]> www.pilppa.org Git - linux-2.6-omap-h63xx.git/blobdiff - fs/autofs4/waitq.c
autofs4: detect invalid direct mount requests
[linux-2.6-omap-h63xx.git] / fs / autofs4 / waitq.c
index 5208cfb1df4e5f9c134a1bfad60aaf404befe38f..bcb6c5265467f4306721848e7076b327f0151aa2 100644 (file)
@@ -28,6 +28,12 @@ void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
 {
        struct autofs_wait_queue *wq, *nwq;
 
+       mutex_lock(&sbi->wq_mutex);
+       if (sbi->catatonic) {
+               mutex_unlock(&sbi->wq_mutex);
+               return;
+       }
+
        DPRINTK("entering catatonic mode");
 
        sbi->catatonic = 1;
@@ -40,11 +46,14 @@ void autofs4_catatonic_mode(struct autofs_sb_info *sbi)
                        kfree(wq->name.name);
                        wq->name.name = NULL;
                }
+               wq->wait_ctr--;
                wake_up_interruptible(&wq->queue);
                wq = nwq;
        }
        fput(sbi->pipe);        /* Close the pipe */
        sbi->pipe = NULL;
+       sbi->pipefd = -1;
+       mutex_unlock(&sbi->wq_mutex);
 }
 
 static int autofs4_write(struct file *file, const void *addr, int bytes)
@@ -91,6 +100,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                union autofs_packet_union v4_pkt;
                union autofs_v5_packet_union v5_pkt;
        } pkt;
+       struct file *pipe = NULL;
        size_t pktsz;
 
        DPRINTK("wait id = 0x%08lx, name = %.*s, type=%d",
@@ -156,8 +166,19 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi,
                return;
        }
 
-       if (autofs4_write(sbi->pipe, &pkt, pktsz))
-               autofs4_catatonic_mode(sbi);
+       /* Check if we have become catatonic */
+       mutex_lock(&sbi->wq_mutex);
+       if (!sbi->catatonic) {
+               pipe = sbi->pipe;
+               get_file(pipe);
+       }
+       mutex_unlock(&sbi->wq_mutex);
+
+       if (pipe) {
+               if (autofs4_write(pipe, &pkt, pktsz))
+                       autofs4_catatonic_mode(sbi);
+               fput(pipe);
+       }
 }
 
 static int autofs4_getpath(struct autofs_sb_info *sbi,
@@ -207,19 +228,110 @@ autofs4_find_wait(struct autofs_sb_info *sbi, struct qstr *qstr)
        return wq;
 }
 
+/*
+ * Check if we have a valid request.
+ * Returns
+ * 1 if the request should continue.
+ *   In this case we can return an autofs_wait_queue entry if one is
+ *   found or NULL to idicate a new wait needs to be created.
+ * 0 or a negative errno if the request shouldn't continue.
+ */
+static int validate_request(struct autofs_wait_queue **wait,
+                           struct autofs_sb_info *sbi,
+                           struct qstr *qstr,
+                           struct dentry*dentry, enum autofs_notify notify)
+{
+       struct autofs_wait_queue *wq;
+       struct autofs_info *ino;
+
+       /* Wait in progress, continue; */
+       wq = autofs4_find_wait(sbi, qstr);
+       if (wq) {
+               *wait = wq;
+               return 1;
+       }
+
+       *wait = NULL;
+
+       /* If we don't yet have any info this is a new request */
+       ino = autofs4_dentry_ino(dentry);
+       if (!ino)
+               return 1;
+
+       /*
+        * If we've been asked to wait on an existing expire (NFY_NONE)
+        * but there is no wait in the queue ...
+        */
+       if (notify == NFY_NONE) {
+               /*
+                * Either we've betean the pending expire to post it's
+                * wait or it finished while we waited on the mutex.
+                * So we need to wait till either, the wait appears
+                * or the expire finishes.
+                */
+
+               while (ino->flags & AUTOFS_INF_EXPIRING) {
+                       mutex_unlock(&sbi->wq_mutex);
+                       schedule_timeout_interruptible(HZ/10);
+                       if (mutex_lock_interruptible(&sbi->wq_mutex))
+                               return -EINTR;
+
+                       wq = autofs4_find_wait(sbi, qstr);
+                       if (wq) {
+                               *wait = wq;
+                               return 1;
+                       }
+               }
+
+               /*
+                * Not ideal but the status has already gone. Of the two
+                * cases where we wait on NFY_NONE neither depend on the
+                * return status of the wait.
+                */
+               return 0;
+       }
+
+       /*
+        * If we've been asked to trigger a mount and the request
+        * completed while we waited on the mutex ...
+        */
+       if (notify == NFY_MOUNT) {
+               /*
+                * If the dentry isn't hashed just go ahead and try the
+                * mount again with a new wait (not much else we can do).
+               */
+               if (!d_unhashed(dentry)) {
+                       /*
+                        * But if the dentry is hashed, that means that we
+                        * got here through the revalidate path.  Thus, we
+                        * need to check if the dentry has been mounted
+                        * while we waited on the wq_mutex. If it has,
+                        * simply return success.
+                        */
+                       if (d_mountpoint(dentry))
+                               return 0;
+               }
+       }
+
+       return 1;
+}
+
 int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                enum autofs_notify notify)
 {
-       struct autofs_info *ino;
        struct autofs_wait_queue *wq;
        struct qstr qstr;
        char *name;
-       int status, type;
+       int status, ret, type;
 
        /* In catatonic mode, we don't wait for nobody */
        if (sbi->catatonic)
                return -ENOENT;
-       
+
+       if (!dentry->d_inode &&
+           (sbi->type & (AUTOFS_TYPE_DIRECT | AUTOFS_TYPE_OFFSET)))
+               return -ENOENT;
+
        name = kmalloc(NAME_MAX + 1, GFP_KERNEL);
        if (!name)
                return -ENOMEM;
@@ -242,38 +354,12 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                return -EINTR;
        }
 
-       wq = autofs4_find_wait(sbi, &qstr);
-       ino = autofs4_dentry_ino(dentry);
-       if (!wq && ino && notify == NFY_NONE) {
-               /*
-                * Either we've betean the pending expire to post it's
-                * wait or it finished while we waited on the mutex.
-                * So we need to wait till either, the wait appears
-                * or the expire finishes.
-                */
-
-               while (ino->flags & AUTOFS_INF_EXPIRING) {
-                       mutex_unlock(&sbi->wq_mutex);
-                       schedule_timeout_interruptible(HZ/10);
-                       if (mutex_lock_interruptible(&sbi->wq_mutex)) {
-                               kfree(qstr.name);
-                               return -EINTR;
-                       }
-                       wq = autofs4_find_wait(sbi, &qstr);
-                       if (wq)
-                               break;
-               }
-
-               /*
-                * Not ideal but the status has already gone. Of the two
-                * cases where we wait on NFY_NONE neither depend on the
-                * return status of the wait.
-                */
-               if (!wq) {
-                       kfree(qstr.name);
+       ret = validate_request(&wq, sbi, &qstr, dentry, notify);
+       if (ret <= 0) {
+               if (ret == 0)
                        mutex_unlock(&sbi->wq_mutex);
-                       return 0;
-               }
+               kfree(qstr.name);
+               return ret;
        }
 
        if (!wq) {
@@ -299,7 +385,7 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                wq->pid = current->pid;
                wq->tgid = current->tgid;
                wq->status = -EINTR; /* Status return if interrupted */
-               atomic_set(&wq->wait_ctr, 2);
+               wq->wait_ctr = 2;
                mutex_unlock(&sbi->wq_mutex);
 
                if (sbi->version < 5) {
@@ -325,7 +411,7 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                /* autofs4_notify_daemon() may block */
                autofs4_notify_daemon(sbi, wq, type);
        } else {
-               atomic_inc(&wq->wait_ctr);
+               wq->wait_ctr++;
                mutex_unlock(&sbi->wq_mutex);
                kfree(qstr.name);
                DPRINTK("existing wait id = 0x%08lx, name = %.*s, nfy=%d",
@@ -333,17 +419,10 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
                        wq->name.name, notify);
        }
 
-       /* wq->name is NULL if and only if the lock is already released */
-
-       if (sbi->catatonic) {
-               /* We might have slept, so check again for catatonic mode */
-               wq->status = -ENOENT;
-               if (wq->name.name) {
-                       kfree(wq->name.name);
-                       wq->name.name = NULL;
-               }
-       }
-
+       /*
+        * wq->name.name is NULL iff the lock is already released
+        * or the mount has been made catatonic.
+        */
        if (wq->name.name) {
                /* Block all but "shutdown" signals while waiting */
                sigset_t oldset;
@@ -368,8 +447,10 @@ int autofs4_wait(struct autofs_sb_info *sbi, struct dentry *dentry,
        status = wq->status;
 
        /* Are we the last process to need status? */
-       if (atomic_dec_and_test(&wq->wait_ctr))
+       mutex_lock(&sbi->wq_mutex);
+       if (!--wq->wait_ctr)
                kfree(wq);
+       mutex_unlock(&sbi->wq_mutex);
 
        return status;
 }
@@ -391,16 +472,13 @@ int autofs4_wait_release(struct autofs_sb_info *sbi, autofs_wqt_t wait_queue_tok
        }
 
        *wql = wq->next;        /* Unlink from chain */
-       mutex_unlock(&sbi->wq_mutex);
        kfree(wq->name.name);
        wq->name.name = NULL;   /* Do not wait on this queue */
-
        wq->status = status;
-
-       if (atomic_dec_and_test(&wq->wait_ctr)) /* Is anyone still waiting for this guy? */
+       wake_up_interruptible(&wq->queue);
+       if (!--wq->wait_ctr)
                kfree(wq);
-       else
-               wake_up_interruptible(&wq->queue);
+       mutex_unlock(&sbi->wq_mutex);
 
        return 0;
 }