Commit dbd380bb authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull misc fixes from Al Viro:
 "vhost race fix and a percpu_ref_init-caused cgroup double-free fix.

  The latter had manifested as buggered struct mount refcounting - those
  are also using percpu data structures, but anything that does percpu
  allocations could be hit"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  Fix double fget() in vhost_net_set_backend()
  percpu_ref_init(): clean ->percpu_count_ref on failure
parents db1fd3fc fb4554c2

drivers/vhost/net.c

+7 −8
Original line number Diff line number Diff line
@@ -1450,13 +1450,9 @@ static struct socket *get_raw_socket(int fd) 
	return ERR_PTR(r);

}



static struct ptr_ring *get_tap_ptr_ring(int fd)

static struct ptr_ring *get_tap_ptr_ring(struct file *file)

{

	struct ptr_ring *ring;

	struct file *file = fget(fd);



	if (!file)

		return NULL;

	ring = tun_get_tx_ring(file);

	if (!IS_ERR(ring))

		goto out;
@@ -1465,7 +1461,6 @@ static struct ptr_ring *get_tap_ptr_ring(int fd) 
		goto out;

	ring = NULL;

out:

	fput(file);

	return ring;

}
@@ -1552,8 +1547,12 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) 
		r = vhost_net_enable_vq(n, vq);

		if (r)

			goto err_used;

		if (index == VHOST_NET_VQ_RX)

			nvq->rx_ring = get_tap_ptr_ring(fd);

		if (index == VHOST_NET_VQ_RX) {

			if (sock)

				nvq->rx_ring = get_tap_ptr_ring(sock->file);

			else

				nvq->rx_ring = NULL;

		}



		oldubufs = nvq->ubufs;

		nvq->ubufs = ubufs;

lib/percpu-refcount.c

+1 −0
Original line number Diff line number Diff line
@@ -76,6 +76,7 @@ int percpu_ref_init(struct percpu_ref *ref, percpu_ref_func_t *release, 
	data = kzalloc(sizeof(*ref->data), gfp);

	if (!data) {

		free_percpu((void __percpu *)ref->percpu_count_ptr);

		ref->percpu_count_ptr = 0;

		return -ENOMEM;

	}