|
if (ctx->subtype)
|
|
return invalf(fc, "fuse: Multiple subtypes specified");
|
|
ctx->subtype = param->string;
|
|
param->string = NULL;
|
|
return 0;
|
|
|
|
case OPT_FD:
|
|
ctx->fd = result.uint_32;
|
|
ctx->fd_present = 1;
|
|
break;
|
|
|
|
case OPT_ROOTMODE:
|
|
if (!fuse_valid_type(result.uint_32))
|
|
return invalf(fc, "fuse: Invalid rootmode");
|
|
ctx->rootmode = result.uint_32;
|
|
ctx->rootmode_present = 1;
|
|
break;
|
|
|
|
case OPT_USER_ID:
|
|
ctx->user_id = make_kuid(fc->user_ns, result.uint_32);
|
|
if (!uid_valid(ctx->user_id))
|
|
return invalf(fc, "fuse: Invalid user_id");
|
|
ctx->user_id_present = 1;
|
|
break;
|
|
|
|
case OPT_GROUP_ID:
|
|
ctx->group_id = make_kgid(fc->user_ns, result.uint_32);
|
|
if (!gid_valid(ctx->group_id))
|
|
return invalf(fc, "fuse: Invalid group_id");
|
|
ctx->group_id_present = 1;
|
|
break;
|
|
|
|
case OPT_DEFAULT_PERMISSIONS:
|
|
ctx->default_permissions = 1;
|
|
break;
|
|
|
|
case OPT_ALLOW_OTHER:
|
|
ctx->allow_other = 1;
|
|
break;
|
|
|
|
case OPT_MAX_READ:
|
|
ctx->max_read = result.uint_32;
|
|
break;
|
|
|
|
case OPT_BLKSIZE:
|
|
if (!ctx->is_bdev)
|
|
return invalf(fc, "fuse: blksize only supported for fuseblk");
|
|
ctx->blksize = result.uint_32;
|
|
break;
|
|
|
|
default:
|
|
return -EINVAL;
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void fuse_free_fc(struct fs_context *fc)
|
|
{
|
|
struct fuse_fs_context *ctx = fc->fs_private;
|
|
|
|
if (ctx) {
|
|
kfree(ctx->subtype);
|
|
kfree(ctx);
|
|
}
|
|
}
|
|
|
|
static int fuse_show_options(struct seq_file *m, struct dentry *root)
|
|
{
|
|
struct super_block *sb = root->d_sb;
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
|
|
if (fc->no_mount_options)
|
|
return 0;
|
|
|
|
seq_printf(m, ",user_id=%u", from_kuid_munged(fc->user_ns, fc->user_id));
|
|
seq_printf(m, ",group_id=%u", from_kgid_munged(fc->user_ns, fc->group_id));
|
|
if (fc->default_permissions)
|
|
seq_puts(m, ",default_permissions");
|
|
if (fc->allow_other)
|
|
seq_puts(m, ",allow_other");
|
|
if (fc->max_read != ~0)
|
|
seq_printf(m, ",max_read=%u", fc->max_read);
|
|
if (sb->s_bdev && sb->s_blocksize != FUSE_DEFAULT_BLKSIZE)
|
|
seq_printf(m, ",blksize=%lu", sb->s_blocksize);
|
|
return 0;
|
|
}
|
|
|
|
static void fuse_iqueue_init(struct fuse_iqueue *fiq,
|
|
const struct fuse_iqueue_ops *ops,
|
|
void *priv)
|
|
{
|
|
memset(fiq, 0, sizeof(struct fuse_iqueue));
|
|
spin_lock_init(&fiq->lock);
|
|
init_waitqueue_head(&fiq->waitq);
|
|
INIT_LIST_HEAD(&fiq->pending);
|
|
INIT_LIST_HEAD(&fiq->interrupts);
|
|
fiq->forget_list_tail = &fiq->forget_list_head;
|
|
fiq->connected = 1;
|
|
fiq->ops = ops;
|
|
fiq->priv = priv;
|
|
}
|
|
|
|
static void fuse_pqueue_init(struct fuse_pqueue *fpq)
|
|
{
|
|
unsigned int i;
|
|
|
|
spin_lock_init(&fpq->lock);
|
|
for (i = 0; i < FUSE_PQ_HASH_SIZE; i++)
|
|
INIT_LIST_HEAD(&fpq->processing[i]);
|
|
INIT_LIST_HEAD(&fpq->io);
|
|
fpq->connected = 1;
|
|
}
|
|
|
|
void fuse_conn_init(struct fuse_conn *fc, struct user_namespace *user_ns,
|
|
const struct fuse_iqueue_ops *fiq_ops, void *fiq_priv)
|
|
{
|
|
memset(fc, 0, sizeof(*fc));
|
|
spin_lock_init(&fc->lock);
|
|
spin_lock_init(&fc->bg_lock);
|
|
spin_lock_init(&fc->passthrough_req_lock);
|
|
init_rwsem(&fc->killsb);
|
|
refcount_set(&fc->count, 1);
|
|
atomic_set(&fc->dev_count, 1);
|
|
init_waitqueue_head(&fc->blocked_waitq);
|
|
fuse_iqueue_init(&fc->iq, fiq_ops, fiq_priv);
|
|
INIT_LIST_HEAD(&fc->bg_queue);
|
|
INIT_LIST_HEAD(&fc->entry);
|
|
INIT_LIST_HEAD(&fc->devices);
|
|
idr_init(&fc->passthrough_req);
|
|
atomic_set(&fc->num_waiting, 0);
|
|
fc->max_background = FUSE_DEFAULT_MAX_BACKGROUND;
|
|
fc->congestion_threshold = FUSE_DEFAULT_CONGESTION_THRESHOLD;
|
|
atomic64_set(&fc->khctr, 0);
|
|
fc->polled_files = RB_ROOT;
|
|
fc->blocked = 0;
|
|
fc->initialized = 0;
|
|
fc->connected = 1;
|
|
atomic64_set(&fc->attr_version, 1);
|
|
get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key));
|
|
fc->pid_ns = get_pid_ns(task_active_pid_ns(current));
|
|
fc->user_ns = get_user_ns(user_ns);
|
|
fc->max_pages = FUSE_DEFAULT_MAX_PAGES_PER_REQ;
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_conn_init);
|
|
|
|
void fuse_conn_put(struct fuse_conn *fc)
|
|
{
|
|
if (refcount_dec_and_test(&fc->count)) {
|
|
struct fuse_iqueue *fiq = &fc->iq;
|
|
|
|
if (fiq->ops->release)
|
|
fiq->ops->release(fiq);
|
|
put_pid_ns(fc->pid_ns);
|
|
put_user_ns(fc->user_ns);
|
|
fc->release(fc);
|
|
}
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_conn_put);
|
|
|
|
struct fuse_conn *fuse_conn_get(struct fuse_conn *fc)
|
|
{
|
|
refcount_inc(&fc->count);
|
|
return fc;
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_conn_get);
|
|
|
|
static struct inode *fuse_get_root_inode(struct super_block *sb, unsigned mode)
|
|
{
|
|
struct fuse_attr attr;
|
|
memset(&attr, 0, sizeof(attr));
|
|
|
|
attr.mode = mode;
|
|
attr.ino = FUSE_ROOT_ID;
|
|
attr.nlink = 1;
|
|
return fuse_iget(sb, 1, 0, &attr, 0, 0);
|
|
}
|
|
|
|
struct fuse_inode_handle {
|
|
u64 nodeid;
|
|
u32 generation;
|
|
};
|
|
|
|
static struct dentry *fuse_get_dentry(struct super_block *sb,
|
|
struct fuse_inode_handle *handle)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
struct inode *inode;
|
|
struct dentry *entry;
|
|
int err = -ESTALE;
|
|
|
|
if (handle->nodeid == 0)
|
|
goto out_err;
|
|
|
|
inode = ilookup5(sb, handle->nodeid, fuse_inode_eq, &handle->nodeid);
|
|
if (!inode) {
|
|
struct fuse_entry_out outarg;
|
|
const struct qstr name = QSTR_INIT(".", 1);
|
|
|
|
if (!fc->export_support)
|
|
goto out_err;
|
|
|
|
err = fuse_lookup_name(sb, handle->nodeid, &name, &outarg,
|
|
&inode);
|
|
if (err && err != -ENOENT)
|
|
goto out_err;
|
|
if (err || !inode) {
|
|
err = -ESTALE;
|
|
goto out_err;
|
|
}
|
|
err = -EIO;
|
|
if (get_node_id(inode) != handle->nodeid)
|
|
goto out_iput;
|
|
}
|
|
err = -ESTALE;
|
|
if (inode->i_generation != handle->generation)
|
|
goto out_iput;
|
|
|
|
entry = d_obtain_alias(inode);
|
|
if (!IS_ERR(entry) && get_node_id(inode) != FUSE_ROOT_ID)
|
|
fuse_invalidate_entry_cache(entry);
|
|
|
|
return entry;
|
|
|
|
out_iput:
|
|
iput(inode);
|
|
out_err:
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
static int fuse_encode_fh(struct inode *inode, u32 *fh, int *max_len,
|
|
struct inode *parent)
|
|
{
|
|
int len = parent ? 6 : 3;
|
|
u64 nodeid;
|
|
u32 generation;
|
|
|
|
if (*max_len < len) {
|
|
*max_len = len;
|
|
return FILEID_INVALID;
|
|
}
|
|
|
|
nodeid = get_fuse_inode(inode)->nodeid;
|
|
generation = inode->i_generation;
|
|
|
|
fh[0] = (u32)(nodeid >> 32);
|
|
fh[1] = (u32)(nodeid & 0xffffffff);
|
|
fh[2] = generation;
|
|
|
|
if (parent) {
|
|
nodeid = get_fuse_inode(parent)->nodeid;
|
|
generation = parent->i_generation;
|
|
|
|
fh[3] = (u32)(nodeid >> 32);
|
|
fh[4] = (u32)(nodeid & 0xffffffff);
|
|
fh[5] = generation;
|
|
}
|
|
|
|
*max_len = len;
|
|
return parent ? 0x82 : 0x81;
|
|
}
|
|
|
|
static struct dentry *fuse_fh_to_dentry(struct super_block *sb,
|
|
struct fid *fid, int fh_len, int fh_type)
|
|
{
|
|
struct fuse_inode_handle handle;
|
|
|
|
if ((fh_type != 0x81 && fh_type != 0x82) || fh_len < 3)
|
|
return NULL;
|
|
|
|
handle.nodeid = (u64) fid->raw[0] << 32;
|
|
handle.nodeid |= (u64) fid->raw[1];
|
|
handle.generation = fid->raw[2];
|
|
return fuse_get_dentry(sb, &handle);
|
|
}
|
|
|
|
static struct dentry *fuse_fh_to_parent(struct super_block *sb,
|
|
struct fid *fid, int fh_len, int fh_type)
|
|
{
|
|
struct fuse_inode_handle parent;
|
|
|
|
if (fh_type != 0x82 || fh_len < 6)
|
|
return NULL;
|
|
|
|
parent.nodeid = (u64) fid->raw[3] << 32;
|
|
parent.nodeid |= (u64) fid->raw[4];
|
|
parent.generation = fid->raw[5];
|
|
return fuse_get_dentry(sb, &parent);
|
|
}
|
|
|
|
static struct dentry *fuse_get_parent(struct dentry *child)
|
|
{
|
|
struct inode *child_inode = d_inode(child);
|
|
struct fuse_conn *fc = get_fuse_conn(child_inode);
|
|
struct inode *inode;
|
|
struct dentry *parent;
|
|
struct fuse_entry_out outarg;
|
|
const struct qstr name = QSTR_INIT("..", 2);
|
|
int err;
|
|
|
|
if (!fc->export_support)
|
|
return ERR_PTR(-ESTALE);
|
|
|
|
err = fuse_lookup_name(child_inode->i_sb, get_node_id(child_inode),
|
|
&name, &outarg, &inode);
|
|
if (err) {
|
|
if (err == -ENOENT)
|
|
return ERR_PTR(-ESTALE);
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
parent = d_obtain_alias(inode);
|
|
if (!IS_ERR(parent) && get_node_id(inode) != FUSE_ROOT_ID)
|
|
fuse_invalidate_entry_cache(parent);
|
|
|
|
return parent;
|
|
}
|
|
|
|
static const struct export_operations fuse_export_operations = {
|
|
.fh_to_dentry = fuse_fh_to_dentry,
|
|
.fh_to_parent = fuse_fh_to_parent,
|
|
.encode_fh = fuse_encode_fh,
|
|
.get_parent = fuse_get_parent,
|
|
};
|
|
|
|
static const struct super_operations fuse_super_operations = {
|
|
.alloc_inode = fuse_alloc_inode,
|
|
.free_inode = fuse_free_inode,
|
|
.evict_inode = fuse_evict_inode,
|
|
.write_inode = fuse_write_inode,
|
|
.drop_inode = generic_delete_inode,
|
|
.put_super = fuse_put_super,
|
|
.umount_begin = fuse_umount_begin,
|
|
.statfs = fuse_statfs,
|
|
.show_options = fuse_show_options,
|
|
};
|
|
|
|
static void sanitize_global_limit(unsigned *limit)
|
|
{
|
|
/*
|
|
* The default maximum number of async requests is calculated to consume
|
|
* 1/2^13 of the total memory, assuming 392 bytes per request.
|
|
*/
|
|
if (*limit == 0)
|
|
*limit = ((totalram_pages() << PAGE_SHIFT) >> 13) / 392;
|
|
|
|
if (*limit >= 1 << 16)
|
|
*limit = (1 << 16) - 1;
|
|
}
|
|
|
|
static int set_global_limit(const char *val, const struct kernel_param *kp)
|
|
{
|
|
int rv;
|
|
|
|
rv = param_set_uint(val, kp);
|
|
if (rv)
|
|
return rv;
|
|
|
|
sanitize_global_limit((unsigned *)kp->arg);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static void process_init_limits(struct fuse_conn *fc, struct fuse_init_out *arg)
|
|
{
|
|
int cap_sys_admin = capable(CAP_SYS_ADMIN);
|
|
|
|
if (arg->minor < 13)
|
|
return;
|
|
|
|
sanitize_global_limit(&max_user_bgreq);
|
|
sanitize_global_limit(&max_user_congthresh);
|
|
|
|
spin_lock(&fc->bg_lock);
|
|
if (arg->max_background) {
|
|
fc->max_background = arg->max_background;
|
|
|
|
if (!cap_sys_admin && fc->max_background > max_user_bgreq)
|
|
fc->max_background = max_user_bgreq;
|
|
}
|
|
if (arg->congestion_threshold) {
|
|
fc->congestion_threshold = arg->congestion_threshold;
|
|
|
|
if (!cap_sys_admin &&
|
|
fc->congestion_threshold > max_user_congthresh)
|
|
fc->congestion_threshold = max_user_congthresh;
|
|
}
|
|
spin_unlock(&fc->bg_lock);
|
|
}
|
|
|
|
struct fuse_init_args {
|
|
struct fuse_args args;
|
|
struct fuse_init_in in;
|
|
struct fuse_init_out out;
|
|
};
|
|
|
|
static void process_init_reply(struct fuse_conn *fc, struct fuse_args *args,
|
|
int error)
|
|
{
|
|
struct fuse_init_args *ia = container_of(args, typeof(*ia), args);
|
|
struct fuse_init_out *arg = &ia->out;
|
|
|
|
if (error || arg->major != FUSE_KERNEL_VERSION)
|
|
fc->conn_error = 1;
|
|
else {
|
|
unsigned long ra_pages;
|
|
|
|
process_init_limits(fc, arg);
|
|
|
|
if (arg->minor >= 6) {
|
|
ra_pages = arg->max_readahead / PAGE_SIZE;
|
|
if (arg->flags & FUSE_ASYNC_READ)
|
|
fc->async_read = 1;
|
|
if (!(arg->flags & FUSE_POSIX_LOCKS))
|
|
fc->no_lock = 1;
|
|
if (arg->minor >= 17) {
|
|
if (!(arg->flags & FUSE_FLOCK_LOCKS))
|
|
fc->no_flock = 1;
|
|
} else {
|
|
if (!(arg->flags & FUSE_POSIX_LOCKS))
|
|
fc->no_flock = 1;
|
|
}
|
|
if (arg->flags & FUSE_ATOMIC_O_TRUNC)
|
|
fc->atomic_o_trunc = 1;
|
|
if (arg->minor >= 9) {
|
|
/* LOOKUP has dependency on proto version */
|
|
if (arg->flags & FUSE_EXPORT_SUPPORT)
|
|
fc->export_support = 1;
|
|
}
|
|
if (arg->flags & FUSE_BIG_WRITES)
|
|
fc->big_writes = 1;
|
|
if (arg->flags & FUSE_DONT_MASK)
|
|
fc->dont_mask = 1;
|
|
if (arg->flags & FUSE_AUTO_INVAL_DATA)
|
|
fc->auto_inval_data = 1;
|
|
else if (arg->flags & FUSE_EXPLICIT_INVAL_DATA)
|
|
fc->explicit_inval_data = 1;
|
|
if (arg->flags & FUSE_DO_READDIRPLUS) {
|
|
fc->do_readdirplus = 1;
|
|
if (arg->flags & FUSE_READDIRPLUS_AUTO)
|
|
fc->readdirplus_auto = 1;
|
|
}
|
|
if (arg->flags & FUSE_ASYNC_DIO)
|
|
fc->async_dio = 1;
|
|
if (arg->flags & FUSE_WRITEBACK_CACHE)
|
|
fc->writeback_cache = 1;
|
|
if (arg->flags & FUSE_PARALLEL_DIROPS)
|
|
fc->parallel_dirops = 1;
|
|
if (arg->flags & FUSE_HANDLE_KILLPRIV)
|
|
fc->handle_killpriv = 1;
|
|
if (arg->time_gran && arg->time_gran <= 1000000000)
|
|
fc->sb->s_time_gran = arg->time_gran;
|
|
if ((arg->flags & FUSE_POSIX_ACL)) {
|
|
fc->default_permissions = 1;
|
|
fc->posix_acl = 1;
|
|
fc->sb->s_xattr = fuse_acl_xattr_handlers;
|
|
}
|
|
if (arg->flags & FUSE_CACHE_SYMLINKS)
|
|
fc->cache_symlinks = 1;
|
|
if (arg->flags & FUSE_ABORT_ERROR)
|
|
fc->abort_err = 1;
|
|
if (arg->flags & FUSE_MAX_PAGES) {
|
|
fc->max_pages =
|
|
min_t(unsigned int, FUSE_MAX_MAX_PAGES,
|
|
max_t(unsigned int, arg->max_pages, 1));
|
|
}
|
|
if (arg->flags & FUSE_PASSTHROUGH) {
|
|
fc->passthrough = 1;
|
|
/* Prevent further stacking */
|
|
fc->sb->s_stack_depth =
|
|
FILESYSTEM_MAX_STACK_DEPTH;
|
|
}
|
|
} else {
|
|
ra_pages = fc->max_read / PAGE_SIZE;
|
|
fc->no_lock = 1;
|
|
fc->no_flock = 1;
|
|
}
|
|
|
|
fc->sb->s_bdi->ra_pages =
|
|
min(fc->sb->s_bdi->ra_pages, ra_pages);
|
|
fc->minor = arg->minor;
|
|
fc->max_write = arg->minor < 5 ? 4096 : arg->max_write;
|
|
fc->max_write = max_t(unsigned, 4096, fc->max_write);
|
|
fc->conn_init = 1;
|
|
}
|
|
kfree(ia);
|
|
|
|
fuse_set_initialized(fc);
|
|
wake_up_all(&fc->blocked_waitq);
|
|
}
|
|
|
|
void fuse_send_init(struct fuse_conn *fc)
|
|
{
|
|
struct fuse_init_args *ia;
|
|
|
|
ia = kzalloc(sizeof(*ia), GFP_KERNEL | __GFP_NOFAIL);
|
|
|
|
ia->in.major = FUSE_KERNEL_VERSION;
|
|
ia->in.minor = FUSE_KERNEL_MINOR_VERSION;
|
|
ia->in.max_readahead = fc->sb->s_bdi->ra_pages * PAGE_SIZE;
|
|
ia->in.flags |=
|
|
FUSE_ASYNC_READ | FUSE_POSIX_LOCKS | FUSE_ATOMIC_O_TRUNC |
|
|
FUSE_EXPORT_SUPPORT | FUSE_BIG_WRITES | FUSE_DONT_MASK |
|
|
FUSE_SPLICE_WRITE | FUSE_SPLICE_MOVE | FUSE_SPLICE_READ |
|
|
FUSE_FLOCK_LOCKS | FUSE_HAS_IOCTL_DIR | FUSE_AUTO_INVAL_DATA |
|
|
FUSE_DO_READDIRPLUS | FUSE_READDIRPLUS_AUTO | FUSE_ASYNC_DIO |
|
|
FUSE_WRITEBACK_CACHE | FUSE_NO_OPEN_SUPPORT |
|
|
FUSE_PARALLEL_DIROPS | FUSE_HANDLE_KILLPRIV | FUSE_POSIX_ACL |
|
|
FUSE_ABORT_ERROR | FUSE_MAX_PAGES | FUSE_CACHE_SYMLINKS |
|
|
FUSE_NO_OPENDIR_SUPPORT | FUSE_EXPLICIT_INVAL_DATA |
|
|
FUSE_PASSTHROUGH;
|
|
ia->args.opcode = FUSE_INIT;
|
|
ia->args.in_numargs = 1;
|
|
ia->args.in_args[0].size = sizeof(ia->in);
|
|
ia->args.in_args[0].value = &ia->in;
|
|
ia->args.out_numargs = 1;
|
|
/* Variable length argument used for backward compatibility
|
|
with interface version < 7.5. Rest of init_out is zeroed
|
|
by do_get_request(), so a short reply is not a problem */
|
|
ia->args.out_argvar = 1;
|
|
ia->args.out_args[0].size = sizeof(ia->out);
|
|
ia->args.out_args[0].value = &ia->out;
|
|
ia->args.force = true;
|
|
ia->args.nocreds = true;
|
|
ia->args.end = process_init_reply;
|
|
|
|
if (fuse_simple_background(fc, &ia->args, GFP_KERNEL) != 0)
|
|
process_init_reply(fc, &ia->args, -ENOTCONN);
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_send_init);
|
|
|
|
static int free_fuse_passthrough(int id, void *p, void *data)
|
|
{
|
|
struct fuse_passthrough *passthrough = (struct fuse_passthrough *)p;
|
|
|
|
fuse_passthrough_release(passthrough);
|
|
kfree(p);
|
|
|
|
return 0;
|
|
}
|
|
|
|
void fuse_free_conn(struct fuse_conn *fc)
|
|
{
|
|
WARN_ON(!list_empty(&fc->devices));
|
|
idr_for_each(&fc->passthrough_req, free_fuse_passthrough, NULL);
|
|
idr_destroy(&fc->passthrough_req);
|
|
kfree_rcu(fc, rcu);
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_free_conn);
|
|
|
|
static int fuse_bdi_init(struct fuse_conn *fc, struct super_block *sb)
|
|
{
|
|
int err;
|
|
char *suffix = "";
|
|
|
|
if (sb->s_bdev) {
|
|
suffix = "-fuseblk";
|
|
/*
|
|
* sb->s_bdi points to blkdev's bdi however we want to redirect
|
|
* it to our private bdi...
|
|
*/
|
|
bdi_put(sb->s_bdi);
|
|
sb->s_bdi = &noop_backing_dev_info;
|
|
}
|
|
err = super_setup_bdi_name(sb, "%u:%u%s", MAJOR(fc->dev),
|
|
MINOR(fc->dev), suffix);
|
|
if (err)
|
|
return err;
|
|
|
|
sb->s_bdi->ra_pages = VM_READAHEAD_PAGES;
|
|
/* fuse does it's own writeback accounting */
|
|
sb->s_bdi->capabilities = BDI_CAP_NO_ACCT_WB | BDI_CAP_STRICTLIMIT;
|
|
|
|
/*
|
|
* For a single fuse filesystem use max 1% of dirty +
|
|
* writeback threshold.
|
|
*
|
|
* This gives about 1M of write buffer for memory maps on a
|
|
* machine with 1G and 10% dirty_ratio, which should be more
|
|
* than enough.
|
|
*
|
|
* Privileged users can raise it by writing to
|
|
*
|
|
* /sys/class/bdi/<bdi>/max_ratio
|
|
*/
|
|
bdi_set_max_ratio(sb->s_bdi, 1);
|
|
|
|
return 0;
|
|
}
|
|
|
|
struct fuse_dev *fuse_dev_alloc(void)
|
|
{
|
|
struct fuse_dev *fud;
|
|
struct list_head *pq;
|
|
|
|
fud = kzalloc(sizeof(struct fuse_dev), GFP_KERNEL);
|
|
if (!fud)
|
|
return NULL;
|
|
|
|
pq = kcalloc(FUSE_PQ_HASH_SIZE, sizeof(struct list_head), GFP_KERNEL);
|
|
if (!pq) {
|
|
kfree(fud);
|
|
return NULL;
|
|
}
|
|
|
|
fud->pq.processing = pq;
|
|
fuse_pqueue_init(&fud->pq);
|
|
|
|
return fud;
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_dev_alloc);
|
|
|
|
void fuse_dev_install(struct fuse_dev *fud, struct fuse_conn *fc)
|
|
{
|
|
fud->fc = fuse_conn_get(fc);
|
|
spin_lock(&fc->lock);
|
|
list_add_tail(&fud->entry, &fc->devices);
|
|
spin_unlock(&fc->lock);
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_dev_install);
|
|
|
|
struct fuse_dev *fuse_dev_alloc_install(struct fuse_conn *fc)
|
|
{
|
|
struct fuse_dev *fud;
|
|
|
|
fud = fuse_dev_alloc();
|
|
if (!fud)
|
|
return NULL;
|
|
|
|
fuse_dev_install(fud, fc);
|
|
return fud;
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_dev_alloc_install);
|
|
|
|
void fuse_dev_free(struct fuse_dev *fud)
|
|
{
|
|
struct fuse_conn *fc = fud->fc;
|
|
|
|
if (fc) {
|
|
spin_lock(&fc->lock);
|
|
list_del(&fud->entry);
|
|
spin_unlock(&fc->lock);
|
|
|
|
fuse_conn_put(fc);
|
|
}
|
|
kfree(fud->pq.processing);
|
|
kfree(fud);
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_dev_free);
|
|
|
|
int fuse_fill_super_common(struct super_block *sb, struct fuse_fs_context *ctx)
|
|
{
|
|
struct fuse_dev *fud;
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
struct inode *root;
|
|
struct dentry *root_dentry;
|
|
int err;
|
|
|
|
err = -EINVAL;
|
|
if (sb->s_flags & SB_MANDLOCK)
|
|
goto err;
|
|
|
|
sb->s_flags &= ~(SB_NOSEC | SB_I_VERSION);
|
|
|
|
if (ctx->is_bdev) {
|
|
#ifdef CONFIG_BLOCK
|
|
err = -EINVAL;
|
|
if (!sb_set_blocksize(sb, ctx->blksize))
|
|
goto err;
|
|
#endif
|
|
} else {
|
|
sb->s_blocksize = PAGE_SIZE;
|
|
sb->s_blocksize_bits = PAGE_SHIFT;
|
|
}
|
|
|
|
sb->s_subtype = ctx->subtype;
|
|
ctx->subtype = NULL;
|
|
sb->s_magic = FUSE_SUPER_MAGIC;
|
|
sb->s_op = &fuse_super_operations;
|
|
sb->s_xattr = fuse_xattr_handlers;
|
|
sb->s_maxbytes = MAX_LFS_FILESIZE;
|
|
sb->s_time_gran = 1;
|
|
sb->s_export_op = &fuse_export_operations;
|
|
sb->s_iflags |= SB_I_IMA_UNVERIFIABLE_SIGNATURE;
|
|
if (sb->s_user_ns != &init_user_ns)
|
|
sb->s_iflags |= SB_I_UNTRUSTED_MOUNTER;
|
|
|
|
/*
|
|
* If we are not in the initial user namespace posix
|
|
* acls must be translated.
|
|
*/
|
|
if (sb->s_user_ns != &init_user_ns)
|
|
sb->s_xattr = fuse_no_acl_xattr_handlers;
|
|
|
|
fud = fuse_dev_alloc_install(fc);
|
|
if (!fud)
|
|
goto err;
|
|
|
|
fc->dev = sb->s_dev;
|
|
fc->sb = sb;
|
|
err = fuse_bdi_init(fc, sb);
|
|
if (err)
|
|
goto err_dev_free;
|
|
|
|
/* Handle umasking inside the fuse code */
|
|
if (sb->s_flags & SB_POSIXACL)
|
|
fc->dont_mask = 1;
|
|
sb->s_flags |= SB_POSIXACL;
|
|
|
|
fc->default_permissions = ctx->default_permissions;
|
|
fc->allow_other = ctx->allow_other;
|
|
fc->user_id = ctx->user_id;
|
|
fc->group_id = ctx->group_id;
|
|
fc->max_read = max_t(unsigned, 4096, ctx->max_read);
|
|
fc->destroy = ctx->destroy;
|
|
fc->no_control = ctx->no_control;
|
|
fc->no_force_umount = ctx->no_force_umount;
|
|
fc->no_mount_options = ctx->no_mount_options;
|
|
|
|
err = -ENOMEM;
|
|
root = fuse_get_root_inode(sb, ctx->rootmode);
|
|
sb->s_d_op = &fuse_root_dentry_operations;
|
|
root_dentry = d_make_root(root);
|
|
if (!root_dentry)
|
|
goto err_dev_free;
|
|
/* Root dentry doesn't have .d_revalidate */
|
|
sb->s_d_op = &fuse_dentry_operations;
|
|
|
|
mutex_lock(&fuse_mutex);
|
|
err = -EINVAL;
|
|
if (*ctx->fudptr)
|
|
goto err_unlock;
|
|
|
|
err = fuse_ctl_add_conn(fc);
|
|
if (err)
|
|
goto err_unlock;
|
|
|
|
list_add_tail(&fc->entry, &fuse_conn_list);
|
|
sb->s_root = root_dentry;
|
|
*ctx->fudptr = fud;
|
|
mutex_unlock(&fuse_mutex);
|
|
return 0;
|
|
|
|
err_unlock:
|
|
mutex_unlock(&fuse_mutex);
|
|
dput(root_dentry);
|
|
err_dev_free:
|
|
fuse_dev_free(fud);
|
|
err:
|
|
return err;
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_fill_super_common);
|
|
|
|
static int fuse_fill_super(struct super_block *sb, struct fs_context *fsc)
|
|
{
|
|
struct fuse_fs_context *ctx = fsc->fs_private;
|
|
struct file *file;
|
|
int err;
|
|
struct fuse_conn *fc;
|
|
|
|
err = -EINVAL;
|
|
file = fget(ctx->fd);
|
|
if (!file)
|
|
goto err;
|
|
|
|
/*
|
|
* Require mount to happen from the same user namespace which
|
|
* opened /dev/fuse to prevent potential attacks.
|
|
*/
|
|
if ((file->f_op != &fuse_dev_operations) ||
|
|
(file->f_cred->user_ns != sb->s_user_ns))
|
|
goto err_fput;
|
|
ctx->fudptr = &file->private_data;
|
|
|
|
fc = kmalloc(sizeof(*fc), GFP_KERNEL);
|
|
err = -ENOMEM;
|
|
if (!fc)
|
|
goto err_fput;
|
|
|
|
fuse_conn_init(fc, sb->s_user_ns, &fuse_dev_fiq_ops, NULL);
|
|
fc->release = fuse_free_conn;
|
|
sb->s_fs_info = fc;
|
|
|
|
err = fuse_fill_super_common(sb, ctx);
|
|
if (err)
|
|
goto err_put_conn;
|
|
/*
|
|
* atomic_dec_and_test() in fput() provides the necessary
|
|
* memory barrier for file->private_data to be visible on all
|
|
* CPUs after this
|
|
*/
|
|
fput(file);
|
|
fuse_send_init(get_fuse_conn_super(sb));
|
|
return 0;
|
|
|
|
err_put_conn:
|
|
fuse_conn_put(fc);
|
|
sb->s_fs_info = NULL;
|
|
err_fput:
|
|
fput(file);
|
|
err:
|
|
return err;
|
|
}
|
|
|
|
static int fuse_get_tree(struct fs_context *fc)
|
|
{
|
|
struct fuse_fs_context *ctx = fc->fs_private;
|
|
|
|
if (!ctx->fd_present || !ctx->rootmode_present ||
|
|
!ctx->user_id_present || !ctx->group_id_present)
|
|
return -EINVAL;
|
|
|
|
#ifdef CONFIG_BLOCK
|
|
if (ctx->is_bdev)
|
|
return get_tree_bdev(fc, fuse_fill_super);
|
|
#endif
|
|
|
|
return get_tree_nodev(fc, fuse_fill_super);
|
|
}
|
|
|
|
static const struct fs_context_operations fuse_context_ops = {
|
|
.free = fuse_free_fc,
|
|
.parse_param = fuse_parse_param,
|
|
.reconfigure = fuse_reconfigure,
|
|
.get_tree = fuse_get_tree,
|
|
};
|
|
|
|
/*
|
|
* Set up the filesystem mount context.
|
|
*/
|
|
static int fuse_init_fs_context(struct fs_context *fc)
|
|
{
|
|
struct fuse_fs_context *ctx;
|
|
|
|
ctx = kzalloc(sizeof(struct fuse_fs_context), GFP_KERNEL);
|
|
if (!ctx)
|
|
return -ENOMEM;
|
|
|
|
ctx->max_read = ~0;
|
|
ctx->blksize = FUSE_DEFAULT_BLKSIZE;
|
|
|
|
#ifdef CONFIG_BLOCK
|
|
if (fc->fs_type == &fuseblk_fs_type) {
|
|
ctx->is_bdev = true;
|
|
ctx->destroy = true;
|
|
}
|
|
#endif
|
|
|
|
fc->fs_private = ctx;
|
|
fc->ops = &fuse_context_ops;
|
|
return 0;
|
|
}
|
|
|
|
static void fuse_sb_destroy(struct super_block *sb)
|
|
{
|
|
struct fuse_conn *fc = get_fuse_conn_super(sb);
|
|
|
|
if (fc) {
|
|
if (fc->destroy)
|
|
fuse_send_destroy(fc);
|
|
|
|
fuse_abort_conn(fc);
|
|
fuse_wait_aborted(fc);
|
|
|
|
down_write(&fc->killsb);
|
|
fc->sb = NULL;
|
|
up_write(&fc->killsb);
|
|
}
|
|
}
|
|
|
|
void fuse_kill_sb_anon(struct super_block *sb)
|
|
{
|
|
fuse_sb_destroy(sb);
|
|
kill_anon_super(sb);
|
|
}
|
|
EXPORT_SYMBOL_GPL(fuse_kill_sb_anon);
|
|
|
|
static struct file_system_type fuse_fs_type = {
|
|
.owner = THIS_MODULE,
|
|
.name = "fuse",
|
|
.fs_flags = FS_HAS_SUBTYPE | FS_USERNS_MOUNT,
|
|
.init_fs_context = fuse_init_fs_context,
|
|
.parameters = &fuse_fs_parameters,
|
|
.kill_sb = fuse_kill_sb_anon,
|
|
};
|
|
MODULE_ALIAS_FS("fuse");
|
|
|
|
#ifdef CONFIG_BLOCK
|
|
static void fuse_kill_sb_blk(struct super_block *sb)
|
|
{
|
|
fuse_sb_destroy(sb);
|
|
kill_block_super(sb);
|
|
}
|
|
|
|
static struct file_system_type fuseblk_fs_type = {
|
|
.owner = THIS_MODULE,
|
|
.name = "fuseblk",
|
|
.init_fs_context = fuse_init_fs_context,
|
|
.parameters = &fuse_fs_parameters,
|
|
.kill_sb = fuse_kill_sb_blk,
|
|
.fs_flags = FS_REQUIRES_DEV | FS_HAS_SUBTYPE,
|
|
};
|
|
MODULE_ALIAS_FS("fuseblk");
|
|
|
|
static inline int register_fuseblk(void)
|
|
{
|
|
return register_filesystem(&fuseblk_fs_type);
|
|
}
|
|
|
|
static inline void unregister_fuseblk(void)
|
|
{
|
|
unregister_filesystem(&fuseblk_fs_type);
|
|
}
|
|
#else
|
|
static inline int register_fuseblk(void)
|
|
{
|
|
return 0;
|
|
}
|
|
|
|
static inline void unregister_fuseblk(void)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
static void fuse_inode_init_once(void *foo)
|
|
{
|
|
struct inode *inode = foo;
|
|
|
|
inode_init_once(inode);
|
|
}
|
|
|
|
static int __init fuse_fs_init(void)
|
|
{
|
|
int err;
|
|
|
|
fuse_inode_cachep = kmem_cache_create("fuse_inode",
|
|
sizeof(struct fuse_inode), 0,
|
|
SLAB_HWCACHE_ALIGN|SLAB_ACCOUNT|SLAB_RECLAIM_ACCOUNT,
|
|
fuse_inode_init_once);
|
|
err = -ENOMEM;
|
|
if (!fuse_inode_cachep)
|
|
goto out;
|
|
|
|
err = register_fuseblk();
|
|
if (err)
|
|
goto out2;
|
|
|
|
err = register_filesystem(&fuse_fs_type);
|
|
if (err)
|
|
goto out3;
|
|
|
|
return 0;
|
|
|
|
out3:
|
|
unregister_fuseblk();
|
|
out2:
|
|
kmem_cache_destroy(fuse_inode_cachep);
|
|
out:
|
|
return err;
|
|
}
|
|
|
|
static void fuse_fs_cleanup(void)
|
|
{
|
|
unregister_filesystem(&fuse_fs_type);
|
|
unregister_fuseblk();
|
|
|
|
/*
|
|
* Make sure all delayed rcu free inodes are flushed before we
|
|
* destroy cache.
|
|
*/
|
|
rcu_barrier();
|
|
kmem_cache_destroy(fuse_inode_cachep);
|
|
}
|
|
|
|
static struct kobject *fuse_kobj;
|
|
|
|
static int fuse_sysfs_init(void)
|
|
{
|
|
int err;
|
|
|
|
fuse_kobj = kobject_create_and_add("fuse", fs_kobj);
|
|
if (!fuse_kobj) {
|
|
err = -ENOMEM;
|
|
goto out_err;
|
|
}
|
|
|
|
err = sysfs_create_mount_point(fuse_kobj, "connections");
|
|
if (err)
|
|
goto out_fuse_unregister;
|
|
|
|
return 0;
|
|
|
|
out_fuse_unregister:
|
|
kobject_put(fuse_kobj);
|
|
out_err:
|
|
return err;
|
|
}
|
|
|
|
static void fuse_sysfs_cleanup(void)
|
|
{
|
|
sysfs_remove_mount_point(fuse_kobj, "connections");
|
|
kobject_put(fuse_kobj);
|
|
}
|
|
|
|
static int __init fuse_init(void)
|
|
{
|
|
int res;
|
|
|
|
pr_info("init (API version %i.%i)\n",
|
|
FUSE_KERNEL_VERSION, FUSE_KERNEL_MINOR_VERSION);
|
|
|
|
INIT_LIST_HEAD(&fuse_conn_list);
|
|
res = fuse_fs_init();
|
|
if (res)
|
|
goto err;
|
|
|
|
res = fuse_dev_init();
|
|
if (res)
|
|
goto err_fs_cleanup;
|
|
|
|
res = fuse_sysfs_init();
|
|
if (res)
|
|
goto err_dev_cleanup;
|
|
|
|
res = fuse_ctl_init();
|
|
if (res)
|
|
goto err_sysfs_cleanup;
|
|
|
|
sanitize_global_limit(&max_user_bgreq);
|
|
sanitize_global_limit(&max_user_congthresh);
|
|
|
|
return 0;
|
|
|
|
err_sysfs_cleanup:
|
|
fuse_sysfs_cleanup();
|
|
err_dev_cleanup:
|
|
fuse_dev_cleanup();
|
|
err_fs_cleanup:
|
|
fuse_fs_cleanup();
|
|
err:
|
|
return res;
|
|
}
|
|
|
|
static void __exit fuse_exit(void)
|
|
{
|
|
pr_debug("exit\n");
|
|
|
|
fuse_ctl_cleanup();
|
|
fuse_sysfs_cleanup();
|
|
fuse_fs_cleanup();
|
|
fuse_dev_cleanup();
|
|
}
|
|
|
|
module_init(fuse_init);
|
|
module_exit(fuse_exit);
|