Merge tag 'vfs-6.10.rw' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

[sfrench/cifs-2.6.git] / fs / userfaultfd.c

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 292f5fd501047f3af8d9a3af546c4e809f5d89bd..2a564f813314300896b36fb2d5a48f9ae8eb38b9 100644 (file)
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -31,6 +31,7 @@
 #include <linux/hugetlb.h>
 #include <linux/swapops.h>
 #include <linux/miscdevice.h>
+#include <linux/uio.h>
 
 static int sysctl_unprivileged_userfaultfd __read_mostly;
 
@@ -282,7 +283,7 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx,
 /*
  * Verify the pagetables are still not ok after having reigstered into
  * the fault_pending_wqh to avoid userland having to UFFDIO_WAKE any
- * userfault that has already been resolved, if userfaultfd_read and
+ * userfault that has already been resolved, if userfaultfd_read_iter and
  * UFFDIO_COPY|ZEROPAGE are being run simultaneously on two different
  * threads.
  */
@@ -1181,34 +1182,34 @@ static ssize_t userfaultfd_ctx_read(struct userfaultfd_ctx *ctx, int no_wait,
        return ret;
 }
 
-static ssize_t userfaultfd_read(struct file *file, char __user *buf,
-                               size_t count, loff_t *ppos)
+static ssize_t userfaultfd_read_iter(struct kiocb *iocb, struct iov_iter *to)
 {
+       struct file *file = iocb->ki_filp;
        struct userfaultfd_ctx *ctx = file->private_data;
        ssize_t _ret, ret = 0;
        struct uffd_msg msg;
-       int no_wait = file->f_flags & O_NONBLOCK;
        struct inode *inode = file_inode(file);
+       bool no_wait;
 
        if (!userfaultfd_is_initialized(ctx))
                return -EINVAL;
 
+       no_wait = file->f_flags & O_NONBLOCK || iocb->ki_flags & IOCB_NOWAIT;
        for (;;) {
-               if (count < sizeof(msg))
+               if (iov_iter_count(to) < sizeof(msg))
                        return ret ? ret : -EINVAL;
                _ret = userfaultfd_ctx_read(ctx, no_wait, &msg, inode);
                if (_ret < 0)
                        return ret ? ret : _ret;
-               if (copy_to_user((__u64 __user *) buf, &msg, sizeof(msg)))
+               _ret = !copy_to_iter_full(&msg, sizeof(msg), to);
+               if (_ret)
                        return ret ? ret : -EFAULT;
                ret += sizeof(msg);
-               buf += sizeof(msg);
-               count -= sizeof(msg);
                /*
                 * Allow to read more than one fault at time but only
                 * block if waiting for the very first one.
                 */
-               no_wait = O_NONBLOCK;
+               no_wait = true;
        }
 }
 
@@ -2176,7 +2177,7 @@ static const struct file_operations userfaultfd_fops = {
 #endif
        .release        = userfaultfd_release,
        .poll           = userfaultfd_poll,
-       .read           = userfaultfd_read,
+       .read_iter      = userfaultfd_read_iter,
        .unlocked_ioctl = userfaultfd_ioctl,
        .compat_ioctl   = compat_ptr_ioctl,
        .llseek         = noop_llseek,
@@ -2196,6 +2197,7 @@ static void init_once_userfaultfd_ctx(void *mem)
 static int new_userfaultfd(int flags)
 {
        struct userfaultfd_ctx *ctx;
+       struct file *file;
        int fd;
 
        BUG_ON(!current->mm);
@@ -2219,16 +2221,26 @@ static int new_userfaultfd(int flags)
        init_rwsem(&ctx->map_changing_lock);
        atomic_set(&ctx->mmap_changing, 0);
        ctx->mm = current->mm;
-       /* prevent the mm struct to be freed */
-       mmgrab(ctx->mm);
+
+       fd = get_unused_fd_flags(flags & UFFD_SHARED_FCNTL_FLAGS);
+       if (fd < 0)
+               goto err_out;
 
        /* Create a new inode so that the LSM can block the creation.  */
-       fd = anon_inode_create_getfd("[userfaultfd]", &userfaultfd_fops, ctx,
+       file = anon_inode_create_getfile("[userfaultfd]", &userfaultfd_fops, ctx,
                        O_RDONLY | (flags & UFFD_SHARED_FCNTL_FLAGS), NULL);
-       if (fd < 0) {
-               mmdrop(ctx->mm);
-               kmem_cache_free(userfaultfd_ctx_cachep, ctx);
+       if (IS_ERR(file)) {
+               put_unused_fd(fd);
+               fd = PTR_ERR(file);
+               goto err_out;
        }
+       /* prevent the mm struct to be freed */
+       mmgrab(ctx->mm);
+       file->f_mode |= FMODE_NOWAIT;
+       fd_install(fd, file);
+       return fd;
+err_out:
+       kmem_cache_free(userfaultfd_ctx_cachep, ctx);
        return fd;
 }