3 files changed, 65 insertions, 4 deletions

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 2c3eb33b904d..abdf38d5971d 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1169,11 +1169,23 @@ static void nfs_dentry_iput(struct dentry *dentry, struct inode *inode)
         iput(inode);
 }
 
+static void nfs_d_release(struct dentry *dentry)
+{
+        /* free cached devname value, if it survived that far */
+        if (unlikely(dentry->d_fsdata)) {
+                if (dentry->d_flags & DCACHE_NFSFS_RENAMED)
+                        WARN_ON(1);
+                else
+                        kfree(dentry->d_fsdata);
+        }
+}
+
 const struct dentry_operations nfs_dentry_operations = {
         .d_revalidate   = nfs_lookup_revalidate,
         .d_delete       = nfs_dentry_delete,
         .d_iput         = nfs_dentry_iput,
         .d_automount    = nfs_d_automount,
+        .d_release      = nfs_d_release,
 };
 
 static struct dentry *nfs_lookup(struct inode *dir, struct dentry * dentry, struct nameidata *nd)
@@ -1248,6 +1260,7 @@ const struct dentry_operations nfs4_dentry_operations = {
         .d_delete       = nfs_dentry_delete,
         .d_iput         = nfs_dentry_iput,
         .d_automount    = nfs_d_automount,
+        .d_release      = nfs_d_release,
 };
 
 /*
diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 4d6e5a317e6d..1084792bc0fe 100644
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -82,12 +82,18 @@ struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh,
         struct nfs_fsinfo fsinfo;
         struct dentry *ret;
         struct inode *inode;
+        void *name = kstrdup(devname, GFP_KERNEL);
         int error;
 
+        if (!name)
+                return ERR_PTR(-ENOMEM);
+
         /* get the actual root for this mount */
         fsinfo.fattr = nfs_alloc_fattr();
-        if (fsinfo.fattr == NULL)
+        if (fsinfo.fattr == NULL) {
+                kfree(name);
                 return ERR_PTR(-ENOMEM);
+        }
 
         error = server->nfs_client->rpc_ops->getroot(server, mntfh, &fsinfo);
         if (error < 0) {
@@ -120,7 +126,15 @@ struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh,
         }
 
         security_d_instantiate(ret, inode);
+        spin_lock(&ret->d_lock);
+        if (IS_ROOT(ret) && !(ret->d_flags & DCACHE_NFSFS_RENAMED)) {
+                ret->d_fsdata = name;
+                name = NULL;
+        }
+        spin_unlock(&ret->d_lock);
 out:
+        if (name)
+                kfree(name);
         nfs_free_fattr(fsinfo.fattr);
         return ret;
 }
@@ -177,21 +191,28 @@ struct dentry *nfs4_get_root(struct super_block *sb, struct nfs_fh *mntfh,
         struct nfs_fattr *fattr = NULL;
         struct dentry *ret;
         struct inode *inode;
+        void *name = kstrdup(devname, GFP_KERNEL);
         int error;
 
         dprintk("--> nfs4_get_root()\n");
 
+        if (!name)
+                return ERR_PTR(-ENOMEM);
+
         /* get the info about the server and filesystem */
         error = nfs4_server_capabilities(server, mntfh);
         if (error < 0) {
                 dprintk("nfs_get_root: getcaps error = %d\n",
                         -error);
+                kfree(name);
                 return ERR_PTR(error);
         }
 
         fattr = nfs_alloc_fattr();
-        if (fattr == NULL)
-                return ERR_PTR(-ENOMEM);;
+        if (fattr == NULL) {
+                kfree(name);
+                return ERR_PTR(-ENOMEM);
+        }
 
         /* get the actual root for this mount */
         error = server->nfs_client->rpc_ops->getattr(server, mntfh, fattr);
@@ -225,8 +246,15 @@ struct dentry *nfs4_get_root(struct super_block *sb, struct nfs_fh *mntfh,
         }
 
         security_d_instantiate(ret, inode);
-
+        spin_lock(&ret->d_lock);
+        if (IS_ROOT(ret) && !(ret->d_flags & DCACHE_NFSFS_RENAMED)) {
+                ret->d_fsdata = name;
+                name = NULL;
+        }
+        spin_unlock(&ret->d_lock);
 out:
+        if (name)
+                kfree(name);
         nfs_free_fattr(fattr);
         dprintk("<-- nfs4_get_root()\n");
         return ret;
diff --git a/fs/nfs/unlink.c b/fs/nfs/unlink.c
index 6481d537d69d..8d6864c2a5fa 100644
--- a/fs/nfs/unlink.c
+++ b/fs/nfs/unlink.c
@@ -148,6 +148,7 @@ static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct n
         alias = d_lookup(parent, &data->args.name);
         if (alias != NULL) {
                 int ret = 0;
+                void *devname_garbage = NULL;
 
                 /*
                  * Hey, we raced with lookup... See if we need to transfer
@@ -157,6 +158,7 @@ static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct n
                 spin_lock(&alias->d_lock);
                 if (alias->d_inode != NULL &&
                     !(alias->d_flags & DCACHE_NFSFS_RENAMED)) {
+                        devname_garbage = alias->d_fsdata;
                         alias->d_fsdata = data;
                         alias->d_flags |= DCACHE_NFSFS_RENAMED;
                         ret = 1;
@@ -164,6 +166,13 @@ static int nfs_do_call_unlink(struct dentry *parent, struct inode *dir, struct n
                 spin_unlock(&alias->d_lock);
                 nfs_dec_sillycount(dir);
                 dput(alias);
+                /*
+                 * If we'd displaced old cached devname, free it.  At that
+                 * point dentry is definitely not a root, so we won't need
+                 * that anymore.
+                 */
+                if (devname_garbage)
+                        kfree(devname_garbage);
                 return ret;
         }
         data->dir = igrab(dir);
@@ -252,6 +261,7 @@ nfs_async_unlink(struct inode *dir, struct dentry *dentry)
 {
         struct nfs_unlinkdata *data;
         int status = -ENOMEM;
+        void *devname_garbage = NULL;
 
         data = kzalloc(sizeof(*data), GFP_KERNEL);
         if (data == NULL)
@@ -269,8 +279,16 @@ nfs_async_unlink(struct inode *dir, struct dentry *dentry)
         if (dentry->d_flags & DCACHE_NFSFS_RENAMED)
                 goto out_unlock;
         dentry->d_flags |= DCACHE_NFSFS_RENAMED;
+        devname_garbage = dentry->d_fsdata;
         dentry->d_fsdata = data;
         spin_unlock(&dentry->d_lock);
+        /*
+         * If we'd displaced old cached devname, free it.  At that
+         * point dentry is definitely not a root, so we won't need
+         * that anymore.
+         */
+        if (devname_garbage)
+                kfree(devname_garbage);
         return 0;
 out_unlock:
         spin_unlock(&dentry->d_lock);
@@ -299,6 +317,7 @@ nfs_complete_unlink(struct dentry *dentry, struct inode *inode)
         if (dentry->d_flags & DCACHE_NFSFS_RENAMED) {
                 dentry->d_flags &= ~DCACHE_NFSFS_RENAMED;
                 data = dentry->d_fsdata;
+                dentry->d_fsdata = NULL;
         }
         spin_unlock(&dentry->d_lock);
 
@@ -315,6 +334,7 @@ nfs_cancel_async_unlink(struct dentry *dentry)
                 struct nfs_unlinkdata *data = dentry->d_fsdata;
 
                 dentry->d_flags &= ~DCACHE_NFSFS_RENAMED;
+                dentry->d_fsdata = NULL;
                 spin_unlock(&dentry->d_lock);
                 nfs_free_unlinkdata(data);
                 return;