kill-the-bkl/reiserfs: always lock the ioctl path
[safe/jmp/linux-2.6] / fs / reiserfs / ioctl.c
index a986b5e..e30e8be 100644 (file)
 
 #include <linux/capability.h>
 #include <linux/fs.h>
+#include <linux/mount.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/time.h>
 #include <asm/uaccess.h>
 #include <linux/pagemap.h>
 #include <linux/smp_lock.h>
-
-static int reiserfs_unpack(struct inode *inode, struct file *filp);
+#include <linux/compat.h>
 
 /*
-** reiserfs_ioctl - handler for ioctl for inode
-** supported commands:
-**  1) REISERFS_IOC_UNPACK - try to unpack tail from direct item into indirect
-**                           and prevent packing file (argument arg has to be non-zero)
-**  2) REISERFS_IOC_[GS]ETFLAGS, REISERFS_IOC_[GS]ETVERSION
-**  3) That's all for a while ...
-*/
+ * reiserfs_ioctl - handler for ioctl for inode
+ * supported commands:
+ *  1) REISERFS_IOC_UNPACK - try to unpack tail from direct item into indirect
+ *                           and prevent packing file (argument arg has to be non-zero)
+ *  2) REISERFS_IOC_[GS]ETFLAGS, REISERFS_IOC_[GS]ETVERSION
+ *  3) That's all for a while ...
+ */
 int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
                   unsigned long arg)
 {
        unsigned int flags;
+       int err = 0;
+
+       reiserfs_write_lock(inode->i_sb);
 
        switch (cmd) {
        case REISERFS_IOC_UNPACK:
                if (S_ISREG(inode->i_mode)) {
                        if (arg)
-                               return reiserfs_unpack(inode, filp);
-                       else
-                               return 0;
+                               err = reiserfs_unpack(inode, filp);
                } else
-                       return -ENOTTY;
-               /* following two cases are taken from fs/ext2/ioctl.c by Remy
-                  Card (card@masi.ibp.fr) */
+                       err = -ENOTTY;
+               break;
+               /*
+                * following two cases are taken from fs/ext2/ioctl.c by Remy
+                * Card (card@masi.ibp.fr)
+                */
        case REISERFS_IOC_GETFLAGS:
-               if (!reiserfs_attrs(inode->i_sb))
-                       return -ENOTTY;
+               if (!reiserfs_attrs(inode->i_sb)) {
+                       err = -ENOTTY;
+                       break;
+               }
 
                flags = REISERFS_I(inode)->i_attrs;
                i_attrs_to_sd_attrs(inode, (__u16 *) & flags);
-               return put_user(flags, (int __user *)arg);
+               err = put_user(flags, (int __user *)arg);
+               break;
        case REISERFS_IOC_SETFLAGS:{
-                       if (!reiserfs_attrs(inode->i_sb))
-                               return -ENOTTY;
-
-                       if (IS_RDONLY(inode))
-                               return -EROFS;
-
-                       if ((current->fsuid != inode->i_uid)
-                           && !capable(CAP_FOWNER))
-                               return -EPERM;
+                       if (!reiserfs_attrs(inode->i_sb)) {
+                               err = -ENOTTY;
+                               break;
+                       }
 
-                       if (get_user(flags, (int __user *)arg))
-                               return -EFAULT;
+                       err = mnt_want_write(filp->f_path.mnt);
+                       if (err)
+                               break;
 
+                       if (!is_owner_or_cap(inode)) {
+                               err = -EPERM;
+                               goto setflags_out;
+                       }
+                       if (get_user(flags, (int __user *)arg)) {
+                               err = -EFAULT;
+                               goto setflags_out;
+                       }
+                       /*
+                        * Is it quota file? Do not allow user to mess with it
+                        */
+                       if (IS_NOQUOTA(inode)) {
+                               err = -EPERM;
+                               goto setflags_out;
+                       }
                        if (((flags ^ REISERFS_I(inode)->
                              i_attrs) & (REISERFS_IMMUTABLE_FL |
                                          REISERFS_APPEND_FL))
-                           && !capable(CAP_LINUX_IMMUTABLE))
-                               return -EPERM;
-
+                           && !capable(CAP_LINUX_IMMUTABLE)) {
+                               err = -EPERM;
+                               goto setflags_out;
+                       }
                        if ((flags & REISERFS_NOTAIL_FL) &&
                            S_ISREG(inode->i_mode)) {
                                int result;
 
                                result = reiserfs_unpack(inode, filp);
-                               if (result)
-                                       return result;
+                               if (result) {
+                                       err = result;
+                                       goto setflags_out;
+                               }
                        }
                        sd_attrs_to_i_attrs(flags, inode);
                        REISERFS_I(inode)->i_attrs = flags;
                        inode->i_ctime = CURRENT_TIME_SEC;
                        mark_inode_dirty(inode);
-                       return 0;
+setflags_out:
+                       mnt_drop_write(filp->f_path.mnt);
+                       break;
                }
        case REISERFS_IOC_GETVERSION:
-               return put_user(inode->i_generation, (int __user *)arg);
+               err = put_user(inode->i_generation, (int __user *)arg);
+               break;
        case REISERFS_IOC_SETVERSION:
-               if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
-                       return -EPERM;
-               if (IS_RDONLY(inode))
-                       return -EROFS;
-               if (get_user(inode->i_generation, (int __user *)arg))
-                       return -EFAULT;
+               if (!is_owner_or_cap(inode))
+                       err = -EPERM;
+                       break;
+               err = mnt_want_write(filp->f_path.mnt);
+               if (err)
+                       break;
+               if (get_user(inode->i_generation, (int __user *)arg)) {
+                       err = -EFAULT;
+                       goto setversion_out;
+               }
                inode->i_ctime = CURRENT_TIME_SEC;
                mark_inode_dirty(inode);
-               return 0;
+setversion_out:
+               mnt_drop_write(filp->f_path.mnt);
+               break;
+       default:
+               err = -ENOTTY;
+       }
+
+       reiserfs_write_unlock(inode->i_sb);
+
+       return err;
+}
+
+#ifdef CONFIG_COMPAT
+long reiserfs_compat_ioctl(struct file *file, unsigned int cmd,
+                               unsigned long arg)
+{
+       struct inode *inode = file->f_path.dentry->d_inode;
+       int ret;
+
+       /* These are just misnamed, they actually get/put from/to user an int */
+       switch (cmd) {
+       case REISERFS_IOC32_UNPACK:
+               cmd = REISERFS_IOC_UNPACK;
+               break;
+       case REISERFS_IOC32_GETFLAGS:
+               cmd = REISERFS_IOC_GETFLAGS;
+               break;
+       case REISERFS_IOC32_SETFLAGS:
+               cmd = REISERFS_IOC_SETFLAGS;
+               break;
+       case REISERFS_IOC32_GETVERSION:
+               cmd = REISERFS_IOC_GETVERSION;
+               break;
+       case REISERFS_IOC32_SETVERSION:
+               cmd = REISERFS_IOC_SETVERSION;
+               break;
        default:
-               return -ENOTTY;
+               return -ENOIOCTLCMD;
        }
+
+       ret = reiserfs_ioctl(inode, file, cmd, (unsigned long) compat_ptr(arg));
+
+       return ret;
 }
+#endif
 
+int reiserfs_commit_write(struct file *f, struct page *page,
+                         unsigned from, unsigned to);
+int reiserfs_prepare_write(struct file *f, struct page *page,
+                          unsigned from, unsigned to);
 /*
 ** reiserfs_unpack
 ** Function try to convert tail from direct item into indirect.
 ** It set up nopack attribute in the REISERFS_I(inode)->nopack
 */
-static int reiserfs_unpack(struct inode *inode, struct file *filp)
+int reiserfs_unpack(struct inode *inode, struct file *filp)
 {
        int retval = 0;
        int index;
@@ -131,7 +203,7 @@ static int reiserfs_unpack(struct inode *inode, struct file *filp)
        }
 
        /* we unpack by finding the page with the tail, and calling
-        ** reiserfs_prepare_write on that page.  This will force a 
+        ** reiserfs_prepare_write on that page.  This will force a
         ** reiserfs_get_block to unpack the tail for us.
         */
        index = inode->i_size >> PAGE_CACHE_SHIFT;
@@ -141,15 +213,13 @@ static int reiserfs_unpack(struct inode *inode, struct file *filp)
        if (!page) {
                goto out;
        }
-       retval =
-           mapping->a_ops->prepare_write(NULL, page, write_from, write_from);
+       retval = reiserfs_prepare_write(NULL, page, write_from, write_from);
        if (retval)
                goto out_unlock;
 
        /* conversion can change page contents, must flush */
        flush_dcache_page(page);
-       retval =
-           mapping->a_ops->commit_write(NULL, page, write_from, write_from);
+       retval = reiserfs_commit_write(NULL, page, write_from, write_from);
        REISERFS_I(inode)->i_flags |= i_nopack_mask;
 
       out_unlock: