1 files changed, 53 insertions, 31 deletions

diff --git a/fs/namei.c b/fs/namei.c
index 8dc2b038d5d9..22f6e8d16aa8 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -104,7 +104,7 @@
  */
 /*
  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
- * implemented.  Let's see if raised priority of ->s_vfs_rename_sem gives
+ * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
  * any extra contention...
  */
 
@@ -546,6 +546,22 @@ struct path {
         struct dentry *dentry;
 };
 
+static inline void dput_path(struct path *path, struct nameidata *nd)
+{
+        dput(path->dentry);
+        if (path->mnt != nd->mnt)
+                mntput(path->mnt);
+}
+
+static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
+{
+        dput(nd->dentry);
+        if (nd->mnt != path->mnt)
+                mntput(nd->mnt);
+        nd->mnt = path->mnt;
+        nd->dentry = path->dentry;
+}
+
 static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
 {
         int error;
@@ -555,8 +571,11 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
         touch_atime(path->mnt, dentry);
         nd_set_link(nd, NULL);
 
-        if (path->mnt == nd->mnt)
-                mntget(path->mnt);
+        if (path->mnt != nd->mnt) {
+                path_to_nameidata(path, nd);
+                dget(dentry);
+        }
+        mntget(path->mnt);
         cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
         error = PTR_ERR(cookie);
         if (!IS_ERR(cookie)) {
@@ -573,22 +592,6 @@ static __always_inline int __do_follow_link(struct path *path, struct nameidata
         return error;
 }
 
-static inline void dput_path(struct path *path, struct nameidata *nd)
-{
-        dput(path->dentry);
-        if (path->mnt != nd->mnt)
-                mntput(path->mnt);
-}
-
-static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
-{
-        dput(nd->dentry);
-        if (nd->mnt != path->mnt)
-                mntput(nd->mnt);
-        nd->mnt = path->mnt;
-        nd->dentry = path->dentry;
-}
-
 /*
  * This limits recursive symlink follows to 8, while
  * limiting consecutive symlinks to 40.
@@ -1353,6 +1356,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
                 return -ENOENT;
 
         BUG_ON(victim->d_parent->d_inode != dir);
+        audit_inode_child(victim->d_name.name, victim->d_inode, dir->i_ino);
 
         error = permission(dir,MAY_WRITE | MAY_EXEC, NULL);
         if (error)
@@ -1422,7 +1426,7 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
                 return NULL;
         }
 
-        down(&p1->d_inode->i_sb->s_vfs_rename_sem);
+        mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
 
         for (p = p1; p->d_parent != p; p = p->d_parent) {
                 if (p->d_parent == p2) {
@@ -1450,7 +1454,7 @@ void unlock_rename(struct dentry *p1, struct dentry *p2)
         mutex_unlock(&p1->d_inode->i_mutex);
         if (p1 != p2) {
                 mutex_unlock(&p2->d_inode->i_mutex);
-                up(&p1->d_inode->i_sb->s_vfs_rename_sem);
+                mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
         }
 }
 
@@ -1472,7 +1476,7 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
         DQUOT_INIT(dir);
         error = dir->i_op->create(dir, dentry, mode, nd);
         if (!error)
-                fsnotify_create(dir, dentry->d_name.name);
+                fsnotify_create(dir, dentry);
         return error;
 }
 
@@ -1628,6 +1632,12 @@ do_last:
                 goto exit;
         }
 
+        if (IS_ERR(nd->intent.open.file)) {
+                mutex_unlock(&dir->d_inode->i_mutex);
+                error = PTR_ERR(nd->intent.open.file);
+                goto exit_dput;
+        }
+
         /* Negative dentry, just create the file */
         if (!path.dentry->d_inode) {
                 if (!IS_POSIXACL(dir->d_inode))
@@ -1793,7 +1803,7 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
         DQUOT_INIT(dir);
         error = dir->i_op->mknod(dir, dentry, mode, dev);
         if (!error)
-                fsnotify_create(dir, dentry->d_name.name);
+                fsnotify_create(dir, dentry);
         return error;
 }
 
@@ -1870,7 +1880,7 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
         DQUOT_INIT(dir);
         error = dir->i_op->mkdir(dir, dentry, mode);
         if (!error)
-                fsnotify_mkdir(dir, dentry->d_name.name);
+                fsnotify_mkdir(dir, dentry);
         return error;
 }
 
@@ -2133,7 +2143,7 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname, i
         DQUOT_INIT(dir);
         error = dir->i_op->symlink(dir, dentry, oldname);
         if (!error)
-                fsnotify_create(dir, dentry->d_name.name);
+                fsnotify_create(dir, dentry);
         return error;
 }
 
@@ -2210,7 +2220,7 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
         error = dir->i_op->link(old_dentry, dir, new_dentry);
         mutex_unlock(&old_dentry->d_inode->i_mutex);
         if (!error)
-                fsnotify_create(dir, new_dentry->d_name.name);
+                fsnotify_create(dir, new_dentry);
         return error;
 }
 
@@ -2277,17 +2287,17 @@ asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
  *      a) we can get into loop creation. Check is done in is_subdir().
  *      b) race potential - two innocent renames can create a loop together.
  *         That's where 4.4 screws up. Current fix: serialization on
- *         sb->s_vfs_rename_sem. We might be more accurate, but that's another
+ *         sb->s_vfs_rename_mutex. We might be more accurate, but that's another
  *         story.
  *      c) we have to lock _three_ objects - parents and victim (if it exists).
  *         And that - after we got ->i_mutex on parents (until then we don't know
  *         whether the target exists).  Solution: try to be smart with locking
  *         order for inodes.  We rely on the fact that tree topology may change
- *         only under ->s_vfs_rename_sem _and_ that parent of the object we
+ *         only under ->s_vfs_rename_mutex _and_ that parent of the object we
  *         move will be locked.  Thus we can rank directories by the tree
  *         (ancestors first) and rank all non-directories after them.
  *         That works since everybody except rename does "lock parent, lookup,
- *         lock child" and rename is under ->s_vfs_rename_sem.
+ *         lock child" and rename is under ->s_vfs_rename_mutex.
  *         HOWEVER, it relies on the assumption that any object with ->lookup()
  *         has no more than 1 dentry.  If "hybrid" objects will ever appear,
  *         we'd better make sure that there's no link(2) for them.
@@ -2621,16 +2631,27 @@ int __page_symlink(struct inode *inode, const char *symname, int len,
         int err = -ENOMEM;
         char *kaddr;
 
+retry:
         page = find_or_create_page(mapping, 0, gfp_mask);
         if (!page)
                 goto fail;
         err = mapping->a_ops->prepare_write(NULL, page, 0, len-1);
+        if (err == AOP_TRUNCATED_PAGE) {
+                page_cache_release(page);
+                goto retry;
+        }
         if (err)
                 goto fail_map;
         kaddr = kmap_atomic(page, KM_USER0);
         memcpy(kaddr, symname, len-1);
         kunmap_atomic(kaddr, KM_USER0);
-        mapping->a_ops->commit_write(NULL, page, 0, len-1);
+        err = mapping->a_ops->commit_write(NULL, page, 0, len-1);
+        if (err == AOP_TRUNCATED_PAGE) {
+                page_cache_release(page);
+                goto retry;
+        }
+        if (err)
+                goto fail_map;
         /*
          * Notice that we are _not_ going to block here - end of page is
          * unmapped, so this will only try to map the rest of page, see
@@ -2640,7 +2661,8 @@ int __page_symlink(struct inode *inode, const char *symname, int len,
          */
         if (!PageUptodate(page)) {
                 err = mapping->a_ops->readpage(NULL, page);
-                wait_on_page_locked(page);
+                if (err != AOP_TRUNCATED_PAGE)
+                        wait_on_page_locked(page);
         } else {
                 unlock_page(page);
         }