vfs: missed source of ->f_pos races

commit 0e665d5d1125f9f4ccff56a75e814f10f88861a2 upstream.

compat_sys_{read,write}v() need the same "pass a copy of file->f_pos" thing
as sys_{read,write}{,v}().

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/fs/compat.c b/fs/compat.c
index c987875..e07a3d3 100644 (file)
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1174,11 +1174,14 @@ compat_sys_readv(unsigned long fd, const struct compat_iovec __user *vec,
        struct file *file;
        int fput_needed;
        ssize_t ret;
        struct file *file;
        int fput_needed;
        ssize_t ret;

+       loff_t pos;

 
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
 
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;

-       ret = compat_readv(file, vec, vlen, &file->f_pos);
+       pos = file->f_pos;
+       ret = compat_readv(file, vec, vlen, &pos);
+       file->f_pos = pos;

        fput_light(file, fput_needed);
        return ret;
 }
        fput_light(file, fput_needed);
        return ret;
 }


@@ -1233,11 +1236,14 @@ compat_sys_writev(unsigned long fd, const struct compat_iovec __user *vec,
        struct file *file;
        int fput_needed;
        ssize_t ret;
        struct file *file;
        int fput_needed;
        ssize_t ret;

+       loff_t pos;

 
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;
 
        file = fget_light(fd, &fput_needed);
        if (!file)
                return -EBADF;

-       ret = compat_writev(file, vec, vlen, &file->f_pos);
+       pos = file->f_pos;
+       ret = compat_writev(file, vec, vlen, &pos);
+       file->f_pos = pos;

        fput_light(file, fput_needed);
        return ret;
 }
        fput_light(file, fput_needed);
        return ret;
 }