atomic_open(): fix the handling of create_error

* if we have a hashed negative dentry and either CREAT|EXCL on
r/o filesystem, or CREAT|TRUNC on r/o filesystem, or CREAT|EXCL
with failing may_o_create(), we should fail with EROFS or the
error may_o_create() has returned, but not ENOENT.  Which is what
the current code ends up returning.

* if we have CREAT|TRUNC hitting a regular file on a read-only
filesystem, we can't fail with EROFS here.  At the very least,
not until we'd done follow_managed() - we might have a writable
file (or a device, for that matter) bound on top of that one.
Moreover, the code downstream will see that O_TRUNC and attempt
to grab the write access (*after* following possible mount), so
if we really should fail with EROFS, it will happen.  No need
to do that inside atomic_open().

The real logics is much simpler than what the current code is
trying to do - if we decided to go for simple lookup, ended
up with a negative dentry *and* had create_error set, fail with
create_error.  No matter whether we'd got that negative dentry
from lookup_real() or had found it in dcache.

Cc: stable@vger.kernel.org # v3.6+
Acked-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 4 insertions, 16 deletions

diff --git a/fs/namei.c b/fs/namei.c
index 1d9ca2d5dff6..b4589922c0de 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2942,22 +2942,10 @@ no_open:
                 dentry = lookup_real(dir, dentry, nd->flags);
                 if (IS_ERR(dentry))
                         return PTR_ERR(dentry);
-
-                if (create_error) {
-                        int open_flag = op->open_flag;
-
-                        error = create_error;
-                        if ((open_flag & O_EXCL)) {
-                                if (!dentry->d_inode)
-                                        goto out;
-                        } else if (!dentry->d_inode) {
-                                goto out;
-                        } else if ((open_flag & O_TRUNC) &&
-                                   d_is_reg(dentry)) {
-                                goto out;
-                        }
-                        /* will fail later, go on to get the right error */
-                }
+        }
+        if (create_error && !dentry->d_inode) {
+                error = create_error;
+                goto out;
         }
 looked_up:
         path->dentry = dentry;