Merge tag 'regmap-v5.12' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie...

[linux-2.6-microblaze.git] / fs / userfaultfd.c

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 894cc28..0be8cdd 100644 (file)
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -979,14 +979,14 @@ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)
 
 static const struct file_operations userfaultfd_fops;
 
-static int resolve_userfault_fork(struct userfaultfd_ctx *ctx,
-                                 struct userfaultfd_ctx *new,
+static int resolve_userfault_fork(struct userfaultfd_ctx *new,
+                                 struct inode *inode,
                                  struct uffd_msg *msg)
 {
        int fd;
 
-       fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, new,
-                             O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS));
+       fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, new,
+                       O_RDWR | (new->flags & UFFD_SHARED_FCNTL_FLAGS), inode);
        if (fd < 0)
                return fd;
 
@@ -996,7 +996,7 @@ static int resolve_userfault_fork(struct userfaultfd_ctx *ctx,
 }
 
 static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
-                                   struct uffd_msg *msg)
+                                   struct uffd_msg *msg, struct inode *inode)
 {
        ssize_t ret;
        DECLARE_WAITQUEUE(wait, current);
@@ -1107,7 +1107,7 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
        spin_unlock_irq(&ctx->fd_wqh.lock);
 
        if (!ret && msg->event == UFFD_EVENT_FORK) {
-               ret = resolve_userfault_fork(ctx, fork_nctx, msg);
+               ret = resolve_userfault_fork(fork_nctx, inode, msg);
                spin_lock_irq(&ctx->event_wqh.lock);
                if (!list_empty(&fork_event)) {
                        /*
@@ -1167,6 +1167,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
        ssize_t _ret, ret = 0;
        struct uffd_msg msg;
        int no_wait = file->f_flags & O_NONBLOCK;
+       struct inode *inode = file_inode(file);
 
        if (ctx->state == UFFD_STATE_WAIT_API)
                return -EINVAL;
@@ -1174,7 +1175,7 @@ static ssize_t userfaultfd_read(struct file *file, char __user *buf,
        for (;;) {
                if (count < sizeof(msg))
                        return ret ? ret : -EINVAL;
-               _ret = userfaultfd_ctx_read(ctx, no_wait, &msg);
+               _ret = userfaultfd_ctx_read(ctx, no_wait, &msg, inode);
                if (_ret < 0)
                        return ret ? ret : _ret;
                if (copy_to_user((__u64 __user *) buf, &msg, sizeof(msg)))
@@ -1999,8 +2000,8 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
        /* prevent the mm struct to be freed */
        mmgrab(ctx->mm);
 
-       fd = anon_inode_getfd("[userfaultfd]", &userfaultfd_fops, ctx,
-                             O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS));
+       fd = anon_inode_getfd_secure("[userfaultfd]", &userfaultfd_fops, ctx,
+                       O_RDWR | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
        if (fd < 0) {
                mmdrop(ctx->mm);
                kmem_cache_free(userfaultfd_ctx_cachep, ctx);