Bluetooth: Fix potential bad memory access with sysfs files
[linux-2.6/mini2440.git] / fs / notify / notification.c
blobb8bf53b4c10897802c83db2c1ce1320aad16236e
1 /*
2 * Copyright (C) 2008 Red Hat, Inc., Eric Paris <eparis@redhat.com>
4 * This program is free software; you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation; either version 2, or (at your option)
7 * any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; see the file COPYING. If not, write to
16 * the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
20 * Basic idea behind the notification queue: An fsnotify group (like inotify)
21 * sends the userspace notification about events asyncronously some time after
22 * the event happened. When inotify gets an event it will need to add that
23 * event to the group notify queue. Since a single event might need to be on
24 * multiple group's notification queues we can't add the event directly to each
25 * queue and instead add a small "event_holder" to each queue. This event_holder
26 * has a pointer back to the original event. Since the majority of events are
27 * going to end up on one, and only one, notification queue we embed one
28 * event_holder into each event. This means we have a single allocation instead
29 * of always needing two. If the embedded event_holder is already in use by
30 * another group a new event_holder (from fsnotify_event_holder_cachep) will be
31 * allocated and used.
34 #include <linux/fs.h>
35 #include <linux/init.h>
36 #include <linux/kernel.h>
37 #include <linux/list.h>
38 #include <linux/module.h>
39 #include <linux/mount.h>
40 #include <linux/mutex.h>
41 #include <linux/namei.h>
42 #include <linux/path.h>
43 #include <linux/slab.h>
44 #include <linux/spinlock.h>
46 #include <asm/atomic.h>
48 #include <linux/fsnotify_backend.h>
49 #include "fsnotify.h"
51 static struct kmem_cache *fsnotify_event_cachep;
52 static struct kmem_cache *fsnotify_event_holder_cachep;
54 * This is a magic event we send when the q is too full. Since it doesn't
55 * hold real event information we just keep one system wide and use it any time
56 * it is needed. It's refcnt is set 1 at kernel init time and will never
57 * get set to 0 so it will never get 'freed'
59 static struct fsnotify_event q_overflow_event;
60 static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
62 /**
63 * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
64 * Called from fsnotify_move, which is inlined into filesystem modules.
66 u32 fsnotify_get_cookie(void)
68 return atomic_inc_return(&fsnotify_sync_cookie);
70 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
72 /* return true if the notify queue is empty, false otherwise */
73 bool fsnotify_notify_queue_is_empty(struct fsnotify_group *group)
75 BUG_ON(!mutex_is_locked(&group->notification_mutex));
76 return list_empty(&group->notification_list) ? true : false;
79 void fsnotify_get_event(struct fsnotify_event *event)
81 atomic_inc(&event->refcnt);
84 void fsnotify_put_event(struct fsnotify_event *event)
86 if (!event)
87 return;
89 if (atomic_dec_and_test(&event->refcnt)) {
90 if (event->data_type == FSNOTIFY_EVENT_PATH)
91 path_put(&event->path);
93 BUG_ON(!list_empty(&event->private_data_list));
95 kfree(event->file_name);
96 kmem_cache_free(fsnotify_event_cachep, event);
100 struct fsnotify_event_holder *fsnotify_alloc_event_holder(void)
102 return kmem_cache_alloc(fsnotify_event_holder_cachep, GFP_KERNEL);
105 void fsnotify_destroy_event_holder(struct fsnotify_event_holder *holder)
107 kmem_cache_free(fsnotify_event_holder_cachep, holder);
111 * Find the private data that the group previously attached to this event when
112 * the group added the event to the notification queue (fsnotify_add_notify_event)
114 struct fsnotify_event_private_data *fsnotify_remove_priv_from_event(struct fsnotify_group *group, struct fsnotify_event *event)
116 struct fsnotify_event_private_data *lpriv;
117 struct fsnotify_event_private_data *priv = NULL;
119 assert_spin_locked(&event->lock);
121 list_for_each_entry(lpriv, &event->private_data_list, event_list) {
122 if (lpriv->group == group) {
123 priv = lpriv;
124 list_del(&priv->event_list);
125 break;
128 return priv;
132 * Check if 2 events contain the same information. We do not compare private data
133 * but at this moment that isn't a problem for any know fsnotify listeners.
135 static bool event_compare(struct fsnotify_event *old, struct fsnotify_event *new)
137 if ((old->mask == new->mask) &&
138 (old->to_tell == new->to_tell) &&
139 (old->data_type == new->data_type) &&
140 (old->name_len == new->name_len)) {
141 switch (old->data_type) {
142 case (FSNOTIFY_EVENT_INODE):
143 /* remember, after old was put on the wait_q we aren't
144 * allowed to look at the inode any more, only thing
145 * left to check was if the file_name is the same */
146 if (!old->name_len ||
147 !strcmp(old->file_name, new->file_name))
148 return true;
149 break;
150 case (FSNOTIFY_EVENT_PATH):
151 if ((old->path.mnt == new->path.mnt) &&
152 (old->path.dentry == new->path.dentry))
153 return true;
154 break;
155 case (FSNOTIFY_EVENT_NONE):
156 if (old->mask & FS_Q_OVERFLOW)
157 return true;
158 else if (old->mask & FS_IN_IGNORED)
159 return false;
160 return false;
163 return false;
167 * Add an event to the group notification queue. The group can later pull this
168 * event off the queue to deal with. If the event is successfully added to the
169 * group's notification queue, a reference is taken on event.
171 int fsnotify_add_notify_event(struct fsnotify_group *group, struct fsnotify_event *event,
172 struct fsnotify_event_private_data *priv)
174 struct fsnotify_event_holder *holder = NULL;
175 struct list_head *list = &group->notification_list;
176 struct fsnotify_event_holder *last_holder;
177 struct fsnotify_event *last_event;
178 int ret = 0;
181 * There is one fsnotify_event_holder embedded inside each fsnotify_event.
182 * Check if we expect to be able to use that holder. If not alloc a new
183 * holder.
184 * For the overflow event it's possible that something will use the in
185 * event holder before we get the lock so we may need to jump back and
186 * alloc a new holder, this can't happen for most events...
188 if (!list_empty(&event->holder.event_list)) {
189 alloc_holder:
190 holder = fsnotify_alloc_event_holder();
191 if (!holder)
192 return -ENOMEM;
195 mutex_lock(&group->notification_mutex);
197 if (group->q_len >= group->max_events) {
198 event = &q_overflow_event;
199 ret = -EOVERFLOW;
200 /* sorry, no private data on the overflow event */
201 priv = NULL;
204 spin_lock(&event->lock);
206 if (list_empty(&event->holder.event_list)) {
207 if (unlikely(holder))
208 fsnotify_destroy_event_holder(holder);
209 holder = &event->holder;
210 } else if (unlikely(!holder)) {
211 /* between the time we checked above and got the lock the in
212 * event holder was used, go back and get a new one */
213 spin_unlock(&event->lock);
214 mutex_unlock(&group->notification_mutex);
215 goto alloc_holder;
218 if (!list_empty(list)) {
219 last_holder = list_entry(list->prev, struct fsnotify_event_holder, event_list);
220 last_event = last_holder->event;
221 if (event_compare(last_event, event)) {
222 spin_unlock(&event->lock);
223 mutex_unlock(&group->notification_mutex);
224 if (holder != &event->holder)
225 fsnotify_destroy_event_holder(holder);
226 return -EEXIST;
230 group->q_len++;
231 holder->event = event;
233 fsnotify_get_event(event);
234 list_add_tail(&holder->event_list, list);
235 if (priv)
236 list_add_tail(&priv->event_list, &event->private_data_list);
237 spin_unlock(&event->lock);
238 mutex_unlock(&group->notification_mutex);
240 wake_up(&group->notification_waitq);
241 return ret;
245 * Remove and return the first event from the notification list. There is a
246 * reference held on this event since it was on the list. It is the responsibility
247 * of the caller to drop this reference.
249 struct fsnotify_event *fsnotify_remove_notify_event(struct fsnotify_group *group)
251 struct fsnotify_event *event;
252 struct fsnotify_event_holder *holder;
254 BUG_ON(!mutex_is_locked(&group->notification_mutex));
256 holder = list_first_entry(&group->notification_list, struct fsnotify_event_holder, event_list);
258 event = holder->event;
260 spin_lock(&event->lock);
261 holder->event = NULL;
262 list_del_init(&holder->event_list);
263 spin_unlock(&event->lock);
265 /* event == holder means we are referenced through the in event holder */
266 if (holder != &event->holder)
267 fsnotify_destroy_event_holder(holder);
269 group->q_len--;
271 return event;
275 * This will not remove the event, that must be done with fsnotify_remove_notify_event()
277 struct fsnotify_event *fsnotify_peek_notify_event(struct fsnotify_group *group)
279 struct fsnotify_event *event;
280 struct fsnotify_event_holder *holder;
282 BUG_ON(!mutex_is_locked(&group->notification_mutex));
284 holder = list_first_entry(&group->notification_list, struct fsnotify_event_holder, event_list);
285 event = holder->event;
287 return event;
291 * Called when a group is being torn down to clean up any outstanding
292 * event notifications.
294 void fsnotify_flush_notify(struct fsnotify_group *group)
296 struct fsnotify_event *event;
297 struct fsnotify_event_private_data *priv;
299 mutex_lock(&group->notification_mutex);
300 while (!fsnotify_notify_queue_is_empty(group)) {
301 event = fsnotify_remove_notify_event(group);
302 /* if they don't implement free_event_priv they better not have attached any */
303 if (group->ops->free_event_priv) {
304 spin_lock(&event->lock);
305 priv = fsnotify_remove_priv_from_event(group, event);
306 spin_unlock(&event->lock);
307 if (priv)
308 group->ops->free_event_priv(priv);
310 fsnotify_put_event(event); /* matches fsnotify_add_notify_event */
312 mutex_unlock(&group->notification_mutex);
315 static void initialize_event(struct fsnotify_event *event)
317 event->holder.event = NULL;
318 INIT_LIST_HEAD(&event->holder.event_list);
319 atomic_set(&event->refcnt, 1);
321 spin_lock_init(&event->lock);
323 event->path.dentry = NULL;
324 event->path.mnt = NULL;
325 event->inode = NULL;
326 event->data_type = FSNOTIFY_EVENT_NONE;
328 INIT_LIST_HEAD(&event->private_data_list);
330 event->to_tell = NULL;
332 event->file_name = NULL;
333 event->name_len = 0;
335 event->sync_cookie = 0;
339 * fsnotify_create_event - Allocate a new event which will be sent to each
340 * group's handle_event function if the group was interested in this
341 * particular event.
343 * @to_tell the inode which is supposed to receive the event (sometimes a
344 * parent of the inode to which the event happened.
345 * @mask what actually happened.
346 * @data pointer to the object which was actually affected
347 * @data_type flag indication if the data is a file, path, inode, nothing...
348 * @name the filename, if available
350 struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask, void *data,
351 int data_type, const char *name, u32 cookie,
352 gfp_t gfp)
354 struct fsnotify_event *event;
356 event = kmem_cache_alloc(fsnotify_event_cachep, gfp);
357 if (!event)
358 return NULL;
360 initialize_event(event);
362 if (name) {
363 event->file_name = kstrdup(name, gfp);
364 if (!event->file_name) {
365 kmem_cache_free(fsnotify_event_cachep, event);
366 return NULL;
368 event->name_len = strlen(event->file_name);
371 event->sync_cookie = cookie;
372 event->to_tell = to_tell;
374 switch (data_type) {
375 case FSNOTIFY_EVENT_FILE: {
376 struct file *file = data;
377 struct path *path = &file->f_path;
378 event->path.dentry = path->dentry;
379 event->path.mnt = path->mnt;
380 path_get(&event->path);
381 event->data_type = FSNOTIFY_EVENT_PATH;
382 break;
384 case FSNOTIFY_EVENT_PATH: {
385 struct path *path = data;
386 event->path.dentry = path->dentry;
387 event->path.mnt = path->mnt;
388 path_get(&event->path);
389 event->data_type = FSNOTIFY_EVENT_PATH;
390 break;
392 case FSNOTIFY_EVENT_INODE:
393 event->inode = data;
394 event->data_type = FSNOTIFY_EVENT_INODE;
395 break;
396 case FSNOTIFY_EVENT_NONE:
397 event->inode = NULL;
398 event->path.dentry = NULL;
399 event->path.mnt = NULL;
400 break;
401 default:
402 BUG();
405 event->mask = mask;
407 return event;
410 __init int fsnotify_notification_init(void)
412 fsnotify_event_cachep = KMEM_CACHE(fsnotify_event, SLAB_PANIC);
413 fsnotify_event_holder_cachep = KMEM_CACHE(fsnotify_event_holder, SLAB_PANIC);
415 initialize_event(&q_overflow_event);
416 q_overflow_event.mask = FS_Q_OVERFLOW;
418 return 0;
420 subsys_initcall(fsnotify_notification_init);