Ext4: Fix online resize block group descriptor corruption

[linux-2.6-omap-h63xx.git] / fs / open.c

diff --git a/fs/open.c b/fs/open.c
index e2df8fd1eb0b329e51eb887f968da9404a5652db..a1450086e92f87e64007351ab673bf6274037e70 100644 (file)
--- a/fs/open.c
+++ b/fs/open.c
@@ -7,6 +7,7 @@
 #include <linux/string.h>
 #include <linux/mm.h>
 #include <linux/file.h>
+#include <linux/fdtable.h>
 #include <linux/quotaops.h>
 #include <linux/fsnotify.h>
 #include <linux/module.h>
@@ -244,21 +245,21 @@ static long do_sys_truncate(const char __user * path, loff_t length)
        if (!S_ISREG(inode->i_mode))
                goto dput_and_out;
 
-       error = vfs_permission(&nd, MAY_WRITE);
+       error = mnt_want_write(nd.path.mnt);
        if (error)
                goto dput_and_out;
 
-       error = -EROFS;
-       if (IS_RDONLY(inode))
-               goto dput_and_out;
+       error = vfs_permission(&nd, MAY_WRITE);
+       if (error)
+               goto mnt_drop_write_and_out;
 
        error = -EPERM;
        if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
-               goto dput_and_out;
+               goto mnt_drop_write_and_out;
 
        error = get_write_access(inode);
        if (error)
-               goto dput_and_out;
+               goto mnt_drop_write_and_out;
 
        /*
         * Make sure that there are no leases.  get_write_access() protects
@@ -276,6 +277,8 @@ static long do_sys_truncate(const char __user * path, loff_t length)
 
 put_write_and_out:
        put_write_access(inode);
+mnt_drop_write_and_out:
+       mnt_drop_write(nd.path.mnt);
 dput_and_out:
        path_put(&nd.path);
 out:
@@ -457,8 +460,17 @@ asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
        if(res || !(mode & S_IWOTH) ||
           special_file(nd.path.dentry->d_inode->i_mode))
                goto out_path_release;
-
-       if(IS_RDONLY(nd.path.dentry->d_inode))
+       /*
+        * This is a rare case where using __mnt_is_readonly()
+        * is OK without a mnt_want/drop_write() pair.  Since
+        * no actual write to the fs is performed here, we do
+        * not need to telegraph to that to anyone.
+        *
+        * By doing this, we accept that this access is
+        * inherently racy and know that the fs may change
+        * state before we even see this result.
+        */
+       if (__mnt_is_readonly(nd.path.mnt))
                res = -EROFS;
 
 out_path_release:
@@ -795,6 +807,8 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
                error = __get_file_write_access(inode, mnt);
                if (error)
                        goto cleanup_file;
+               if (!special_file(inode->i_mode))
+                       file_take_write(f);
        }
 
        f->f_mapping = inode->i_mapping;
@@ -824,7 +838,7 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
        if (f->f_flags & O_DIRECT) {
                if (!f->f_mapping->a_ops ||
                    ((!f->f_mapping->a_ops->direct_IO) &&
-                   (!f->f_mapping->a_ops->get_xip_page))) {
+                   (!f->f_mapping->a_ops->get_xip_mem))) {
                        fput(f);
                        f = ERR_PTR(-EINVAL);
                }
@@ -836,8 +850,16 @@ cleanup_all:
        fops_put(f->f_op);
        if (f->f_mode & FMODE_WRITE) {
                put_write_access(inode);
-               if (!special_file(inode->i_mode))
+               if (!special_file(inode->i_mode)) {
+                       /*
+                        * We don't consider this a real
+                        * mnt_want/drop_write() pair
+                        * because it all happenend right
+                        * here, so just reset the state.
+                        */
+                       file_reset_write(f);
                        mnt_drop_write(mnt);
+               }
        }
        file_kill(f);
        f->f_path.dentry = NULL;