8 files changed, 105 insertions, 17 deletions

diff --git a/fs/cachefiles/bind.c b/fs/cachefiles/bind.c
index 3797e0077b35..2906077ac798 100644
--- a/fs/cachefiles/bind.c
+++ b/fs/cachefiles/bind.c
@@ -84,7 +84,7 @@ int cachefiles_daemon_bind(struct cachefiles_cache *cache, char *args)
 static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache)
 {
         struct cachefiles_object *fsdef;
-        struct nameidata nd;
+        struct path path;
         struct kstatfs stats;
         struct dentry *graveyard, *cachedir, *root;
         const struct cred *saved_cred;
@@ -114,15 +114,12 @@ static int cachefiles_daemon_add_cache(struct cachefiles_cache *cache)
         _debug("- fsdef %p", fsdef);
 
         /* look up the directory at the root of the cache */
-        memset(&nd, 0, sizeof(nd));
-
-        ret = path_lookup(cache->rootdirname, LOOKUP_DIRECTORY, &nd);
+        ret = kern_path(cache->rootdirname, LOOKUP_DIRECTORY, &path);
         if (ret < 0)
                 goto error_open_root;
 
-        cache->mnt = mntget(nd.path.mnt);
-        root = dget(nd.path.dentry);
-        path_put(&nd.path);
+        cache->mnt = path.mnt;
+        root = path.dentry;
 
         /* check parameters */
         ret = -EOPNOTSUPP;
diff --git a/fs/cachefiles/daemon.c b/fs/cachefiles/daemon.c
index 4618516dd994..c2413561ea75 100644
--- a/fs/cachefiles/daemon.c
+++ b/fs/cachefiles/daemon.c
@@ -21,6 +21,7 @@
 #include <linux/mount.h>
 #include <linux/statfs.h>
 #include <linux/ctype.h>
+#include <linux/string.h>
 #include <linux/fs_struct.h>
 #include "internal.h"
 
@@ -257,8 +258,7 @@ static ssize_t cachefiles_daemon_write(struct file *file,
                 if (args == data)
                         goto error;
                 *args = '\0';
-                for (args++; isspace(*args); args++)
-                        continue;
+                args = skip_spaces(++args);
         }
 
         /* run the appropriate command handler */
diff --git a/fs/cachefiles/interface.c b/fs/cachefiles/interface.c
index 27089311fbea..37fe101a4e0d 100644
--- a/fs/cachefiles/interface.c
+++ b/fs/cachefiles/interface.c
@@ -9,6 +9,7 @@
  * 2 of the Licence, or (at your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/mount.h>
 #include <linux/buffer_head.h>
 #include "internal.h"
diff --git a/fs/cachefiles/internal.h b/fs/cachefiles/internal.h
index f7c255f9c624..a8cd821226da 100644
--- a/fs/cachefiles/internal.h
+++ b/fs/cachefiles/internal.h
@@ -34,6 +34,7 @@ struct cachefiles_object {
         loff_t                          i_size;         /* object size */
         unsigned long                   flags;
 #define CACHEFILES_OBJECT_ACTIVE        0               /* T if marked active */
+#define CACHEFILES_OBJECT_BURIED        1               /* T if preemptively buried */
         atomic_t                        usage;          /* object usage count */
         uint8_t                         type;           /* object type */
         uint8_t                         new;            /* T if object new */
diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
index 14ac4806e291..f4a7840bf42c 100644
--- a/fs/cachefiles/namei.c
+++ b/fs/cachefiles/namei.c
@@ -19,6 +19,7 @@
 #include <linux/mount.h>
 #include <linux/namei.h>
 #include <linux/security.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 #define CACHEFILES_KEYBUF_SIZE 512
@@ -92,6 +93,59 @@ static noinline void cachefiles_printk_object(struct cachefiles_object *object,
 }
 
 /*
+ * mark the owner of a dentry, if there is one, to indicate that that dentry
+ * has been preemptively deleted
+ * - the caller must hold the i_mutex on the dentry's parent as required to
+ *   call vfs_unlink(), vfs_rmdir() or vfs_rename()
+ */
+static void cachefiles_mark_object_buried(struct cachefiles_cache *cache,
+                                          struct dentry *dentry)
+{
+        struct cachefiles_object *object;
+        struct rb_node *p;
+
+        _enter(",'%*.*s'",
+               dentry->d_name.len, dentry->d_name.len, dentry->d_name.name);
+
+        write_lock(&cache->active_lock);
+
+        p = cache->active_nodes.rb_node;
+        while (p) {
+                object = rb_entry(p, struct cachefiles_object, active_node);
+                if (object->dentry > dentry)
+                        p = p->rb_left;
+                else if (object->dentry < dentry)
+                        p = p->rb_right;
+                else
+                        goto found_dentry;
+        }
+
+        write_unlock(&cache->active_lock);
+        _leave(" [no owner]");
+        return;
+
+        /* found the dentry for  */
+found_dentry:
+        kdebug("preemptive burial: OBJ%x [%s] %p",
+               object->fscache.debug_id,
+               fscache_object_states[object->fscache.state],
+               dentry);
+
+        if (object->fscache.state < FSCACHE_OBJECT_DYING) {
+                printk(KERN_ERR "\n");
+                printk(KERN_ERR "CacheFiles: Error:"
+                       " Can't preemptively bury live object\n");
+                cachefiles_printk_object(object, NULL);
+        } else if (test_and_set_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+                printk(KERN_ERR "CacheFiles: Error:"
+                       " Object already preemptively buried\n");
+        }
+
+        write_unlock(&cache->active_lock);
+        _leave(" [owner marked]");
+}
+
+/*
  * record the fact that an object is now active
  */
 static int cachefiles_mark_object_active(struct cachefiles_cache *cache,
@@ -218,7 +272,8 @@ requeue:
  */
 static int cachefiles_bury_object(struct cachefiles_cache *cache,
                                   struct dentry *dir,
-                                  struct dentry *rep)
+                                  struct dentry *rep,
+                                  bool preemptive)
 {
         struct dentry *grave, *trap;
         char nbuffer[8 + 8 + 1];
@@ -228,11 +283,16 @@ static int cachefiles_bury_object(struct cachefiles_cache *cache,
                dir->d_name.len, dir->d_name.len, dir->d_name.name,
                rep->d_name.len, rep->d_name.len, rep->d_name.name);
 
+        _debug("remove %p from %p", rep, dir);
+
         /* non-directories can just be unlinked */
         if (!S_ISDIR(rep->d_inode->i_mode)) {
                 _debug("unlink stale object");
                 ret = vfs_unlink(dir->d_inode, rep);
 
+                if (preemptive)
+                        cachefiles_mark_object_buried(cache, rep);
+
                 mutex_unlock(&dir->d_inode->i_mutex);
 
                 if (ret == -EIO)
@@ -324,6 +384,9 @@ try_again:
         if (ret != 0 && ret != -ENOMEM)
                 cachefiles_io_error(cache, "Rename failed with error %d", ret);
 
+        if (preemptive)
+                cachefiles_mark_object_buried(cache, rep);
+
         unlock_rename(cache->graveyard, dir);
         dput(grave);
         _leave(" = 0");
@@ -339,7 +402,7 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
         struct dentry *dir;
         int ret;
 
-        _enter(",{%p}", object->dentry);
+        _enter(",OBJ%x{%p}", object->fscache.debug_id, object->dentry);
 
         ASSERT(object->dentry);
         ASSERT(object->dentry->d_inode);
@@ -348,7 +411,27 @@ int cachefiles_delete_object(struct cachefiles_cache *cache,
         dir = dget_parent(object->dentry);
 
         mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
-        ret = cachefiles_bury_object(cache, dir, object->dentry);
+
+        if (test_bit(CACHEFILES_OBJECT_BURIED, &object->flags)) {
+                /* object allocation for the same key preemptively deleted this
+                 * object's file so that it could create its own file */
+                _debug("object preemptively buried");
+                mutex_unlock(&dir->d_inode->i_mutex);
+                ret = 0;
+        } else {
+                /* we need to check that our parent is _still_ our parent - it
+                 * may have been renamed */
+                if (dir == object->dentry->d_parent) {
+                        ret = cachefiles_bury_object(cache, dir,
+                                                     object->dentry, false);
+                } else {
+                        /* it got moved, presumably by cachefilesd culling it,
+                         * so it's no longer in the key path and we can ignore
+                         * it */
+                        mutex_unlock(&dir->d_inode->i_mutex);
+                        ret = 0;
+                }
+        }
 
         dput(dir);
         _leave(" = %d", ret);
@@ -370,7 +453,9 @@ int cachefiles_walk_to_object(struct cachefiles_object *parent,
         const char *name;
         int ret, nlen;
 
-        _enter("{%p},,%s,", parent->dentry, key);
+        _enter("OBJ%x{%p},OBJ%x,%s,",
+               parent->fscache.debug_id, parent->dentry,
+               object->fscache.debug_id, key);
 
         cache = container_of(parent->fscache.cache,
                              struct cachefiles_cache, cache);
@@ -498,7 +583,7 @@ lookup_again:
                          * mutex) */
                         object->dentry = NULL;
 
-                        ret = cachefiles_bury_object(cache, dir, next);
+                        ret = cachefiles_bury_object(cache, dir, next, true);
                         dput(next);
                         next = NULL;
 
@@ -817,7 +902,7 @@ int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
         /*  actually remove the victim (drops the dir mutex) */
         _debug("bury");
 
-        ret = cachefiles_bury_object(cache, dir, victim);
+        ret = cachefiles_bury_object(cache, dir, victim, false);
         if (ret < 0)
                 goto error;
 
diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
index a6c8c6fe8df9..0f0d41fbb03f 100644
--- a/fs/cachefiles/rdwr.c
+++ b/fs/cachefiles/rdwr.c
@@ -10,8 +10,8 @@
  */
 
 #include <linux/mount.h>
+#include <linux/slab.h>
 #include <linux/file.h>
-#include <linux/ima.h>
 #include "internal.h"
 
 /*
@@ -923,7 +923,6 @@ int cachefiles_write_page(struct fscache_storage *op, struct page *page)
         if (IS_ERR(file)) {
                 ret = PTR_ERR(file);
         } else {
-                ima_counts_get(file);
                 ret = -EIO;
                 if (file->f_op->write) {
                         pos = (loff_t) page->index << PAGE_SHIFT;
diff --git a/fs/cachefiles/security.c b/fs/cachefiles/security.c
index b5808cdb2232..039b5011d83b 100644
--- a/fs/cachefiles/security.c
+++ b/fs/cachefiles/security.c
@@ -77,6 +77,8 @@ static int cachefiles_check_cache_dir(struct cachefiles_cache *cache,
 /*
  * check the security details of the on-disk cache
  * - must be called with security override in force
+ * - must return with a security override in force - even in the case of an
+ *   error
  */
 int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
                                         struct dentry *root,
@@ -99,6 +101,8 @@ int cachefiles_determine_cache_security(struct cachefiles_cache *cache,
          * which create files */
         ret = set_create_files_as(new, root->d_inode);
         if (ret < 0) {
+                abort_creds(new);
+                cachefiles_begin_secure(cache, _saved_cred);
                 _leave(" = %d [cfa]", ret);
                 return ret;
         }
diff --git a/fs/cachefiles/xattr.c b/fs/cachefiles/xattr.c
index f3e7a0bf068b..e18b183b47e1 100644
--- a/fs/cachefiles/xattr.c
+++ b/fs/cachefiles/xattr.c
@@ -16,6 +16,7 @@
 #include <linux/fsnotify.h>
 #include <linux/quotaops.h>
 #include <linux/xattr.h>
+#include <linux/slab.h>
 #include "internal.h"
 
 static const char cachefiles_xattr_cache[] =