mnt_want_write() is always called before lookup_hash_update(), so we can simplify the code by moving the call into that function. If lookup_hash_update() succeeds, it now will have claimed the want_write lock. If it fails, the want_write lock isn't held. Also lookup_hash_update() now receives a 'struct path'. Note that when creating a name, any error from mnt_want_write() does not get reported unless there is no other error. For unlink/rmdir though, an error from mnt_want_write() is immediately fatal - overriding ENOENT for example. This behaviour seems strange, but this patch is careful to preserve it. Signed-off-by: NeilBrown <neilb@xxxxxxx> --- fs/namei.c | 71 +++++++++++++++++++++++++----------------------------------- 1 file changed, 29 insertions(+), 42 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index e7a56d6e2472..83ce2f7083be 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1631,12 +1631,22 @@ static struct dentry *__lookup_hash(const struct qstr *name, * If not LOOKUP_CREATE, name should already exist, else -ENOENT */ static struct dentry *lookup_hash_update(const struct qstr *name, - struct dentry *base, unsigned int flags, + struct path *path, unsigned int flags, wait_queue_head_t *wq) { struct dentry *dentry; + struct dentry *base = path->dentry; struct inode *dir = base->d_inode; - int err; + int err, err2; + + /* For create, don't fail immediately if it's r/o, + * at least try to report other errors. + * For unlink/rmdir where LOOKUP_REVAl is the only + * flag, fail immediately if r/o. + */ + err2 = mnt_want_write(path->mnt); + if (err2 && (flags & ~LOOKUP_REVAL) == 0) + return ERR_PTR(err2); if (!(dir->i_flags & S_PAR_UPDATE)) wq = NULL; @@ -1675,6 +1685,11 @@ static struct dentry *lookup_hash_update(const struct qstr *name, dput(dentry); goto retry; } + if (err2) { + err = err2; + dput(dentry); + goto out_err; + } return dentry; out_err: @@ -1682,6 +1697,8 @@ static struct dentry *lookup_hash_update(const struct qstr *name, inode_unlock_shared(dir); else inode_unlock(dir); + if (!err2) + mnt_drop_write(path->mnt); return ERR_PTR(err); } @@ -1698,7 +1715,7 @@ struct dentry *lookup_hash_update_len(const char *name, int nlen, path->dentry, nlen, &this); if (err) return ERR_PTR(err); - return lookup_hash_update(&this, path->dentry, flags, wq); + return lookup_hash_update(&this, path, flags, wq); } EXPORT_SYMBOL(lookup_hash_update_len); @@ -3857,15 +3874,10 @@ static struct dentry *filename_create_one(struct qstr *last, struct path *path, unsigned int lookup_flags, wait_queue_head_t *wq) { - struct dentry *dentry; bool want_dir = lookup_flags & LOOKUP_DIRECTORY; unsigned int reval_flag = lookup_flags & LOOKUP_REVAL; unsigned int create_flag = LOOKUP_CREATE; - int err2; - int error; - /* don't fail immediately if it's r/o, at least try to report other errors */ - err2 = mnt_want_write(path->mnt); /* * Do the final lookup. Suppress 'create' if there is a trailing * '/', and a directory wasn't requested. @@ -3876,25 +3888,9 @@ static struct dentry *filename_create_one(struct qstr *last, struct path *path, * or -EEXIST. */ create_flag = 0; - dentry = lookup_hash_update(last, path->dentry, - reval_flag | create_flag | LOOKUP_EXCL, - wq); - if (IS_ERR(dentry)) - goto drop_write; - - if (unlikely(err2)) { - error = err2; - goto fail; - } - return dentry; -fail: - done_path_update(path, dentry, wq); - dput(dentry); - dentry = ERR_PTR(error); -drop_write: - if (!err2) - mnt_drop_write(path->mnt); - return dentry; + return lookup_hash_update(last, path, + reval_flag | create_flag | LOOKUP_EXCL, + wq); } struct dentry *filename_create_one_len(const char *name, int nlen, @@ -4269,23 +4265,18 @@ int do_rmdir(int dfd, struct filename *name) goto exit2; } - error = mnt_want_write(path.mnt); - if (error) - goto exit2; - - dentry = lookup_hash_update(&last, path.dentry, lookup_flags, &wq); + dentry = lookup_hash_update(&last, &path, lookup_flags, &wq); error = PTR_ERR(dentry); if (IS_ERR(dentry)) - goto exit3; + goto exit2; error = security_path_rmdir(&path, dentry); if (error) - goto exit4; + goto exit3; mnt_userns = mnt_user_ns(path.mnt); error = vfs_rmdir(mnt_userns, path.dentry->d_inode, dentry); -exit4: +exit3: done_path_update(&path, dentry, &wq); dput(dentry); -exit3: mnt_drop_write(path.mnt); exit2: path_put(&path); @@ -4402,12 +4393,8 @@ int do_unlinkat(int dfd, struct filename *name) if (type != LAST_NORM) goto exit2; - error = mnt_want_write(path.mnt); - if (error) - goto exit2; - retry_deleg: - dentry = lookup_hash_update(&last, path.dentry, lookup_flags, &wq); + dentry = lookup_hash_update(&last, &path, lookup_flags, &wq); error = PTR_ERR(dentry); if (!IS_ERR(dentry)) { struct user_namespace *mnt_userns; @@ -4426,6 +4413,7 @@ int do_unlinkat(int dfd, struct filename *name) exit3: done_path_update(&path, dentry, &wq); dput(dentry); + mnt_drop_write(path.mnt); } if (inode) iput(inode); /* truncate the inode here */ @@ -4435,7 +4423,6 @@ int do_unlinkat(int dfd, struct filename *name) if (!error) goto retry_deleg; } - mnt_drop_write(path.mnt); exit2: path_put(&path); if (retry_estale(error, lookup_flags)) {