4 files changed, 113 insertions, 50 deletions

diff --git a/fs/dcache.c b/fs/dcache.c
index 83cfb834db03..b949af850cd6 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -229,7 +229,7 @@ static void __d_free(struct rcu_head *head)
  */
 static void d_free(struct dentry *dentry)
 {
-        BUG_ON(dentry->d_count);
+        BUG_ON(dentry->d_lockref.count);
         this_cpu_dec(nr_dentry);
         if (dentry->d_op && dentry->d_op->d_release)
                 dentry->d_op->d_release(dentry);
@@ -467,7 +467,7 @@ relock:
         }
 
         if (ref)
-                dentry->d_count--;
+                dentry->d_lockref.count--;
         /*
          * inform the fs via d_prune that this dentry is about to be
          * unhashed and destroyed.
@@ -513,15 +513,10 @@ void dput(struct dentry *dentry)
                 return;
 
 repeat:
-        if (dentry->d_count == 1)
+        if (dentry->d_lockref.count == 1)
                 might_sleep();
-        spin_lock(&dentry->d_lock);
-        BUG_ON(!dentry->d_count);
-        if (dentry->d_count > 1) {
-                dentry->d_count--;
-                spin_unlock(&dentry->d_lock);
+        if (lockref_put_or_lock(&dentry->d_lockref))
                 return;
-        }
 
         if (dentry->d_flags & DCACHE_OP_DELETE) {
                 if (dentry->d_op->d_delete(dentry))
@@ -535,7 +530,7 @@ repeat:
         dentry->d_flags |= DCACHE_REFERENCED;
         dentry_lru_add(dentry);
 
-        dentry->d_count--;
+        dentry->d_lockref.count--;
         spin_unlock(&dentry->d_lock);
         return;
 
@@ -590,7 +585,7 @@ int d_invalidate(struct dentry * dentry)
          * We also need to leave mountpoints alone,
          * directory or not.
          */
-        if (dentry->d_count > 1 && dentry->d_inode) {
+        if (dentry->d_lockref.count > 1 && dentry->d_inode) {
                 if (S_ISDIR(dentry->d_inode->i_mode) || d_mountpoint(dentry)) {
                         spin_unlock(&dentry->d_lock);
                         return -EBUSY;
@@ -606,14 +601,12 @@ EXPORT_SYMBOL(d_invalidate);
 /* This must be called with d_lock held */
 static inline void __dget_dlock(struct dentry *dentry)
 {
-        dentry->d_count++;
+        dentry->d_lockref.count++;
 }
 
 static inline void __dget(struct dentry *dentry)
 {
-        spin_lock(&dentry->d_lock);
-        __dget_dlock(dentry);
-        spin_unlock(&dentry->d_lock);
+        lockref_get(&dentry->d_lockref);
 }
 
 struct dentry *dget_parent(struct dentry *dentry)
@@ -634,8 +627,8 @@ repeat:
                 goto repeat;
         }
         rcu_read_unlock();
-        BUG_ON(!ret->d_count);
-        ret->d_count++;
+        BUG_ON(!ret->d_lockref.count);
+        ret->d_lockref.count++;
         spin_unlock(&ret->d_lock);
         return ret;
 }
@@ -718,7 +711,7 @@ restart:
         spin_lock(&inode->i_lock);
         hlist_for_each_entry(dentry, &inode->i_dentry, d_alias) {
                 spin_lock(&dentry->d_lock);
-                if (!dentry->d_count) {
+                if (!dentry->d_lockref.count) {
                         __dget_dlock(dentry);
                         __d_drop(dentry);
                         spin_unlock(&dentry->d_lock);
@@ -763,12 +756,8 @@ static void try_prune_one_dentry(struct dentry *dentry)
         /* Prune ancestors. */
         dentry = parent;
         while (dentry) {
-                spin_lock(&dentry->d_lock);
-                if (dentry->d_count > 1) {
-                        dentry->d_count--;
-                        spin_unlock(&dentry->d_lock);
+                if (lockref_put_or_lock(&dentry->d_lockref))
                         return;
-                }
                 dentry = dentry_kill(dentry, 1);
         }
 }
@@ -793,7 +782,7 @@ static void shrink_dentry_list(struct list_head *list)
                  * the LRU because of laziness during lookup.  Do not free
                  * it - just keep it off the LRU list.
                  */
-                if (dentry->d_count) {
+                if (dentry->d_lockref.count) {
                         dentry_lru_del(dentry);
                         spin_unlock(&dentry->d_lock);
                         continue;
@@ -913,7 +902,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
                         dentry_lru_del(dentry);
                         __d_shrink(dentry);
 
-                        if (dentry->d_count != 0) {
+                        if (dentry->d_lockref.count != 0) {
                                 printk(KERN_ERR
                                        "BUG: Dentry %p{i=%lx,n=%s}"
                                        " still in use (%d)"
@@ -922,7 +911,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
                                        dentry->d_inode ?
                                        dentry->d_inode->i_ino : 0UL,
                                        dentry->d_name.name,
-                                       dentry->d_count,
+                                       dentry->d_lockref.count,
                                        dentry->d_sb->s_type->name,
                                        dentry->d_sb->s_id);
                                 BUG();
@@ -933,7 +922,7 @@ static void shrink_dcache_for_umount_subtree(struct dentry *dentry)
                                 list_del(&dentry->d_u.d_child);
                         } else {
                                 parent = dentry->d_parent;
-                                parent->d_count--;
+                                parent->d_lockref.count--;
                                 list_del(&dentry->d_u.d_child);
                         }
 
@@ -981,7 +970,7 @@ void shrink_dcache_for_umount(struct super_block *sb)
 
         dentry = sb->s_root;
         sb->s_root = NULL;
-        dentry->d_count--;
+        dentry->d_lockref.count--;
         shrink_dcache_for_umount_subtree(dentry);
 
         while (!hlist_bl_empty(&sb->s_anon)) {
@@ -1147,7 +1136,7 @@ resume:
                  * loop in shrink_dcache_parent() might not make any progress
                  * and loop forever.
                  */
-                if (dentry->d_count) {
+                if (dentry->d_lockref.count) {
                         dentry_lru_del(dentry);
                 } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) {
                         dentry_lru_move_list(dentry, dispose);
@@ -1269,7 +1258,7 @@ struct dentry *__d_alloc(struct super_block *sb, const struct qstr *name)
         smp_wmb();
         dentry->d_name.name = dname;
 
-        dentry->d_count = 1;
+        dentry->d_lockref.count = 1;
         dentry->d_flags = 0;
         spin_lock_init(&dentry->d_lock);
         seqcount_init(&dentry->d_seq);
@@ -1970,7 +1959,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
                                 goto next;
                 }
 
-                dentry->d_count++;
+                dentry->d_lockref.count++;
                 found = dentry;
                 spin_unlock(&dentry->d_lock);
                 break;
@@ -2069,7 +2058,7 @@ again:
         spin_lock(&dentry->d_lock);
         inode = dentry->d_inode;
         isdir = S_ISDIR(inode->i_mode);
-        if (dentry->d_count == 1) {
+        if (dentry->d_lockref.count == 1) {
                 if (!spin_trylock(&inode->i_lock)) {
                         spin_unlock(&dentry->d_lock);
                         cpu_relax();
@@ -2948,7 +2937,7 @@ resume:
                 }
                 if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
                         dentry->d_flags |= DCACHE_GENOCIDE;
-                        dentry->d_count--;
+                        dentry->d_lockref.count--;
                 }
                 spin_unlock(&dentry->d_lock);
         }
@@ -2956,7 +2945,7 @@ resume:
                 struct dentry *child = this_parent;
                 if (!(this_parent->d_flags & DCACHE_GENOCIDE)) {
                         this_parent->d_flags |= DCACHE_GENOCIDE;
-                        this_parent->d_count--;
+                        this_parent->d_lockref.count--;
                 }
                 this_parent = try_to_ascend(this_parent, locked, seq);
                 if (!this_parent)
diff --git a/fs/namei.c b/fs/namei.c
index 89a612e392eb..7720fbd5277b 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -536,8 +536,8 @@ static int unlazy_walk(struct nameidata *nd, struct dentry *dentry)
                  * a reference at this point.
                  */
                 BUG_ON(!IS_ROOT(dentry) && dentry->d_parent != parent);
-                BUG_ON(!parent->d_count);
-                parent->d_count++;
+                BUG_ON(!parent->d_lockref.count);
+                parent->d_lockref.count++;
                 spin_unlock(&dentry->d_lock);
         }
         spin_unlock(&parent->d_lock);
@@ -3327,7 +3327,7 @@ void dentry_unhash(struct dentry *dentry)
 {
         shrink_dcache_parent(dentry);
         spin_lock(&dentry->d_lock);
-        if (dentry->d_count == 1)
+        if (dentry->d_lockref.count == 1)
                 __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
 }
@@ -3671,11 +3671,15 @@ SYSCALL_DEFINE5(linkat, int, olddfd, const char __user *, oldname,
         if ((flags & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH)) != 0)
                 return -EINVAL;
         /*
-         * Using empty names is equivalent to using AT_SYMLINK_FOLLOW
-         * on /proc/self/fd/<fd>.
+         * To use null names we require CAP_DAC_READ_SEARCH
+         * This ensures that not everyone will be able to create
+         * handlink using the passed filedescriptor.
          */
-        if (flags & AT_EMPTY_PATH)
+        if (flags & AT_EMPTY_PATH) {
+                if (!capable(CAP_DAC_READ_SEARCH))
+                        return -ENOENT;
                 how = LOOKUP_EMPTY;
+        }
 
         if (flags & AT_SYMLINK_FOLLOW)
                 how |= LOOKUP_FOLLOW;
diff --git a/include/linux/dcache.h b/include/linux/dcache.h
index 4a12532da8c4..efdc94434c30 100644
--- a/include/linux/dcache.h
+++ b/include/linux/dcache.h
@@ -9,6 +9,7 @@
 #include <linux/seqlock.h>
 #include <linux/cache.h>
 #include <linux/rcupdate.h>
+#include <linux/lockref.h>
 
 struct nameidata;
 struct path;
@@ -100,6 +101,8 @@ extern unsigned int full_name_hash(const unsigned char *, unsigned int);
 # endif
 #endif
 
+#define d_lock  d_lockref.lock
+
 struct dentry {
         /* RCU lookup touched fields */
         unsigned int d_flags;           /* protected by d_lock */
@@ -112,8 +115,7 @@ struct dentry {
         unsigned char d_iname[DNAME_INLINE_LEN];        /* small names */
 
         /* Ref lookup also touches following */
-        unsigned int d_count;           /* protected by d_lock */
-        spinlock_t d_lock;              /* per dentry lock */
+        struct lockref d_lockref;       /* per-dentry lock and refcount */
         const struct dentry_operations *d_op;
         struct super_block *d_sb;       /* The root of the dentry tree */
         unsigned long d_time;           /* used by d_revalidate */
@@ -318,7 +320,7 @@ static inline int __d_rcu_to_refcount(struct dentry *dentry, unsigned seq)
         assert_spin_locked(&dentry->d_lock);
         if (!read_seqcount_retry(&dentry->d_seq, seq)) {
                 ret = 1;
-                dentry->d_count++;
+                dentry->d_lockref.count++;
         }
 
         return ret;
@@ -326,7 +328,7 @@ static inline int __d_rcu_to_refcount(struct dentry *dentry, unsigned seq)
 
 static inline unsigned d_count(const struct dentry *dentry)
 {
-        return dentry->d_count;
+        return dentry->d_lockref.count;
 }
 
 /* validate "insecure" dentry pointer */
@@ -357,17 +359,14 @@ extern char *dentry_path(struct dentry *, char *, int);
 static inline struct dentry *dget_dlock(struct dentry *dentry)
 {
         if (dentry)
-                dentry->d_count++;
+                dentry->d_lockref.count++;
         return dentry;
 }
 
 static inline struct dentry *dget(struct dentry *dentry)
 {
-        if (dentry) {
-                spin_lock(&dentry->d_lock);
-                dget_dlock(dentry);
-                spin_unlock(&dentry->d_lock);
-        }
+        if (dentry)
+                lockref_get(&dentry->d_lockref);
         return dentry;
 }
 
diff --git a/include/linux/lockref.h b/include/linux/lockref.h
new file mode 100644
index 000000000000..01233e01627a
--- /dev/null
+++ b/include/linux/lockref.h
@@ -0,0 +1,71 @@
+#ifndef __LINUX_LOCKREF_H
+#define __LINUX_LOCKREF_H
+
+/*
+ * Locked reference counts.
+ *
+ * These are different from just plain atomic refcounts in that they
+ * are atomic with respect to the spinlock that goes with them.  In
+ * particular, there can be implementations that don't actually get
+ * the spinlock for the common decrement/increment operations, but they
+ * still have to check that the operation is done semantically as if
+ * the spinlock had been taken (using a cmpxchg operation that covers
+ * both the lock and the count word, or using memory transactions, for
+ * example).
+ */
+
+#include <linux/spinlock.h>
+
+struct lockref {
+        spinlock_t lock;
+        unsigned int count;
+};
+
+/**
+ * lockref_get - Increments reference count unconditionally
+ * @lockcnt: pointer to lockref structure
+ *
+ * This operation is only valid if you already hold a reference
+ * to the object, so you know the count cannot be zero.
+ */
+static inline void lockref_get(struct lockref *lockref)
+{
+        spin_lock(&lockref->lock);
+        lockref->count++;
+        spin_unlock(&lockref->lock);
+}
+
+/**
+ * lockref_get_not_zero - Increments count unless the count is 0
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count is 0
+ */
+static inline int lockref_get_not_zero(struct lockref *lockref)
+{
+        int retval = 0;
+
+        spin_lock(&lockref->lock);
+        if (lockref->count) {
+                lockref->count++;
+                retval = 1;
+        }
+        spin_unlock(&lockref->lock);
+        return retval;
+}
+
+/**
+ * lockref_put_or_lock - decrements count unless count <= 1 before decrement
+ * @lockcnt: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count <= 1 and lock taken
+ */
+static inline int lockref_put_or_lock(struct lockref *lockref)
+{
+        spin_lock(&lockref->lock);
+        if (lockref->count <= 1)
+                return 0;
+        lockref->count--;
+        spin_unlock(&lockref->lock);
+        return 1;
+}
+
+#endif /* __LINUX_LOCKREF_H */