8 files changed, 60 insertions, 85 deletions

diff --git a/fs/dcache.c b/fs/dcache.c
index 7a5b51440afa..cb25a1a5e307 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -2372,7 +2372,8 @@ void dentry_update_name_case(struct dentry *dentry, struct qstr *name)
 }
 EXPORT_SYMBOL(dentry_update_name_case);
 
-static void switch_names(struct dentry *dentry, struct dentry *target)
+static void switch_names(struct dentry *dentry, struct dentry *target,
+                         bool exchange)
 {
         if (dname_external(target)) {
                 if (dname_external(dentry)) {
@@ -2406,13 +2407,19 @@ static void switch_names(struct dentry *dentry, struct dentry *target)
                          */
                         unsigned int i;
                         BUILD_BUG_ON(!IS_ALIGNED(DNAME_INLINE_LEN, sizeof(long)));
+                        if (!exchange) {
+                                memcpy(dentry->d_iname, target->d_name.name,
+                                                target->d_name.len + 1);
+                                dentry->d_name.hash_len = target->d_name.hash_len;
+                                return;
+                        }
                         for (i = 0; i < DNAME_INLINE_LEN / sizeof(long); i++) {
                                 swap(((long *) &dentry->d_iname)[i],
                                      ((long *) &target->d_iname)[i]);
                         }
                 }
         }
-        swap(dentry->d_name.len, target->d_name.len);
+        swap(dentry->d_name.hash_len, target->d_name.hash_len);
 }
 
 static void dentry_lock_for_move(struct dentry *dentry, struct dentry *target)
@@ -2442,25 +2449,29 @@ static void dentry_lock_for_move(struct dentry *dentry, struct dentry *target)
         }
 }
 
-static void dentry_unlock_parents_for_move(struct dentry *dentry,
-                                        struct dentry *target)
+static void dentry_unlock_for_move(struct dentry *dentry, struct dentry *target)
 {
         if (target->d_parent != dentry->d_parent)
                 spin_unlock(&dentry->d_parent->d_lock);
         if (target->d_parent != target)
                 spin_unlock(&target->d_parent->d_lock);
+        spin_unlock(&target->d_lock);
+        spin_unlock(&dentry->d_lock);
 }
 
 /*
  * When switching names, the actual string doesn't strictly have to
  * be preserved in the target - because we're dropping the target
  * anyway. As such, we can just do a simple memcpy() to copy over
- * the new name before we switch.
- *
- * Note that we have to be a lot more careful about getting the hash
- * switched - we have to switch the hash value properly even if it
- * then no longer matches the actual (corrupted) string of the target.
- * The hash value has to match the hash queue that the dentry is on..
+ * the new name before we switch, unless we are going to rehash
+ * it.  Note that if we *do* unhash the target, we are not allowed
+ * to rehash it without giving it a new name/hash key - whether
+ * we swap or overwrite the names here, resulting name won't match
+ * the reality in filesystem; it's only there for d_path() purposes.
+ * Note that all of this is happening under rename_lock, so the
+ * any hash lookup seeing it in the middle of manipulations will
+ * be discarded anyway.  So we do not care what happens to the hash
+ * key in that case.
  */
 /*
  * __d_move - move a dentry
@@ -2506,36 +2517,30 @@ static void __d_move(struct dentry *dentry, struct dentry *target,
                            d_hash(dentry->d_parent, dentry->d_name.hash));
         }
 
-        list_del(&dentry->d_u.d_child);
-        list_del(&target->d_u.d_child);
-
         /* Switch the names.. */
-        switch_names(dentry, target);
-        swap(dentry->d_name.hash, target->d_name.hash);
+        switch_names(dentry, target, exchange);
 
-        /* ... and switch the parents */
+        /* ... and switch them in the tree */
         if (IS_ROOT(dentry)) {
+                /* splicing a tree */
                 dentry->d_parent = target->d_parent;
                 target->d_parent = target;
-                INIT_LIST_HEAD(&target->d_u.d_child);
+                list_del_init(&target->d_u.d_child);
+                list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
         } else {
+                /* swapping two dentries */
                 swap(dentry->d_parent, target->d_parent);
-
-                /* And add them back to the (new) parent lists */
-                list_add(&target->d_u.d_child, &target->d_parent->d_subdirs);
+                list_move(&target->d_u.d_child, &target->d_parent->d_subdirs);
+                list_move(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
+                if (exchange)
+                        fsnotify_d_move(target);
+                fsnotify_d_move(dentry);
         }
 
-        list_add(&dentry->d_u.d_child, &dentry->d_parent->d_subdirs);
-
         write_seqcount_end(&target->d_seq);
         write_seqcount_end(&dentry->d_seq);
 
-        dentry_unlock_parents_for_move(dentry, target);
-        if (exchange)
-                fsnotify_d_move(target);
-        spin_unlock(&target->d_lock);
-        fsnotify_d_move(dentry);
-        spin_unlock(&dentry->d_lock);
+        dentry_unlock_for_move(dentry, target);
 }
 
 /*
@@ -2633,45 +2638,6 @@ out_err:
         return ret;
 }
 
-/*
- * Prepare an anonymous dentry for life in the superblock's dentry tree as a
- * named dentry in place of the dentry to be replaced.
- * returns with anon->d_lock held!
- */
-static void __d_materialise_dentry(struct dentry *dentry, struct dentry *anon)
-{
-        struct dentry *dparent;
-
-        dentry_lock_for_move(anon, dentry);
-
-        write_seqcount_begin(&dentry->d_seq);
-        write_seqcount_begin_nested(&anon->d_seq, DENTRY_D_LOCK_NESTED);
-
-        dparent = dentry->d_parent;
-
-        switch_names(dentry, anon);
-        swap(dentry->d_name.hash, anon->d_name.hash);
-
-        dentry->d_parent = dentry;
-        list_del_init(&dentry->d_u.d_child);
-        anon->d_parent = dparent;
-        if (likely(!d_unhashed(anon))) {
-                hlist_bl_lock(&anon->d_sb->s_anon);
-                __hlist_bl_del(&anon->d_hash);
-                anon->d_hash.pprev = NULL;
-                hlist_bl_unlock(&anon->d_sb->s_anon);
-        }
-        list_move(&anon->d_u.d_child, &dparent->d_subdirs);
-
-        write_seqcount_end(&dentry->d_seq);
-        write_seqcount_end(&anon->d_seq);
-
-        dentry_unlock_parents_for_move(anon, dentry);
-        spin_unlock(&dentry->d_lock);
-
-        /* anon->d_lock still locked, returns locked */
-}
-
 /**
  * d_splice_alias - splice a disconnected dentry into the tree if one exists
  * @inode:  the inode which may have a disconnected dentry
@@ -2717,10 +2683,8 @@ struct dentry *d_splice_alias(struct inode *inode, struct dentry *dentry)
                                 return ERR_PTR(-EIO);
                         }
                         write_seqlock(&rename_lock);
-                        __d_materialise_dentry(dentry, new);
+                        __d_move(new, dentry, false);
                         write_sequnlock(&rename_lock);
-                        _d_rehash(new);
-                        spin_unlock(&new->d_lock);
                         spin_unlock(&inode->i_lock);
                         security_d_instantiate(new, inode);
                         iput(inode);
@@ -2780,7 +2744,7 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
                         } else if (IS_ROOT(alias)) {
                                 /* Is this an anonymous mountpoint that we
                                  * could splice into our tree? */
-                                __d_materialise_dentry(dentry, alias);
+                                __d_move(alias, dentry, false);
                                 write_sequnlock(&rename_lock);
                                 goto found;
                         } else {
@@ -2807,13 +2771,9 @@ struct dentry *d_materialise_unique(struct dentry *dentry, struct inode *inode)
         actual = __d_instantiate_unique(dentry, inode);
         if (!actual)
                 actual = dentry;
-        else
-                BUG_ON(!d_unhashed(actual));
 
-        spin_lock(&actual->d_lock);
+        d_rehash(actual);
 found:
-        _d_rehash(actual);
-        spin_unlock(&actual->d_lock);
         spin_unlock(&inode->i_lock);
 out_nolock:
         if (actual == dentry) {
diff --git a/fs/direct-io.c b/fs/direct-io.c
index c3116404ab49..e181b6b2e297 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -158,7 +158,7 @@ static inline int dio_refill_pages(struct dio *dio, struct dio_submit *sdio)
 {
         ssize_t ret;
 
-        ret = iov_iter_get_pages(sdio->iter, dio->pages, DIO_PAGES,
+        ret = iov_iter_get_pages(sdio->iter, dio->pages, LONG_MAX, DIO_PAGES,
                                 &sdio->from);
 
         if (ret < 0 && sdio->blocks_available && (dio->rw & WRITE)) {
diff --git a/fs/fuse/file.c b/fs/fuse/file.c
index 912061ac4baf..caa8d95b24e8 100644
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -1305,6 +1305,7 @@ static int fuse_get_user_pages(struct fuse_req *req, struct iov_iter *ii,
                 size_t start;
                 ssize_t ret = iov_iter_get_pages(ii,
                                         &req->pages[req->num_pages],
+                                        *nbytesp - nbytes,
                                         req->max_pages - req->num_pages,
                                         &start);
                 if (ret < 0)
diff --git a/fs/ufs/ialloc.c b/fs/ufs/ialloc.c
index a9cc75ffa925..7caa01652888 100644
--- a/fs/ufs/ialloc.c
+++ b/fs/ufs/ialloc.c
@@ -298,7 +298,10 @@ cg_found:
         ufsi->i_oeftflag = 0;
         ufsi->i_dir_start_lookup = 0;
         memset(&ufsi->i_u1, 0, sizeof(ufsi->i_u1));
-        insert_inode_hash(inode);
+        if (insert_inode_locked(inode) < 0) {
+                err = -EIO;
+                goto failed;
+        }
         mark_inode_dirty(inode);
 
         if (uspi->fs_magic == UFS2_MAGIC) {
@@ -337,6 +340,7 @@ cg_found:
 fail_remove_inode:
         unlock_ufs(sb);
         clear_nlink(inode);
+        unlock_new_inode(inode);
         iput(inode);
         UFSD("EXIT (FAILED): err %d\n", err);
         return ERR_PTR(err);
diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c
index 2df62a73f20c..fd65deb4b5f0 100644
--- a/fs/ufs/namei.c
+++ b/fs/ufs/namei.c
@@ -38,10 +38,12 @@ static inline int ufs_add_nondir(struct dentry *dentry, struct inode *inode)
 {
         int err = ufs_add_link(dentry, inode);
         if (!err) {
+                unlock_new_inode(inode);
                 d_instantiate(dentry, inode);
                 return 0;
         }
         inode_dec_link_count(inode);
+        unlock_new_inode(inode);
         iput(inode);
         return err;
 }
@@ -155,6 +157,7 @@ out_notlocked:
 
 out_fail:
         inode_dec_link_count(inode);
+        unlock_new_inode(inode);
         iput(inode);
         goto out;
 }
@@ -210,6 +213,7 @@ out:
 out_fail:
         inode_dec_link_count(inode);
         inode_dec_link_count(inode);
+        unlock_new_inode(inode);
         iput (inode);
         inode_dec_link_count(dir);
         unlock_ufs(dir->i_sb);
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 48d64e6ab292..290fbf0b6b8a 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -84,7 +84,7 @@ unsigned long iov_iter_alignment(const struct iov_iter *i);
 void iov_iter_init(struct iov_iter *i, int direction, const struct iovec *iov,
                         unsigned long nr_segs, size_t count);
 ssize_t iov_iter_get_pages(struct iov_iter *i, struct page **pages,
-                        unsigned maxpages, size_t *start);
+                        size_t maxsize, unsigned maxpages, size_t *start);
 ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, struct page ***pages,
                         size_t maxsize, size_t *start);
 int iov_iter_npages(const struct iov_iter *i, int maxpages);
diff --git a/mm/iov_iter.c b/mm/iov_iter.c
index ab88dc0ea1d3..9a09f2034fcc 100644
--- a/mm/iov_iter.c
+++ b/mm/iov_iter.c
@@ -310,7 +310,7 @@ void iov_iter_init(struct iov_iter *i, int direction,
 EXPORT_SYMBOL(iov_iter_init);
 
 static ssize_t get_pages_iovec(struct iov_iter *i,
-                   struct page **pages, unsigned maxpages,
+                   struct page **pages, size_t maxsize, unsigned maxpages,
                    size_t *start)
 {
         size_t offset = i->iov_offset;
@@ -323,6 +323,8 @@ static ssize_t get_pages_iovec(struct iov_iter *i,
         len = iov->iov_len - offset;
         if (len > i->count)
                 len = i->count;
+        if (len > maxsize)
+                len = maxsize;
         addr = (unsigned long)iov->iov_base + offset;
         len += *start = addr & (PAGE_SIZE - 1);
         if (len > maxpages * PAGE_SIZE)
@@ -588,13 +590,15 @@ static unsigned long alignment_bvec(const struct iov_iter *i)
 }
 
 static ssize_t get_pages_bvec(struct iov_iter *i,
-                   struct page **pages, unsigned maxpages,
+                   struct page **pages, size_t maxsize, unsigned maxpages,
                    size_t *start)
 {
         const struct bio_vec *bvec = i->bvec;
         size_t len = bvec->bv_len - i->iov_offset;
         if (len > i->count)
                 len = i->count;
+        if (len > maxsize)
+                len = maxsize;
         /* can't be more than PAGE_SIZE */
         *start = bvec->bv_offset + i->iov_offset;
 
@@ -711,13 +715,13 @@ unsigned long iov_iter_alignment(const struct iov_iter *i)
 EXPORT_SYMBOL(iov_iter_alignment);
 
 ssize_t iov_iter_get_pages(struct iov_iter *i,
-                   struct page **pages, unsigned maxpages,
+                   struct page **pages, size_t maxsize, unsigned maxpages,
                    size_t *start)
 {
         if (i->type & ITER_BVEC)
-                return get_pages_bvec(i, pages, maxpages, start);
+                return get_pages_bvec(i, pages, maxsize, maxpages, start);
         else
-                return get_pages_iovec(i, pages, maxpages, start);
+                return get_pages_iovec(i, pages, maxsize, maxpages, start);
 }
 EXPORT_SYMBOL(iov_iter_get_pages);
 
diff --git a/mm/shmem.c b/mm/shmem.c
index 0e5fb225007c..469f90d56051 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2367,8 +2367,10 @@ static int shmem_rename2(struct inode *old_dir, struct dentry *old_dentry, struc
 
         if (new_dentry->d_inode) {
                 (void) shmem_unlink(new_dir, new_dentry);
-                if (they_are_dirs)
+                if (they_are_dirs) {
+                        drop_nlink(new_dentry->d_inode);
                         drop_nlink(old_dir);
+                }
         } else if (they_are_dirs) {
                 drop_nlink(old_dir);
                 inc_nlink(new_dir);