Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs fixes from Al Viro:
 "Fixes for crap of assorted ages: EOPENSTALE one is 4.2+, autofs one is
  4.6, d_walk - 3.2+.

  The atomic_open() and coredump ones are regressions from this window"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  coredump: fix dumping through pipes
  fix a regression in atomic_open()
  fix d_walk()/non-delayed __d_free() race
  autofs braino fix for do_last()
  fix EOPENSTALE bug in do_last()

7 files changed, 24 insertions, 52 deletions

diff --git a/arch/powerpc/platforms/cell/spufs/coredump.c b/arch/powerpc/platforms/cell/spufs/coredump.c
index 84fb984f29c1..85c85eb3e245 100644
--- a/arch/powerpc/platforms/cell/spufs/coredump.c
+++ b/arch/powerpc/platforms/cell/spufs/coredump.c
@@ -172,7 +172,7 @@ static int spufs_arch_write_note(struct spu_context *ctx, int i,
         if (rc < 0)
                 goto out;
 
-        skip = roundup(cprm->file->f_pos - total + sz, 4) - cprm->file->f_pos;
+        skip = roundup(cprm->pos - total + sz, 4) - cprm->pos;
         if (!dump_skip(cprm, skip))
                 goto Eio;
 out:
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index e158b22ef32f..a7a28110dc80 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -2275,7 +2275,7 @@ static int elf_core_dump(struct coredump_params *cprm)
                 goto end_coredump;
 
         /* Align to page */
-        if (!dump_skip(cprm, dataoff - cprm->file->f_pos))
+        if (!dump_skip(cprm, dataoff - cprm->pos))
                 goto end_coredump;
 
         for (i = 0, vma = first_vma(current, gate_vma); vma != NULL;
diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index 71ade0e556b7..203589311bf8 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -1787,7 +1787,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm)
                                 goto end_coredump;
         }
 
-        if (!dump_skip(cprm, dataoff - cprm->file->f_pos))
+        if (!dump_skip(cprm, dataoff - cprm->pos))
                 goto end_coredump;
 
         if (!elf_fdpic_dump_segments(cprm))
diff --git a/fs/coredump.c b/fs/coredump.c
index 38a7ab87e10a..281b768000e6 100644
--- a/fs/coredump.c
+++ b/fs/coredump.c
@@ -794,6 +794,7 @@ int dump_emit(struct coredump_params *cprm, const void *addr, int nr)
                         return 0;
                 file->f_pos = pos;
                 cprm->written += n;
+                cprm->pos += n;
                 nr -= n;
         }
         return 1;
@@ -808,6 +809,7 @@ int dump_skip(struct coredump_params *cprm, size_t nr)
                 if (dump_interrupted() ||
                     file->f_op->llseek(file, nr, SEEK_CUR) < 0)
                         return 0;
+                cprm->pos += nr;
                 return 1;
         } else {
                 while (nr > PAGE_SIZE) {
@@ -822,7 +824,7 @@ EXPORT_SYMBOL(dump_skip);
 
 int dump_align(struct coredump_params *cprm, int align)
 {
-        unsigned mod = cprm->file->f_pos & (align - 1);
+        unsigned mod = cprm->pos & (align - 1);
         if (align & (align - 1))
                 return 0;
         return mod ? dump_skip(cprm, align - mod) : 1;
diff --git a/fs/dcache.c b/fs/dcache.c
index ad4a542e9bab..817c243c1ff1 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1636,7 +1636,7 @@ struct dentry *d_alloc(struct dentry * parent, const struct qstr *name)
         struct dentry *dentry = __d_alloc(parent->d_sb, name);
         if (!dentry)
                 return NULL;
-
+        dentry->d_flags |= DCACHE_RCUACCESS;
         spin_lock(&parent->d_lock);
         /*
          * don't need child lock because it is not subject
@@ -2358,7 +2358,6 @@ static void __d_rehash(struct dentry * entry, struct hlist_bl_head *b)
 {
         BUG_ON(!d_unhashed(entry));
         hlist_bl_lock(b);
-        entry->d_flags |= DCACHE_RCUACCESS;
         hlist_bl_add_head_rcu(&entry->d_hash, b);
         hlist_bl_unlock(b);
 }
@@ -2843,6 +2842,7 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
         /* ... and switch them in the tree */
         if (IS_ROOT(dentry)) {
                 /* splicing a tree */
+                dentry->d_flags |= DCACHE_RCUACCESS;
                 dentry->d_parent = target->d_parent;
                 target->d_parent = target;
                 list_del_init(&target->d_child);
diff --git a/fs/namei.c b/fs/namei.c
index 6a82fb7e2127..70580ab1445c 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -3030,9 +3030,13 @@ static int atomic_open(struct nameidata *nd, struct dentry *dentry,
                         }
                         if (*opened & FILE_CREATED)
                                 fsnotify_create(dir, dentry);
-                        path->dentry = dentry;
-                        path->mnt = nd->path.mnt;
-                        return 1;
+                        if (unlikely(d_is_negative(dentry))) {
+                                error = -ENOENT;
+                        } else {
+                                path->dentry = dentry;
+                                path->mnt = nd->path.mnt;
+                                return 1;
+                        }
                 }
         }
         dput(dentry);
@@ -3201,9 +3205,7 @@ static int do_last(struct nameidata *nd,
         int acc_mode = op->acc_mode;
         unsigned seq;
         struct inode *inode;
-        struct path save_parent = { .dentry = NULL, .mnt = NULL };
         struct path path;
-        bool retried = false;
         int error;
 
         nd->flags &= ~LOOKUP_PARENT;
@@ -3246,7 +3248,6 @@ static int do_last(struct nameidata *nd,
                         return -EISDIR;
         }
 
-retry_lookup:
         if (open_flag & (O_CREAT | O_TRUNC | O_WRONLY | O_RDWR)) {
                 error = mnt_want_write(nd->path.mnt);
                 if (!error)
@@ -3298,6 +3299,10 @@ retry_lookup:
                 got_write = false;
         }
 
+        error = follow_managed(&path, nd);
+        if (unlikely(error < 0))
+                return error;
+
         if (unlikely(d_is_negative(path.dentry))) {
                 path_to_nameidata(&path, nd);
                 return -ENOENT;
@@ -3313,10 +3318,6 @@ retry_lookup:
                 return -EEXIST;
         }
 
-        error = follow_managed(&path, nd);
-        if (unlikely(error < 0))
-                return error;
-
         seq = 0;        /* out of RCU mode, so the value doesn't matter */
         inode = d_backing_inode(path.dentry);
 finish_lookup:
@@ -3327,23 +3328,14 @@ finish_lookup:
         if (unlikely(error))
                 return error;
 
-        if ((nd->flags & LOOKUP_RCU) || nd->path.mnt != path.mnt) {
-                path_to_nameidata(&path, nd);
-        } else {
-                save_parent.dentry = nd->path.dentry;
-                save_parent.mnt = mntget(path.mnt);
-                nd->path.dentry = path.dentry;
-
-        }
+        path_to_nameidata(&path, nd);
         nd->inode = inode;
         nd->seq = seq;
         /* Why this, you ask?  _Now_ we might have grown LOOKUP_JUMPED... */
 finish_open:
         error = complete_walk(nd);
-        if (error) {
-                path_put(&save_parent);
+        if (error)
                 return error;
-        }
         audit_inode(nd->name, nd->path.dentry, 0);
         error = -EISDIR;
         if ((open_flag & O_CREAT) && d_is_dir(nd->path.dentry))
@@ -3366,13 +3358,9 @@ finish_open_created:
                 goto out;
         BUG_ON(*opened & FILE_OPENED); /* once it's opened, it's opened */
         error = vfs_open(&nd->path, file, current_cred());
-        if (!error) {
-                *opened |= FILE_OPENED;
-        } else {
-                if (error == -EOPENSTALE)
-                        goto stale_open;
+        if (error)
                 goto out;
-        }
+        *opened |= FILE_OPENED;
 opened:
         error = open_check_o_direct(file);
         if (!error)
@@ -3388,26 +3376,7 @@ out:
         }
         if (got_write)
                 mnt_drop_write(nd->path.mnt);
-        path_put(&save_parent);
         return error;
-
-stale_open:
-        /* If no saved parent or already retried then can't retry */
-        if (!save_parent.dentry || retried)
-                goto out;
-
-        BUG_ON(save_parent.dentry != dir);
-        path_put(&nd->path);
-        nd->path = save_parent;
-        nd->inode = dir->d_inode;
-        save_parent.mnt = NULL;
-        save_parent.dentry = NULL;
-        if (got_write) {
-                mnt_drop_write(nd->path.mnt);
-                got_write = false;
-        }
-        retried = true;
-        goto retry_lookup;
 }
 
 static int do_tmpfile(struct nameidata *nd, unsigned flags,
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index 576e4639ca60..314b3caa701c 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -65,6 +65,7 @@ struct coredump_params {
         unsigned long limit;
         unsigned long mm_flags;
         loff_t written;
+        loff_t pos;
 };
 
 /*