Merge branch 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs namei updates from Al Viro:

 - make lookup_one_len() safe with parent locked only shared(incoming
   afs series wants that)

 - fix of getname_kernel() regression from 2015 (-stable fodder, that
   one).

* 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  getname_kernel() needs to make sure that ->name != ->iname in long case
  make lookup_one_len() safe to use with directory locked shared
  new helper: __lookup_slow()
  merge common parts of lookup_one_len{,_unlocked} into common helper

1 files changed, 57 insertions, 67 deletions

diff --git a/fs/namei.c b/fs/namei.c
index a66ed5a1622a..186bd2464fd5 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -224,9 +224,10 @@ getname_kernel(const char * filename)
         if (len <= EMBEDDED_NAME_MAX) {
                 result->name = (char *)result->iname;
         } else if (len <= PATH_MAX) {
+                const size_t size = offsetof(struct filename, iname[1]);
                 struct filename *tmp;
 
-                tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
+                tmp = kmalloc(size, GFP_KERNEL);
                 if (unlikely(!tmp)) {
                         __putname(result);
                         return ERR_PTR(-ENOMEM);
@@ -1597,22 +1598,21 @@ static int lookup_fast(struct nameidata *nd,
 }
 
 /* Fast lookup failed, do it the slow way */
-static struct dentry *lookup_slow(const struct qstr *name,
-                                  struct dentry *dir,
-                                  unsigned int flags)
+static struct dentry *__lookup_slow(const struct qstr *name,
+                                    struct dentry *dir,
+                                    unsigned int flags)
 {
-        struct dentry *dentry = ERR_PTR(-ENOENT), *old;
+        struct dentry *dentry, *old;
         struct inode *inode = dir->d_inode;
         DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wq);
 
-        inode_lock_shared(inode);
         /* Don't go there if it's already dead */
         if (unlikely(IS_DEADDIR(inode)))
-                goto out;
+                return ERR_PTR(-ENOENT);
 again:
         dentry = d_alloc_parallel(dir, name, &wq);
         if (IS_ERR(dentry))
-                goto out;
+                return dentry;
         if (unlikely(!d_in_lookup(dentry))) {
                 if (!(flags & LOOKUP_NO_REVAL)) {
                         int error = d_revalidate(dentry, flags);
@@ -1634,11 +1634,21 @@ again:
                         dentry = old;
                 }
         }
-out:
-        inode_unlock_shared(inode);
         return dentry;
 }
 
+static struct dentry *lookup_slow(const struct qstr *name,
+                                  struct dentry *dir,
+                                  unsigned int flags)
+{
+        struct inode *inode = dir->d_inode;
+        struct dentry *res;
+        inode_lock_shared(inode);
+        res = __lookup_slow(name, dir, flags);
+        inode_unlock_shared(inode);
+        return res;
+}
+
 static inline int may_lookup(struct nameidata *nd)
 {
         if (nd->flags & LOOKUP_RCU) {
@@ -2421,56 +2431,63 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
 }
 EXPORT_SYMBOL(vfs_path_lookup);
 
-/**
- * lookup_one_len - filesystem helper to lookup single pathname component
- * @name:       pathname component to lookup
- * @base:       base directory to lookup from
- * @len:        maximum length @len should be interpreted to
- *
- * Note that this routine is purely a helper for filesystem usage and should
- * not be called by generic code.
- *
- * The caller must hold base->i_mutex.
- */
-struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
+static int lookup_one_len_common(const char *name, struct dentry *base,
+                                 int len, struct qstr *this)
 {
-        struct qstr this;
-        unsigned int c;
-        int err;
-
-        WARN_ON_ONCE(!inode_is_locked(base->d_inode));
-
-        this.name = name;
-        this.len = len;
-        this.hash = full_name_hash(base, name, len);
+        this->name = name;
+        this->len = len;
+        this->hash = full_name_hash(base, name, len);
         if (!len)
-                return ERR_PTR(-EACCES);
+                return -EACCES;
 
         if (unlikely(name[0] == '.')) {
                 if (len < 2 || (len == 2 && name[1] == '.'))
-                        return ERR_PTR(-EACCES);
+                        return -EACCES;
         }
 
         while (len--) {
-                c = *(const unsigned char *)name++;
+                unsigned int c = *(const unsigned char *)name++;
                 if (c == '/' || c == '\0')
-                        return ERR_PTR(-EACCES);
+                        return -EACCES;
         }
         /*
          * See if the low-level filesystem might want
          * to use its own hash..
          */
         if (base->d_flags & DCACHE_OP_HASH) {
-                int err = base->d_op->d_hash(base, &this);
+                int err = base->d_op->d_hash(base, this);
                 if (err < 0)
-                        return ERR_PTR(err);
+                        return err;
         }
 
-        err = inode_permission(base->d_inode, MAY_EXEC);
+        return inode_permission(base->d_inode, MAY_EXEC);
+}
+
+/**
+ * lookup_one_len - filesystem helper to lookup single pathname component
+ * @name:       pathname component to lookup
+ * @base:       base directory to lookup from
+ * @len:        maximum length @len should be interpreted to
+ *
+ * Note that this routine is purely a helper for filesystem usage and should
+ * not be called by generic code.
+ *
+ * The caller must hold base->i_mutex.
+ */
+struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
+{
+        struct dentry *dentry;
+        struct qstr this;
+        int err;
+
+        WARN_ON_ONCE(!inode_is_locked(base->d_inode));
+
+        err = lookup_one_len_common(name, base, len, &this);
         if (err)
                 return ERR_PTR(err);
 
-        return __lookup_hash(&this, base, 0);
+        dentry = lookup_dcache(&this, base, 0);
+        return dentry ? dentry : __lookup_slow(&this, base, 0);
 }
 EXPORT_SYMBOL(lookup_one_len);
 
@@ -2490,37 +2507,10 @@ struct dentry *lookup_one_len_unlocked(const char *name,
                                        struct dentry *base, int len)
 {
         struct qstr this;
-        unsigned int c;
         int err;
         struct dentry *ret;
 
-        this.name = name;
-        this.len = len;
-        this.hash = full_name_hash(base, name, len);
-        if (!len)
-                return ERR_PTR(-EACCES);
-
-        if (unlikely(name[0] == '.')) {
-                if (len < 2 || (len == 2 && name[1] == '.'))
-                        return ERR_PTR(-EACCES);
-        }
-
-        while (len--) {
-                c = *(const unsigned char *)name++;
-                if (c == '/' || c == '\0')
-                        return ERR_PTR(-EACCES);
-        }
-        /*
-         * See if the low-level filesystem might want
-         * to use its own hash..
-         */
-        if (base->d_flags & DCACHE_OP_HASH) {
-                int err = base->d_op->d_hash(base, &this);
-                if (err < 0)
-                        return ERR_PTR(err);
-        }
-
-        err = inode_permission(base->d_inode, MAY_EXEC);
+        err = lookup_one_len_common(name, base, len, &this);
         if (err)
                 return ERR_PTR(err);