[PATCH] fs: fix libfs data leak

[pandora-kernel.git] / Documentation / filesystems / vfs.txt

diff --git a/Documentation/filesystems/vfs.txt b/Documentation/filesystems/vfs.txt
index 1cb7e8b..ea271f2 100644 (file)
--- a/Documentation/filesystems/vfs.txt
+++ b/Documentation/filesystems/vfs.txt
@@ -410,7 +410,7 @@ otherwise noted.
 
   put_link: called by the VFS to release resources allocated by
        follow_link().  The cookie returned by follow_link() is passed
-       to to this method as the last parameter.  It is used by
+       to this method as the last parameter.  It is used by
        filesystems such as NFS where page cache is not stable
        (i.e. page that was installed when the symbolic link walk
        started might not be in the page cache at the end of the
@@ -617,6 +617,11 @@ struct address_space_operations {
        In this case the prepare_write will be retried one the lock is
        regained.
 
+       Note: the page _must not_ be marked uptodate in this function
+       (or anywhere else) unless it actually is uptodate right now. As
+       soon as a page is marked uptodate, it is possible for a concurrent
+       read(2) to copy it to userspace.
+
   commit_write: If prepare_write succeeds, new data will be copied
         into the page and then commit_write will be called.  It will
         typically update the size of the file (if appropriate) and
@@ -699,9 +704,9 @@ This describes how the VFS can manipulate an open file. As of kernel
 struct file_operations {
        loff_t (*llseek) (struct file *, loff_t, int);
        ssize_t (*read) (struct file *, char __user *, size_t, loff_t *);
-       ssize_t (*aio_read) (struct kiocb *, char __user *, size_t, loff_t);
        ssize_t (*write) (struct file *, const char __user *, size_t, loff_t *);
-       ssize_t (*aio_write) (struct kiocb *, const char __user *, size_t, loff_t);
+       ssize_t (*aio_read) (struct kiocb *, const struct iovec *, unsigned long, loff_t);
+       ssize_t (*aio_write) (struct kiocb *, const struct iovec *, unsigned long, loff_t);
        int (*readdir) (struct file *, void *, filldir_t);
        unsigned int (*poll) (struct file *, struct poll_table_struct *);
        int (*ioctl) (struct inode *, struct file *, unsigned int, unsigned long);