8 files changed, 207 insertions, 180 deletions

diff --git a/fs/Makefile b/fs/Makefile
index da0bbb456d3f..bedff48e8fdc 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -11,7 +11,7 @@ obj-y :=	open.o read_write.o file_table.o super.o \
                 attr.o bad_inode.o file.o filesystems.o namespace.o \
                 seq_file.o xattr.o libfs.o fs-writeback.o \
                 pnode.o splice.o sync.o utimes.o \
-                stack.o fs_struct.o statfs.o fs_pin.o
+                stack.o fs_struct.o statfs.o fs_pin.o nsfs.o
 
 ifeq ($(CONFIG_BLOCK),y)
 obj-y +=        buffer.o block_dev.o direct-io.o mpage.o
diff --git a/fs/internal.h b/fs/internal.h
index 757ba2abf21e..e9a61fe67575 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -147,3 +147,8 @@ extern const struct file_operations pipefifo_fops;
  */
 extern void sb_pin_kill(struct super_block *sb);
 extern void mnt_pin_kill(struct mount *m);
+
+/*
+ * fs/nsfs.c
+ */
+extern struct dentry_operations ns_dentry_operations;
diff --git a/fs/mount.h b/fs/mount.h
index f82c62840905..0ad6f760ce52 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -1,10 +1,11 @@
 #include <linux/mount.h>
 #include <linux/seq_file.h>
 #include <linux/poll.h>
+#include <linux/ns_common.h>
 
 struct mnt_namespace {
         atomic_t                count;
-        unsigned int            proc_inum;
+        struct ns_common        ns;
         struct mount *  root;
         struct list_head        list;
         struct user_namespace   *user_ns;
diff --git a/fs/namespace.c b/fs/namespace.c
index 5b66b2b3624d..30df6e7dd807 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1569,17 +1569,13 @@ SYSCALL_DEFINE1(oldumount, char __user *, name)
 static bool is_mnt_ns_file(struct dentry *dentry)
 {
         /* Is this a proxy for a mount namespace? */
-        struct inode *inode = dentry->d_inode;
-        struct proc_ns *ei;
-
-        if (!proc_ns_inode(inode))
-                return false;
-
-        ei = get_proc_ns(inode);
-        if (ei->ns_ops != &mntns_operations)
-                return false;
+        return dentry->d_op == &ns_dentry_operations &&
+               dentry->d_fsdata == &mntns_operations;
+}
 
-        return true;
+struct mnt_namespace *to_mnt_ns(struct ns_common *ns)
+{
+        return container_of(ns, struct mnt_namespace, ns);
 }
 
 static bool mnt_ns_loop(struct dentry *dentry)
@@ -1591,7 +1587,7 @@ static bool mnt_ns_loop(struct dentry *dentry)
         if (!is_mnt_ns_file(dentry))
                 return false;
 
-        mnt_ns = get_proc_ns(dentry->d_inode)->ns;
+        mnt_ns = to_mnt_ns(get_proc_ns(dentry->d_inode));
         return current->nsproxy->mnt_ns->seq >= mnt_ns->seq;
 }
 
@@ -2020,7 +2016,10 @@ static int do_loopback(struct path *path, const char *old_name,
         if (IS_MNT_UNBINDABLE(old))
                 goto out2;
 
-        if (!check_mnt(parent) || !check_mnt(old))
+        if (!check_mnt(parent))
+                goto out2;
+
+        if (!check_mnt(old) && old_path.dentry->d_op != &ns_dentry_operations)
                 goto out2;
 
         if (!recurse && has_locked_children(old, old_path.dentry))
@@ -2640,7 +2639,7 @@ dput_out:
 
 static void free_mnt_ns(struct mnt_namespace *ns)
 {
-        proc_free_inum(ns->proc_inum);
+        ns_free_inum(&ns->ns);
         put_user_ns(ns->user_ns);
         kfree(ns);
 }
@@ -2662,11 +2661,12 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns)
         new_ns = kmalloc(sizeof(struct mnt_namespace), GFP_KERNEL);
         if (!new_ns)
                 return ERR_PTR(-ENOMEM);
-        ret = proc_alloc_inum(&new_ns->proc_inum);
+        ret = ns_alloc_inum(&new_ns->ns);
         if (ret) {
                 kfree(new_ns);
                 return ERR_PTR(ret);
         }
+        new_ns->ns.ops = &mntns_operations;
         new_ns->seq = atomic64_add_return(1, &mnt_ns_seq);
         atomic_set(&new_ns->count, 1);
         new_ns->root = NULL;
@@ -3144,31 +3144,31 @@ found:
         return visible;
 }
 
-static void *mntns_get(struct task_struct *task)
+static struct ns_common *mntns_get(struct task_struct *task)
 {
-        struct mnt_namespace *ns = NULL;
+        struct ns_common *ns = NULL;
         struct nsproxy *nsproxy;
 
         task_lock(task);
         nsproxy = task->nsproxy;
         if (nsproxy) {
-                ns = nsproxy->mnt_ns;
-                get_mnt_ns(ns);
+                ns = &nsproxy->mnt_ns->ns;
+                get_mnt_ns(to_mnt_ns(ns));
         }
         task_unlock(task);
 
         return ns;
 }
 
-static void mntns_put(void *ns)
+static void mntns_put(struct ns_common *ns)
 {
-        put_mnt_ns(ns);
+        put_mnt_ns(to_mnt_ns(ns));
 }
 
-static int mntns_install(struct nsproxy *nsproxy, void *ns)
+static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
 {
         struct fs_struct *fs = current->fs;
-        struct mnt_namespace *mnt_ns = ns;
+        struct mnt_namespace *mnt_ns = to_mnt_ns(ns);
         struct path root;
 
         if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
@@ -3198,17 +3198,10 @@ static int mntns_install(struct nsproxy *nsproxy, void *ns)
         return 0;
 }
 
-static unsigned int mntns_inum(void *ns)
-{
-        struct mnt_namespace *mnt_ns = ns;
-        return mnt_ns->proc_inum;
-}
-
 const struct proc_ns_operations mntns_operations = {
         .name           = "mnt",
         .type           = CLONE_NEWNS,
         .get            = mntns_get,
         .put            = mntns_put,
         .install        = mntns_install,
-        .inum           = mntns_inum,
 };
diff --git a/fs/nsfs.c b/fs/nsfs.c
new file mode 100644
index 000000000000..af1b24fa899d
--- /dev/null
+++ b/fs/nsfs.c
@@ -0,0 +1,161 @@
+#include <linux/mount.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/proc_ns.h>
+#include <linux/magic.h>
+#include <linux/ktime.h>
+
+static struct vfsmount *nsfs_mnt;
+
+static const struct file_operations ns_file_operations = {
+        .llseek         = no_llseek,
+};
+
+static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
+{
+        struct inode *inode = dentry->d_inode;
+        const struct proc_ns_operations *ns_ops = dentry->d_fsdata;
+
+        return dynamic_dname(dentry, buffer, buflen, "%s:[%lu]",
+                ns_ops->name, inode->i_ino);
+}
+
+static void ns_prune_dentry(struct dentry *dentry)
+{
+        struct inode *inode = dentry->d_inode;
+        if (inode) {
+                struct ns_common *ns = inode->i_private;
+                atomic_long_set(&ns->stashed, 0);
+        }
+}
+
+const struct dentry_operations ns_dentry_operations =
+{
+        .d_prune        = ns_prune_dentry,
+        .d_delete       = always_delete_dentry,
+        .d_dname        = ns_dname,
+};
+
+static void nsfs_evict(struct inode *inode)
+{
+        struct ns_common *ns = inode->i_private;
+        clear_inode(inode);
+        ns->ops->put(ns);
+}
+
+void *ns_get_path(struct path *path, struct task_struct *task,
+                        const struct proc_ns_operations *ns_ops)
+{
+        struct vfsmount *mnt = mntget(nsfs_mnt);
+        struct qstr qname = { .name = "", };
+        struct dentry *dentry;
+        struct inode *inode;
+        struct ns_common *ns;
+        unsigned long d;
+
+again:
+        ns = ns_ops->get(task);
+        if (!ns) {
+                mntput(mnt);
+                return ERR_PTR(-ENOENT);
+        }
+        rcu_read_lock();
+        d = atomic_long_read(&ns->stashed);
+        if (!d)
+                goto slow;
+        dentry = (struct dentry *)d;
+        if (!lockref_get_not_dead(&dentry->d_lockref))
+                goto slow;
+        rcu_read_unlock();
+        ns_ops->put(ns);
+got_it:
+        path->mnt = mnt;
+        path->dentry = dentry;
+        return NULL;
+slow:
+        rcu_read_unlock();
+        inode = new_inode_pseudo(mnt->mnt_sb);
+        if (!inode) {
+                ns_ops->put(ns);
+                mntput(mnt);
+                return ERR_PTR(-ENOMEM);
+        }
+        inode->i_ino = ns->inum;
+        inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
+        inode->i_flags |= S_IMMUTABLE;
+        inode->i_mode = S_IFREG | S_IRUGO;
+        inode->i_fop = &ns_file_operations;
+        inode->i_private = ns;
+
+        dentry = d_alloc_pseudo(mnt->mnt_sb, &qname);
+        if (!dentry) {
+                iput(inode);
+                mntput(mnt);
+                return ERR_PTR(-ENOMEM);
+        }
+        d_instantiate(dentry, inode);
+        dentry->d_fsdata = (void *)ns_ops;
+        d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry);
+        if (d) {
+                d_delete(dentry);       /* make sure ->d_prune() does nothing */
+                dput(dentry);
+                cpu_relax();
+                goto again;
+        }
+        goto got_it;
+}
+
+int ns_get_name(char *buf, size_t size, struct task_struct *task,
+                        const struct proc_ns_operations *ns_ops)
+{
+        struct ns_common *ns;
+        int res = -ENOENT;
+        ns = ns_ops->get(task);
+        if (ns) {
+                res = snprintf(buf, size, "%s:[%u]", ns_ops->name, ns->inum);
+                ns_ops->put(ns);
+        }
+        return res;
+}
+
+struct file *proc_ns_fget(int fd)
+{
+        struct file *file;
+
+        file = fget(fd);
+        if (!file)
+                return ERR_PTR(-EBADF);
+
+        if (file->f_op != &ns_file_operations)
+                goto out_invalid;
+
+        return file;
+
+out_invalid:
+        fput(file);
+        return ERR_PTR(-EINVAL);
+}
+
+static const struct super_operations nsfs_ops = {
+        .statfs = simple_statfs,
+        .evict_inode = nsfs_evict,
+};
+static struct dentry *nsfs_mount(struct file_system_type *fs_type,
+                        int flags, const char *dev_name, void *data)
+{
+        return mount_pseudo(fs_type, "nsfs:", &nsfs_ops,
+                        &ns_dentry_operations, NSFS_MAGIC);
+}
+static struct file_system_type nsfs = {
+        .name = "nsfs",
+        .mount = nsfs_mount,
+        .kill_sb = kill_anon_super,
+};
+
+void __init nsfs_init(void)
+{
+        nsfs_mnt = kern_mount(&nsfs);
+        if (IS_ERR(nsfs_mnt))
+                panic("can't set nsfs up\n");
+        nsfs_mnt->mnt_sb->s_flags &= ~MS_NOUSER;
+}
diff --git a/fs/proc/inode.c b/fs/proc/inode.c
index 333080d7a671..8420a2f80811 100644
--- a/fs/proc/inode.c
+++ b/fs/proc/inode.c
@@ -32,8 +32,6 @@ static void proc_evict_inode(struct inode *inode)
 {
         struct proc_dir_entry *de;
         struct ctl_table_header *head;
-        const struct proc_ns_operations *ns_ops;
-        void *ns;
 
         truncate_inode_pages_final(&inode->i_data);
         clear_inode(inode);
@@ -50,11 +48,6 @@ static void proc_evict_inode(struct inode *inode)
                 RCU_INIT_POINTER(PROC_I(inode)->sysctl, NULL);
                 sysctl_head_put(head);
         }
-        /* Release any associated namespace */
-        ns_ops = PROC_I(inode)->ns.ns_ops;
-        ns = PROC_I(inode)->ns.ns;
-        if (ns_ops && ns)
-                ns_ops->put(ns);
 }
 
 static struct kmem_cache * proc_inode_cachep;
@@ -73,8 +66,7 @@ static struct inode *proc_alloc_inode(struct super_block *sb)
         ei->pde = NULL;
         ei->sysctl = NULL;
         ei->sysctl_entry = NULL;
-        ei->ns.ns = NULL;
-        ei->ns.ns_ops = NULL;
+        ei->ns_ops = NULL;
         inode = &ei->vfs_inode;
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         return inode;
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index aa7a0ee182e1..d689fd6960d5 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -64,7 +64,7 @@ struct proc_inode {
         struct proc_dir_entry *pde;
         struct ctl_table_header *sysctl;
         struct ctl_table *sysctl_entry;
-        struct proc_ns ns;
+        const struct proc_ns_operations *ns_ops;
         struct inode vfs_inode;
 };
 
diff --git a/fs/proc/namespaces.c b/fs/proc/namespaces.c
index 89026095f2b5..c9eac4563fa8 100644
--- a/fs/proc/namespaces.c
+++ b/fs/proc/namespaces.c
@@ -1,10 +1,6 @@
 #include <linux/proc_fs.h>
 #include <linux/nsproxy.h>
-#include <linux/sched.h>
 #include <linux/ptrace.h>
-#include <linux/fs_struct.h>
-#include <linux/mount.h>
-#include <linux/path.h>
 #include <linux/namei.h>
 #include <linux/file.h>
 #include <linux/utsname.h>
@@ -34,138 +30,45 @@ static const struct proc_ns_operations *ns_entries[] = {
         &mntns_operations,
 };
 
-static const struct file_operations ns_file_operations = {
-        .llseek         = no_llseek,
-};
-
-static const struct inode_operations ns_inode_operations = {
-        .setattr        = proc_setattr,
-};
-
-static char *ns_dname(struct dentry *dentry, char *buffer, int buflen)
-{
-        struct inode *inode = dentry->d_inode;
-        const struct proc_ns_operations *ns_ops = PROC_I(inode)->ns.ns_ops;
-
-        return dynamic_dname(dentry, buffer, buflen, "%s:[%lu]",
-                ns_ops->name, inode->i_ino);
-}
-
-const struct dentry_operations ns_dentry_operations =
-{
-        .d_delete       = always_delete_dentry,
-        .d_dname        = ns_dname,
-};
-
-static struct dentry *proc_ns_get_dentry(struct super_block *sb,
-        struct task_struct *task, const struct proc_ns_operations *ns_ops)
-{
-        struct dentry *dentry, *result;
-        struct inode *inode;
-        struct proc_inode *ei;
-        struct qstr qname = { .name = "", };
-        void *ns;
-
-        ns = ns_ops->get(task);
-        if (!ns)
-                return ERR_PTR(-ENOENT);
-
-        dentry = d_alloc_pseudo(sb, &qname);
-        if (!dentry) {
-                ns_ops->put(ns);
-                return ERR_PTR(-ENOMEM);
-        }
-
-        inode = iget_locked(sb, ns_ops->inum(ns));
-        if (!inode) {
-                dput(dentry);
-                ns_ops->put(ns);
-                return ERR_PTR(-ENOMEM);
-        }
-
-        ei = PROC_I(inode);
-        if (inode->i_state & I_NEW) {
-                inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
-                inode->i_op = &ns_inode_operations;
-                inode->i_mode = S_IFREG | S_IRUGO;
-                inode->i_fop = &ns_file_operations;
-                ei->ns.ns_ops = ns_ops;
-                ei->ns.ns = ns;
-                unlock_new_inode(inode);
-        } else {
-                ns_ops->put(ns);
-        }
-
-        d_set_d_op(dentry, &ns_dentry_operations);
-        result = d_instantiate_unique(dentry, inode);
-        if (result) {
-                dput(dentry);
-                dentry = result;
-        }
-
-        return dentry;
-}
-
 static void *proc_ns_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
         struct inode *inode = dentry->d_inode;
-        struct super_block *sb = inode->i_sb;
-        struct proc_inode *ei = PROC_I(inode);
+        const struct proc_ns_operations *ns_ops = PROC_I(inode)->ns_ops;
         struct task_struct *task;
         struct path ns_path;
         void *error = ERR_PTR(-EACCES);
 
         task = get_proc_task(inode);
         if (!task)
-                goto out;
+                return error;
 
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
-                goto out_put_task;
-
-        ns_path.dentry = proc_ns_get_dentry(sb, task, ei->ns.ns_ops);
-        if (IS_ERR(ns_path.dentry)) {
-                error = ERR_CAST(ns_path.dentry);
-                goto out_put_task;
+        if (ptrace_may_access(task, PTRACE_MODE_READ)) {
+                error = ns_get_path(&ns_path, task, ns_ops);
+                if (!error)
+                        nd_jump_link(nd, &ns_path);
         }
-
-        ns_path.mnt = mntget(nd->path.mnt);
-        nd_jump_link(nd, &ns_path);
-        error = NULL;
-
-out_put_task:
         put_task_struct(task);
-out:
         return error;
 }
 
 static int proc_ns_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
         struct inode *inode = dentry->d_inode;
-        struct proc_inode *ei = PROC_I(inode);
-        const struct proc_ns_operations *ns_ops = ei->ns.ns_ops;
+        const struct proc_ns_operations *ns_ops = PROC_I(inode)->ns_ops;
         struct task_struct *task;
-        void *ns;
         char name[50];
         int res = -EACCES;
 
         task = get_proc_task(inode);
         if (!task)
-                goto out;
-
-        if (!ptrace_may_access(task, PTRACE_MODE_READ))
-                goto out_put_task;
+                return res;
 
-        res = -ENOENT;
-        ns = ns_ops->get(task);
-        if (!ns)
-                goto out_put_task;
-
-        snprintf(name, sizeof(name), "%s:[%u]", ns_ops->name, ns_ops->inum(ns));
-        res = readlink_copy(buffer, buflen, name);
-        ns_ops->put(ns);
-out_put_task:
+        if (ptrace_may_access(task, PTRACE_MODE_READ)) {
+                res = ns_get_name(name, sizeof(name), task, ns_ops);
+                if (res >= 0)
+                        res = readlink_copy(buffer, buflen, name);
+        }
         put_task_struct(task);
-out:
         return res;
 }
 
@@ -189,7 +92,7 @@ static int proc_ns_instantiate(struct inode *dir,
         ei = PROC_I(inode);
         inode->i_mode = S_IFLNK|S_IRWXUGO;
         inode->i_op = &proc_ns_link_inode_operations;
-        ei->ns.ns_ops = ns_ops;
+        ei->ns_ops = ns_ops;
 
         d_set_d_op(dentry, &pid_dentry_operations);
         d_add(dentry, inode);
@@ -267,31 +170,3 @@ const struct inode_operations proc_ns_dir_inode_operations = {
         .getattr        = pid_getattr,
         .setattr        = proc_setattr,
 };
-
-struct file *proc_ns_fget(int fd)
-{
-        struct file *file;
-
-        file = fget(fd);
-        if (!file)
-                return ERR_PTR(-EBADF);
-
-        if (file->f_op != &ns_file_operations)
-                goto out_invalid;
-
-        return file;
-
-out_invalid:
-        fput(file);
-        return ERR_PTR(-EINVAL);
-}
-
-struct proc_ns *get_proc_ns(struct inode *inode)
-{
-        return &PROC_I(inode)->ns;
-}
-
-bool proc_ns_inode(struct inode *inode)
-{
-        return inode->i_fop == &ns_file_operations;
-}