1 files changed, 104 insertions, 69 deletions

diff --git a/fs/namei.c b/fs/namei.c
index dd78f01b6de8..fa8df81ce8ca 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -493,12 +493,21 @@ fail:
         return PTR_ERR(link);
 }
 
-static inline int __do_follow_link(struct dentry *dentry, struct nameidata *nd)
+struct path {
+        struct vfsmount *mnt;
+        struct dentry *dentry;
+};
+
+static inline int __do_follow_link(struct path *path, struct nameidata *nd)
 {
         int error;
+        struct dentry *dentry = path->dentry;
 
-        touch_atime(nd->mnt, dentry);
+        touch_atime(path->mnt, dentry);
         nd_set_link(nd, NULL);
+
+        if (path->mnt == nd->mnt)
+                mntget(path->mnt);
         error = dentry->d_inode->i_op->follow_link(dentry, nd);
         if (!error) {
                 char *s = nd_get_link(nd);
@@ -507,6 +516,8 @@ static inline int __do_follow_link(struct dentry *dentry, struct nameidata *nd)
                 if (dentry->d_inode->i_op->put_link)
                         dentry->d_inode->i_op->put_link(dentry, nd);
         }
+        dput(dentry);
+        mntput(path->mnt);
 
         return error;
 }
@@ -518,7 +529,7 @@ static inline int __do_follow_link(struct dentry *dentry, struct nameidata *nd)
  * Without that kind of total limit, nasty chains of consecutive
  * symlinks can cause almost arbitrarily long lookups. 
  */
-static inline int do_follow_link(struct dentry *dentry, struct nameidata *nd)
+static inline int do_follow_link(struct path *path, struct nameidata *nd)
 {
         int err = -ELOOP;
         if (current->link_count >= MAX_NESTED_LINKS)
@@ -527,17 +538,20 @@ static inline int do_follow_link(struct dentry *dentry, struct nameidata *nd)
                 goto loop;
         BUG_ON(nd->depth >= MAX_NESTED_LINKS);
         cond_resched();
-        err = security_inode_follow_link(dentry, nd);
+        err = security_inode_follow_link(path->dentry, nd);
         if (err)
                 goto loop;
         current->link_count++;
         current->total_link_count++;
         nd->depth++;
-        err = __do_follow_link(dentry, nd);
+        err = __do_follow_link(path, nd);
         current->link_count--;
         nd->depth--;
         return err;
 loop:
+        dput(path->dentry);
+        if (path->mnt != nd->mnt)
+                mntput(path->mnt);
         path_release(nd);
         return err;
 }
@@ -565,87 +579,91 @@ int follow_up(struct vfsmount **mnt, struct dentry **dentry)
 /* no need for dcache_lock, as serialization is taken care in
  * namespace.c
  */
-static int follow_mount(struct vfsmount **mnt, struct dentry **dentry)
+static int __follow_mount(struct path *path)
 {
         int res = 0;
+        while (d_mountpoint(path->dentry)) {
+                struct vfsmount *mounted = lookup_mnt(path->mnt, path->dentry);
+                if (!mounted)
+                        break;
+                dput(path->dentry);
+                if (res)
+                        mntput(path->mnt);
+                path->mnt = mounted;
+                path->dentry = dget(mounted->mnt_root);
+                res = 1;
+        }
+        return res;
+}
+
+static void follow_mount(struct vfsmount **mnt, struct dentry **dentry)
+{
         while (d_mountpoint(*dentry)) {
                 struct vfsmount *mounted = lookup_mnt(*mnt, *dentry);
                 if (!mounted)
                         break;
+                dput(*dentry);
                 mntput(*mnt);
                 *mnt = mounted;
-                dput(*dentry);
                 *dentry = dget(mounted->mnt_root);
-                res = 1;
         }
-        return res;
 }
 
 /* no need for dcache_lock, as serialization is taken care in
  * namespace.c
  */
-static inline int __follow_down(struct vfsmount **mnt, struct dentry **dentry)
+int follow_down(struct vfsmount **mnt, struct dentry **dentry)
 {
         struct vfsmount *mounted;
 
         mounted = lookup_mnt(*mnt, *dentry);
         if (mounted) {
+                dput(*dentry);
                 mntput(*mnt);
                 *mnt = mounted;
-                dput(*dentry);
                 *dentry = dget(mounted->mnt_root);
                 return 1;
         }
         return 0;
 }
 
-int follow_down(struct vfsmount **mnt, struct dentry **dentry)
-{
-        return __follow_down(mnt,dentry);
-}
- 
-static inline void follow_dotdot(struct vfsmount **mnt, struct dentry **dentry)
+static inline void follow_dotdot(struct nameidata *nd)
 {
         while(1) {
                 struct vfsmount *parent;
-                struct dentry *old = *dentry;
+                struct dentry *old = nd->dentry;
 
                 read_lock(&current->fs->lock);
-                if (*dentry == current->fs->root &&
-                    *mnt == current->fs->rootmnt) {
+                if (nd->dentry == current->fs->root &&
+                    nd->mnt == current->fs->rootmnt) {
                         read_unlock(&current->fs->lock);
                         break;
                 }
                 read_unlock(&current->fs->lock);
                 spin_lock(&dcache_lock);
-                if (*dentry != (*mnt)->mnt_root) {
-                        *dentry = dget((*dentry)->d_parent);
+                if (nd->dentry != nd->mnt->mnt_root) {
+                        nd->dentry = dget(nd->dentry->d_parent);
                         spin_unlock(&dcache_lock);
                         dput(old);
                         break;
                 }
                 spin_unlock(&dcache_lock);
                 spin_lock(&vfsmount_lock);
-                parent = (*mnt)->mnt_parent;
-                if (parent == *mnt) {
+                parent = nd->mnt->mnt_parent;
+                if (parent == nd->mnt) {
                         spin_unlock(&vfsmount_lock);
                         break;
                 }
                 mntget(parent);
-                *dentry = dget((*mnt)->mnt_mountpoint);
+                nd->dentry = dget(nd->mnt->mnt_mountpoint);
                 spin_unlock(&vfsmount_lock);
                 dput(old);
-                mntput(*mnt);
-                *mnt = parent;
+                mntput(nd->mnt);
+                nd->mnt = parent;
         }
-        follow_mount(mnt, dentry);
+        follow_mount(&nd->mnt, &nd->dentry);
 }
 
-struct path {
-        struct vfsmount *mnt;
-        struct dentry *dentry;
-};
-
 /*
  *  It's more convoluted than I'd like it to be, but... it's still fairly
  *  small and for now I'd prefer to have fast path as straight as possible.
@@ -664,6 +682,7 @@ static int do_lookup(struct nameidata *nd, struct qstr *name,
 done:
         path->mnt = mnt;
         path->dentry = dentry;
+        __follow_mount(path);
         return 0;
 
 need_lookup:
@@ -751,7 +770,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                         case 2: 
                                 if (this.name[1] != '.')
                                         break;
-                                follow_dotdot(&nd->mnt, &nd->dentry);
+                                follow_dotdot(nd);
                                 inode = nd->dentry->d_inode;
                                 /* fallthrough */
                         case 1:
@@ -771,8 +790,6 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                 err = do_lookup(nd, &this, &next);
                 if (err)
                         break;
-                /* Check mountpoints.. */
-                follow_mount(&next.mnt, &next.dentry);
 
                 err = -ENOENT;
                 inode = next.dentry->d_inode;
@@ -783,10 +800,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                         goto out_dput;
 
                 if (inode->i_op->follow_link) {
-                        mntget(next.mnt);
-                        err = do_follow_link(next.dentry, nd);
-                        dput(next.dentry);
-                        mntput(next.mnt);
+                        err = do_follow_link(&next, nd);
                         if (err)
                                 goto return_err;
                         err = -ENOENT;
@@ -798,6 +812,8 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                                 break;
                 } else {
                         dput(nd->dentry);
+                        if (nd->mnt != next.mnt)
+                                mntput(nd->mnt);
                         nd->mnt = next.mnt;
                         nd->dentry = next.dentry;
                 }
@@ -819,7 +835,7 @@ last_component:
                         case 2: 
                                 if (this.name[1] != '.')
                                         break;
-                                follow_dotdot(&nd->mnt, &nd->dentry);
+                                follow_dotdot(nd);
                                 inode = nd->dentry->d_inode;
                                 /* fallthrough */
                         case 1:
@@ -833,19 +849,17 @@ last_component:
                 err = do_lookup(nd, &this, &next);
                 if (err)
                         break;
-                follow_mount(&next.mnt, &next.dentry);
                 inode = next.dentry->d_inode;
                 if ((lookup_flags & LOOKUP_FOLLOW)
                     && inode && inode->i_op && inode->i_op->follow_link) {
-                        mntget(next.mnt);
-                        err = do_follow_link(next.dentry, nd);
-                        dput(next.dentry);
-                        mntput(next.mnt);
+                        err = do_follow_link(&next, nd);
                         if (err)
                                 goto return_err;
                         inode = nd->dentry->d_inode;
                 } else {
                         dput(nd->dentry);
+                        if (nd->mnt != next.mnt)
+                                mntput(nd->mnt);
                         nd->mnt = next.mnt;
                         nd->dentry = next.dentry;
                 }
@@ -885,6 +899,8 @@ return_base:
                 return 0;
 out_dput:
                 dput(next.dentry);
+                if (nd->mnt != next.mnt)
+                        mntput(next.mnt);
                 break;
         }
         path_release(nd);
@@ -1398,7 +1414,7 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
 int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
 {
         int acc_mode, error = 0;
-        struct dentry *dentry;
+        struct path path;
         struct dentry *dir;
         int count = 0;
 
@@ -1442,23 +1458,24 @@ int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
         dir = nd->dentry;
         nd->flags &= ~LOOKUP_PARENT;
         down(&dir->d_inode->i_sem);
-        dentry = __lookup_hash(&nd->last, nd->dentry, nd);
+        path.dentry = __lookup_hash(&nd->last, nd->dentry, nd);
+        path.mnt = nd->mnt;
 
 do_last:
-        error = PTR_ERR(dentry);
-        if (IS_ERR(dentry)) {
+        error = PTR_ERR(path.dentry);
+        if (IS_ERR(path.dentry)) {
                 up(&dir->d_inode->i_sem);
                 goto exit;
         }
 
         /* Negative dentry, just create the file */
-        if (!dentry->d_inode) {
+        if (!path.dentry->d_inode) {
                 if (!IS_POSIXACL(dir->d_inode))
                         mode &= ~current->fs->umask;
-                error = vfs_create(dir->d_inode, dentry, mode, nd);
+                error = vfs_create(dir->d_inode, path.dentry, mode, nd);
                 up(&dir->d_inode->i_sem);
                 dput(nd->dentry);
-                nd->dentry = dentry;
+                nd->dentry = path.dentry;
                 if (error)
                         goto exit;
                 /* Don't check for write permission, don't truncate */
@@ -1476,22 +1493,24 @@ do_last:
         if (flag & O_EXCL)
                 goto exit_dput;
 
-        if (d_mountpoint(dentry)) {
+        if (__follow_mount(&path)) {
                 error = -ELOOP;
                 if (flag & O_NOFOLLOW)
                         goto exit_dput;
-                while (__follow_down(&nd->mnt,&dentry) && d_mountpoint(dentry));
         }
         error = -ENOENT;
-        if (!dentry->d_inode)
+        if (!path.dentry->d_inode)
                 goto exit_dput;
-        if (dentry->d_inode->i_op && dentry->d_inode->i_op->follow_link)
+        if (path.dentry->d_inode->i_op && path.dentry->d_inode->i_op->follow_link)
                 goto do_link;
 
         dput(nd->dentry);
-        nd->dentry = dentry;
+        nd->dentry = path.dentry;
+        if (nd->mnt != path.mnt)
+                mntput(nd->mnt);
+        nd->mnt = path.mnt;
         error = -EISDIR;
-        if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))
+        if (path.dentry->d_inode && S_ISDIR(path.dentry->d_inode->i_mode))
                 goto exit;
 ok:
         error = may_open(nd, acc_mode, flag);
@@ -1500,7 +1519,9 @@ ok:
         return 0;
 
 exit_dput:
-        dput(dentry);
+        dput(path.dentry);
+        if (nd->mnt != path.mnt)
+                mntput(path.mnt);
 exit:
         path_release(nd);
         return error;
@@ -1520,18 +1541,15 @@ do_link:
          * are done. Procfs-like symlinks just set LAST_BIND.
          */
         nd->flags |= LOOKUP_PARENT;
-        error = security_inode_follow_link(dentry, nd);
+        error = security_inode_follow_link(path.dentry, nd);
         if (error)
                 goto exit_dput;
-        error = __do_follow_link(dentry, nd);
-        dput(dentry);
+        error = __do_follow_link(&path, nd);
         if (error)
                 return error;
         nd->flags &= ~LOOKUP_PARENT;
-        if (nd->last_type == LAST_BIND) {
-                dentry = nd->dentry;
+        if (nd->last_type == LAST_BIND)
                 goto ok;
-        }
         error = -EISDIR;
         if (nd->last_type != LAST_NORM)
                 goto exit;
@@ -1546,7 +1564,8 @@ do_link:
         }
         dir = nd->dentry;
         down(&dir->d_inode->i_sem);
-        dentry = __lookup_hash(&nd->last, nd->dentry, nd);
+        path.dentry = __lookup_hash(&nd->last, nd->dentry, nd);
+        path.mnt = nd->mnt;
         putname(nd->last.name);
         goto do_last;
 }
@@ -1558,19 +1577,35 @@ do_link:
  *
  * Simple function to lookup and return a dentry and create it
  * if it doesn't exist.  Is SMP-safe.
+ *
+ * Returns with nd->dentry->d_inode->i_sem locked.
  */
 struct dentry *lookup_create(struct nameidata *nd, int is_dir)
 {
-        struct dentry *dentry;
+        struct dentry *dentry = ERR_PTR(-EEXIST);
 
         down(&nd->dentry->d_inode->i_sem);
-        dentry = ERR_PTR(-EEXIST);
+        /*
+         * Yucky last component or no last component at all?
+         * (foo/., foo/.., /////)
+         */
         if (nd->last_type != LAST_NORM)
                 goto fail;
         nd->flags &= ~LOOKUP_PARENT;
+
+        /*
+         * Do the final lookup.
+         */
         dentry = lookup_hash(&nd->last, nd->dentry);
         if (IS_ERR(dentry))
                 goto fail;
+
+        /*
+         * Special case - lookup gave negative, but... we had foo/bar/
+         * From the vfs_mknod() POV we just have a negative dentry -
+         * all is fine. Let's be bastards - you had / on the end, you've
+         * been asking for (non-existent) directory. -ENOENT for you.
+         */
         if (!is_dir && nd->last.name[nd->last.len] && !dentry->d_inode)
                 goto enoent;
         return dentry;