[PATCH] r/o bind mounts: elevate write count for do_utimes()

Now includes fix for oops seen by akpm.

"never let a libc developer write your kernel code" - hch

"nor, apparently, a kernel developer" - akpm

Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Cc: Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
Cc: Balbir Singh <balbir@in.ibm.com>
Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/utimes.c b/fs/utimes.c
index b18da9c..a2bef77 100644 (file)
--- a/fs/utimes.c
+++ b/fs/utimes.c
@@ -2,6 +2,7 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/linkage.h>
+#include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/sched.h>
 #include <linux/stat.h>
@@ -59,6 +60,7 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        struct inode *inode;
        struct iattr newattrs;
        struct file *f = NULL;
+       struct vfsmount *mnt;
 
        error = -EINVAL;
        if (times && (!nsec_valid(times[0].tv_nsec) ||
@@ -79,18 +81,20 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
                if (!f)
                        goto out;
                dentry = f->f_path.dentry;
+               mnt = f->f_path.mnt;
        } else {
                error = __user_walk_fd(dfd, filename, (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW, &nd);
                if (error)
                        goto out;
 
                dentry = nd.path.dentry;
+               mnt = nd.path.mnt;
        }
 
        inode = dentry->d_inode;
 
-       error = -EROFS;
-       if (IS_RDONLY(inode))
+       error = mnt_want_write(mnt);
+       if (error)
                goto dput_and_out;
 
        /* Don't worry, the checks are done in inode_change_ok() */
@@ -98,7 +102,7 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        if (times) {
                error = -EPERM;
                 if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
-                        goto dput_and_out;
+                       goto mnt_drop_write_and_out;
 
                if (times[0].tv_nsec == UTIME_OMIT)
                        newattrs.ia_valid &= ~ATTR_ATIME;
@@ -118,22 +122,24 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
        } else {
                error = -EACCES;
                 if (IS_IMMUTABLE(inode))
-                        goto dput_and_out;
+                       goto mnt_drop_write_and_out;
 
                if (!is_owner_or_cap(inode)) {
                        if (f) {
                                if (!(f->f_mode & FMODE_WRITE))
-                                       goto dput_and_out;
+                                       goto mnt_drop_write_and_out;
                        } else {
                                error = vfs_permission(&nd, MAY_WRITE);
                                if (error)
-                                       goto dput_and_out;
+                                       goto mnt_drop_write_and_out;
                        }
                }
        }
        mutex_lock(&inode->i_mutex);
        error = notify_change(dentry, &newattrs);
        mutex_unlock(&inode->i_mutex);
+mnt_drop_write_and_out:
+       mnt_drop_write(mnt);
 dput_and_out:
        if (f)
                fput(f);