bcm2835-v4l2: Fix buffer overflow problem

[mirror_ubuntu-zesty-kernel.git] / fs / super.c

diff --git a/fs/super.c b/fs/super.c
index 1709ed029a2cae70c3d4a6cccccca760a0ad003f..36c4a3c73a0170c7a4fbd8e03bf64d59014c0272 100644 (file)
--- a/fs/super.c
+++ b/fs/super.c
@@ -469,7 +469,7 @@ struct super_block *sget_userns(struct file_system_type *type,
        struct super_block *old;
        int err;
 
-       if (!(flags & MS_KERNMOUNT) &&
+       if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) &&
            !(type->fs_flags & FS_USERNS_MOUNT) &&
            !capable(CAP_SYS_ADMIN))
                return ERR_PTR(-EPERM);
@@ -499,7 +499,7 @@ retry:
        }
        if (!s) {
                spin_unlock(&sb_lock);
-               s = alloc_super(type, flags, user_ns);
+               s = alloc_super(type, (flags & ~MS_SUBMOUNT), user_ns);
                if (!s)
                        return ERR_PTR(-ENOMEM);
                goto retry;
@@ -540,8 +540,15 @@ struct super_block *sget(struct file_system_type *type,
 {
        struct user_namespace *user_ns = current_user_ns();
 
+       /* We don't yet pass the user namespace of the parent
+        * mount through to here so always use &init_user_ns
+        * until that changes.
+        */
+       if (flags & MS_SUBMOUNT)
+               user_ns = &init_user_ns;
+
        /* Ensure the requestor has permissions over the target filesystem */
-       if (!(flags & MS_KERNMOUNT) && !ns_capable(user_ns, CAP_SYS_ADMIN))
+       if (!(flags & (MS_KERNMOUNT|MS_SUBMOUNT)) && !ns_capable(user_ns, CAP_SYS_ADMIN))
                return ERR_PTR(-EPERM);
 
        return sget_userns(type, test, set, flags, user_ns, data);
@@ -1072,6 +1079,23 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
        if (IS_ERR(bdev))
                return ERR_CAST(bdev);
 
+       if (current_user_ns() != &init_user_ns) {
+               /*
+                * For userns mounts, disallow mounting if bdev is open for
+                * writing
+                */
+               if (!atomic_dec_unless_positive(&bdev->bd_inode->i_writecount)) {
+                       error = -EBUSY;
+                       goto error_bdev;
+               }
+               if (bdev->bd_contains != bdev &&
+                   !atomic_dec_unless_positive(&bdev->bd_contains->bd_inode->i_writecount)) {
+                       atomic_inc(&bdev->bd_inode->i_writecount);
+                       error = -EBUSY;
+                       goto error_bdev;
+               }
+       }
+
        /*
         * once the super is inserted into the list by sget, s_umount
         * will protect the lockfs code from trying to start a snapshot
@@ -1081,7 +1105,7 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
        if (bdev->bd_fsfreeze_count > 0) {
                mutex_unlock(&bdev->bd_fsfreeze_mutex);
                error = -EBUSY;
-               goto error_bdev;
+               goto error_inc;
        }
        s = sget(fs_type, test_bdev_super, set_bdev_super, flags | MS_NOSEC,
                 bdev);
@@ -1093,7 +1117,7 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
                if ((flags ^ s->s_flags) & MS_RDONLY) {
                        deactivate_locked_super(s);
                        error = -EBUSY;
-                       goto error_bdev;
+                       goto error_inc;
                }
 
                /*
@@ -1124,6 +1148,12 @@ struct dentry *mount_bdev(struct file_system_type *fs_type,
 
 error_s:
        error = PTR_ERR(s);
+error_inc:
+       if (current_user_ns() != &init_user_ns) {
+               atomic_inc(&bdev->bd_inode->i_writecount);
+               if (bdev->bd_contains != bdev)
+                       atomic_inc(&bdev->bd_contains->bd_inode->i_writecount);
+       }
 error_bdev:
        blkdev_put(bdev, mode);
 error:
@@ -1140,6 +1170,11 @@ void kill_block_super(struct super_block *sb)
        generic_shutdown_super(sb);
        sync_blockdev(bdev);
        WARN_ON_ONCE(!(mode & FMODE_EXCL));
+       if (sb->s_user_ns != &init_user_ns) {
+               atomic_inc(&bdev->bd_inode->i_writecount);
+               if (bdev->bd_contains != bdev)
+                       atomic_inc(&bdev->bd_contains->bd_inode->i_writecount);
+       }
        blkdev_put(bdev, mode | FMODE_EXCL);
 }