Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs fixes from Al Viro:
 "Assorted fixes + unifying __d_move() and __d_materialise_dentry() +
  minimal regression fix for d_path() of victims of overwriting rename()
  ported on top of that"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  vfs: Don't exchange "short" filenames unconditionally.
  fold swapping ->d_name.hash into switch_names()
  fold unlocking the children into dentry_unlock_parents_for_move()
  kill __d_materialise_dentry()
  __d_materialise_dentry(): flip the order of arguments
  __d_move(): fold manipulations with ->d_child/->d_subdirs
  don't open-code d_rehash() in d_materialise_unique()
  pull rehashing and unlocking the target dentry into __d_materialise_dentry()
  ufs: deal with nfsd/iget races
  fuse: honour max_read and max_write in direct_io mode
  shmem: fix nlink for rename overwrite directory

1 files changed, 36 insertions, 76 deletions

diff --git a/fs/dcache.c b/fs/dcache.c
index 7a5b51440afa..cb25a1a5e307 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2372,7 +2372,8 @@ void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
 }
 EXPORT_SYMBOL(dentry_update_name_case);
 
-static void switch_names(struct dentry *dentry, struct dentry *target)
+static void switch_names(struct dentry *dentry, struct dentry *target,
+                         bool exchange)
 {
         if (dname_external(target)) {
                 if (dname_external(dentry)) {
@@ -2406,13 +2407,19 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
                          */
                         unsigned int i;
                         BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long)));
+                        if (!exchange) {
+                                memcpy(dentry->d_iname, target->d_name.name,
+                                                target->d_name.len + 1);
+                                dentry->d_name.hash_len = target->d_name.hash_len;
+                                return;
+                        }
                         for (i = 0; i < DNAME_INLINE_LEN / sizeof(long); i++) {
                                 swap(((long *) &dentry->d_iname)[i],
                                      ((long *) &target->d_iname)[i]);
                         }
                 }
         }
-        swap(dentry->d_name.len, target->d_name.len);
+        swap(dentry->d_name.hash_len, target->d_name.hash_len);
 }
 
 static void dentry_lock_for_move(struct dentry *dentry, struct dentry *target)
@@ -2442,25 +2449,29 @@ static void dentry_lock_for_move(struct dentry *dentry, struct dentry *target)
         }
 }
 
-static void dentry_unlock_parents_for_move(struct dentry *dentry,
-                                        struct dentry *target)
+static void dentry_unlock_for_move(struct dentry *dentry, struct dentry *target)
 {
         if (target->d_parent != dentry->d_parent)
                 spin_unlock(&dentry->d_parent->d_lock);
         if (target->d_parent != target)
                 spin_unlock(&target->d_parent->d_lock);
+        spin_unlock(&target->d_lock);
+        spin_unlock(&dentry->d_lock);
 }
 
 /*
  * When switching names, the actual string doesn't strictly have to
  * be preserved in the target - because we're dropping the target
  * anyway. As such, we can just do a simple memcpy() to copy over
- * the new name before we switch.
- *
- * Note that we have to be a lot more careful about getting the hash
- * switched - we have to switch the hash value properly even if it
- * then no longer matches the actual (corrupted) string of the target.
- * The hash value has to match the hash queue that the dentry is on..
+ * the new name before we switch, unless we are going to rehash
+ * it.  Note that if we *do* unhash the target, we are not allowed
+ * to rehash it without giving it a new name/hash key - whether
+ * we swap or overwrite the names here, resulting name won't match
+ * the reality in filesystem; it's only there for d_path() purposes.
+ * Note that all of this is happening under rename_lock, so the
+ * any hash lookup seeing it in the middle of manipulations will
+ * be discarded anyway.  So we do not care what happens to the hash
+ * key in that case.
  */
 /*
  * __d_move - move a dentry
@@ -2506,36 +2517,30 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
                            d_hash(dentry->d_parent, dentry->d_name.hash));
         }
 
-        list_del(&dentry->d_u.d_child);
-        list_del(&target->d_u.d_child);
-
         /* Switch the names.. */
-        switch_names(dentry, target);
-        swap(dentry->d_name.hash, target->d_name.hash);
+        switch_names(dentry, target, exchange);
 
-        /* ... and switch the parents */
+        /* ... and switch them in the tree */
         if (IS_ROOT(dentry)) {
+                /* splicing a tree */
                 dentry->d_parent = target->d_parent;
                 target->d_parent = target;
-                INIT_LIST_HEAD(&target->d_u.d_child);
+                list_del_init(&target->d_u.d_child);
+                list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
         } else {
+                /* swapping two dentries */
                 swap(dentry->d_parent, target->d_parent);
-
-                /* And add them back to the (new) parent lists */
-                list_add(&target->d_u.d_child, &target->d_parent->d_subdirs);
+                list_move(&target->d_u.d_child, &target->d_parent->d_subdirs);
+                list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
+                if (exchange)
+                        fsnotify_d_move(target);
+                fsnotify_d_move(dentry);
         }
 
-        list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
-
         write_seqcount_end(&target->d_seq);
         write_seqcount_end(&dentry->d_seq);
 
-        dentry_unlock_parents_for_move(dentry, target);
-        if (exchange)
-                fsnotify_d_move(target);
-        spin_unlock(&target->d_lock);
-        fsnotify_d_move(dentry);
-        spin_unlock(&dentry->d_lock);
+        dentry_unlock_for_move(dentry, target);
 }
 
 /*
@@ -2633,45 +2638,6 @@ out_err:
         return ret;
 }
 
-/*
- * Prepare an anonymous dentry for life in the superblock's dentry tree as a
- * named dentry in place of the dentry to be replaced.
- * returns with anon->d_lock held!
- */
-static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
-{
-        struct dentry *dparent;
-
-        dentry_lock_for_move(anon, dentry);
-
-        write_seqcount_begin(&dentry->d_seq);
-        write_seqcount_begin_nested(&anon->d_seq, DENTRY_D_LOCK_NESTED);
-
-        dparent = dentry->d_parent;
-
-        switch_names(dentry, anon);
-        swap(dentry->d_name.hash, anon->d_name.hash);
-
-        dentry->d_parent = dentry;
-        list_del_init(&dentry->d_u.d_child);
-        anon->d_parent = dparent;
-        if (likely(!d_unhashed(anon))) {
-                hlist_bl_lock(&anon->d_sb->s_anon);
-                __hlist_bl_del(&anon->d_hash);
-                anon->d_hash.pprev = NULL;
-                hlist_bl_unlock(&anon->d_sb->s_anon);
-        }
-        list_move(&anon->d_u.d_child, &dparent->d_subdirs);
-
-        write_seqcount_end(&dentry->d_seq);
-        write_seqcount_end(&anon->d_seq);
-
-        dentry_unlock_parents_for_move(anon, dentry);
-        spin_unlock(&dentry->d_lock);
-
-        /* anon->d_lock still locked, returns locked */
-}
-
 /**
  * d_splice_alias - splice a disconnected dentry into the tree if one exists
  * @inode:  the inode which may have a disconnected dentry
@@ -2717,10 +2683,8 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                                 return ERR_PTR(-EIO);
                         }
                         write_seqlock(&rename_lock);
-                        __d_materialise_dentry(dentry, new);
+                        __d_move(new, dentry, false);
                         write_sequnlock(&rename_lock);
-                        _d_rehash(new);
-                        spin_unlock(&new->d_lock);
                         spin_unlock(&inode->i_lock);
                         security_d_instantiate(new, inode);
                         iput(inode);
@@ -2780,7 +2744,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                         } else if (IS_ROOT(alias)) {
                                 /* Is this an anonymous mountpoint that we
                                  * could splice into our tree? */
-                                __d_materialise_dentry(dentry, alias);
+                                __d_move(alias, dentry, false);
                                 write_sequnlock(&rename_lock);
                                 goto found;
                         } else {
@@ -2807,13 +2771,9 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
         actual = __d_instantiate_unique(dentry, inode);
         if (!actual)
                 actual = dentry;
-        else
-                BUG_ON(!d_unhashed(actual));
 
-        spin_lock(&actual->d_lock);
+        d_rehash(actual);
 found:
-        _d_rehash(actual);
-        spin_unlock(&actual->d_lock);
         spin_unlock(&inode->i_lock);
 out_nolock:
         if (actual == dentry) {