[PARISC] Add __user annotation to eisa_eeprom.c
[safe/jmp/linux-2.6] / fs / namei.c
index abeec34..0a8f073 100644 (file)
 #include <linux/namei.h>
 #include <linux/quotaops.h>
 #include <linux/pagemap.h>
-#include <linux/dnotify.h>
+#include <linux/fsnotify.h>
 #include <linux/smp_lock.h>
 #include <linux/personality.h>
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/mount.h>
 #include <linux/audit.h>
+#include <linux/file.h>
 #include <asm/namei.h>
 #include <asm/uaccess.h>
 
@@ -255,6 +256,38 @@ int permission(struct inode *inode, int mask, struct nameidata *nd)
        return security_inode_permission(inode, mask, nd);
 }
 
+/**
+ * vfs_permission  -  check for access rights to a given path
+ * @nd:                lookup result that describes the path
+ * @mask:      right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
+ *
+ * Used to check for read/write/execute permissions on a path.
+ * We use "fsuid" for this, letting us set arbitrary permissions
+ * for filesystem access without changing the "normal" uids which
+ * are used for other things.
+ */
+int vfs_permission(struct nameidata *nd, int mask)
+{
+       return permission(nd->dentry->d_inode, mask, nd);
+}
+
+/**
+ * file_permission  -  check for additional access rights to a given file
+ * @file:      file to check access rights for
+ * @mask:      right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
+ *
+ * Used to check for read/write/execute permissions on an already opened
+ * file.
+ *
+ * Note:
+ *     Do not use this function in new code.  All access checks should
+ *     be done using vfs_permission().
+ */
+int file_permission(struct file *file, int mask)
+{
+       return permission(file->f_dentry->d_inode, mask, NULL);
+}
+
 /*
  * get_write_access() gets write permission for a file.
  * put_write_access() releases this write permission.
@@ -314,7 +347,19 @@ void path_release(struct nameidata *nd)
 void path_release_on_umount(struct nameidata *nd)
 {
        dput(nd->dentry);
-       _mntput(nd->mnt);
+       mntput_no_expire(nd->mnt);
+}
+
+/**
+ * release_open_intent - free up open intent resources
+ * @nd: pointer to nameidata
+ */
+void release_open_intent(struct nameidata *nd)
+{
+       if (nd->intent.open.file->f_dentry == NULL)
+               put_filp(nd->intent.open.file);
+       else
+               fput(nd->intent.open.file);
 }
 
 /*
@@ -393,7 +438,7 @@ static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, s
        struct dentry * result;
        struct inode *dir = parent->d_inode;
 
-       down(&dir->i_sem);
+       mutex_lock(&dir->i_mutex);
        /*
         * First re-do the cached lookup just in case it was created
         * while we waited for the directory semaphore..
@@ -419,7 +464,7 @@ static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, s
                        else
                                result = dentry;
                }
-               up(&dir->i_sem);
+               mutex_unlock(&dir->i_mutex);
                return result;
        }
 
@@ -427,7 +472,7 @@ static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, s
         * Uhhuh! Nasty case: the cache was re-populated while
         * we waited on the semaphore. Need to revalidate.
         */
-       up(&dir->i_sem);
+       mutex_unlock(&dir->i_mutex);
        if (result->d_op && result->d_op->d_revalidate) {
                if (!result->d_op->d_revalidate(result, nd) && !d_invalidate(result)) {
                        dput(result);
@@ -498,24 +543,49 @@ struct path {
        struct dentry *dentry;
 };
 
-static inline int __do_follow_link(struct dentry *dentry, struct nameidata *nd)
+static inline int __do_follow_link(struct path *path, struct nameidata *nd)
 {
        int error;
+       void *cookie;
+       struct dentry *dentry = path->dentry;
 
-       touch_atime(nd->mnt, dentry);
+       touch_atime(path->mnt, dentry);
        nd_set_link(nd, NULL);
-       error = dentry->d_inode->i_op->follow_link(dentry, nd);
-       if (!error) {
+
+       if (path->mnt == nd->mnt)
+               mntget(path->mnt);
+       cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
+       error = PTR_ERR(cookie);
+       if (!IS_ERR(cookie)) {
                char *s = nd_get_link(nd);
+               error = 0;
                if (s)
                        error = __vfs_follow_link(nd, s);
                if (dentry->d_inode->i_op->put_link)
-                       dentry->d_inode->i_op->put_link(dentry, nd);
+                       dentry->d_inode->i_op->put_link(dentry, nd, cookie);
        }
+       dput(dentry);
+       mntput(path->mnt);
 
        return error;
 }
 
+static inline void dput_path(struct path *path, struct nameidata *nd)
+{
+       dput(path->dentry);
+       if (path->mnt != nd->mnt)
+               mntput(path->mnt);
+}
+
+static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
+{
+       dput(nd->dentry);
+       if (nd->mnt != path->mnt)
+               mntput(nd->mnt);
+       nd->mnt = path->mnt;
+       nd->dentry = path->dentry;
+}
+
 /*
  * This limits recursive symlink follows to 8, while
  * limiting consecutive symlinks to 40.
@@ -538,11 +608,12 @@ static inline int do_follow_link(struct path *path, struct nameidata *nd)
        current->link_count++;
        current->total_link_count++;
        nd->depth++;
-       err = __do_follow_link(path->dentry, nd);
+       err = __do_follow_link(path, nd);
        current->link_count--;
        nd->depth--;
        return err;
 loop:
+       dput_path(path, nd);
        path_release(nd);
        return err;
 }
@@ -570,80 +641,89 @@ int follow_up(struct vfsmount **mnt, struct dentry **dentry)
 /* no need for dcache_lock, as serialization is taken care in
  * namespace.c
  */
-static int follow_mount(struct vfsmount **mnt, struct dentry **dentry)
+static int __follow_mount(struct path *path)
 {
        int res = 0;
+       while (d_mountpoint(path->dentry)) {
+               struct vfsmount *mounted = lookup_mnt(path->mnt, path->dentry);
+               if (!mounted)
+                       break;
+               dput(path->dentry);
+               if (res)
+                       mntput(path->mnt);
+               path->mnt = mounted;
+               path->dentry = dget(mounted->mnt_root);
+               res = 1;
+       }
+       return res;
+}
+
+static void follow_mount(struct vfsmount **mnt, struct dentry **dentry)
+{
        while (d_mountpoint(*dentry)) {
                struct vfsmount *mounted = lookup_mnt(*mnt, *dentry);
                if (!mounted)
                        break;
+               dput(*dentry);
                mntput(*mnt);
                *mnt = mounted;
-               dput(*dentry);
                *dentry = dget(mounted->mnt_root);
-               res = 1;
        }
-       return res;
 }
 
 /* no need for dcache_lock, as serialization is taken care in
  * namespace.c
  */
-static inline int __follow_down(struct vfsmount **mnt, struct dentry **dentry)
+int follow_down(struct vfsmount **mnt, struct dentry **dentry)
 {
        struct vfsmount *mounted;
 
        mounted = lookup_mnt(*mnt, *dentry);
        if (mounted) {
+               dput(*dentry);
                mntput(*mnt);
                *mnt = mounted;
-               dput(*dentry);
                *dentry = dget(mounted->mnt_root);
                return 1;
        }
        return 0;
 }
 
-int follow_down(struct vfsmount **mnt, struct dentry **dentry)
-{
-       return __follow_down(mnt,dentry);
-}
-static inline void follow_dotdot(struct vfsmount **mnt, struct dentry **dentry)
+static inline void follow_dotdot(struct nameidata *nd)
 {
        while(1) {
                struct vfsmount *parent;
-               struct dentry *old = *dentry;
+               struct dentry *old = nd->dentry;
 
                 read_lock(&current->fs->lock);
-               if (*dentry == current->fs->root &&
-                   *mnt == current->fs->rootmnt) {
+               if (nd->dentry == current->fs->root &&
+                   nd->mnt == current->fs->rootmnt) {
                         read_unlock(&current->fs->lock);
                        break;
                }
                 read_unlock(&current->fs->lock);
                spin_lock(&dcache_lock);
-               if (*dentry != (*mnt)->mnt_root) {
-                       *dentry = dget((*dentry)->d_parent);
+               if (nd->dentry != nd->mnt->mnt_root) {
+                       nd->dentry = dget(nd->dentry->d_parent);
                        spin_unlock(&dcache_lock);
                        dput(old);
                        break;
                }
                spin_unlock(&dcache_lock);
                spin_lock(&vfsmount_lock);
-               parent = (*mnt)->mnt_parent;
-               if (parent == *mnt) {
+               parent = nd->mnt->mnt_parent;
+               if (parent == nd->mnt) {
                        spin_unlock(&vfsmount_lock);
                        break;
                }
                mntget(parent);
-               *dentry = dget((*mnt)->mnt_mountpoint);
+               nd->dentry = dget(nd->mnt->mnt_mountpoint);
                spin_unlock(&vfsmount_lock);
                dput(old);
-               mntput(*mnt);
-               *mnt = parent;
+               mntput(nd->mnt);
+               nd->mnt = parent;
        }
-       follow_mount(mnt, dentry);
+       follow_mount(&nd->mnt, &nd->dentry);
 }
 
 /*
@@ -664,6 +744,7 @@ static int do_lookup(struct nameidata *nd, struct qstr *name,
 done:
        path->mnt = mnt;
        path->dentry = dentry;
+       __follow_mount(path);
        return 0;
 
 need_lookup:
@@ -714,10 +795,10 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                struct qstr this;
                unsigned int c;
 
+               nd->flags |= LOOKUP_CONTINUE;
                err = exec_permission_lite(inode, nd);
-               if (err == -EAGAIN) { 
-                       err = permission(inode, MAY_EXEC, nd);
-               }
+               if (err == -EAGAIN)
+                       err = vfs_permission(nd, MAY_EXEC);
                if (err)
                        break;
 
@@ -751,7 +832,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                        case 2: 
                                if (this.name[1] != '.')
                                        break;
-                               follow_dotdot(&nd->mnt, &nd->dentry);
+                               follow_dotdot(nd);
                                inode = nd->dentry->d_inode;
                                /* fallthrough */
                        case 1:
@@ -766,13 +847,10 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                        if (err < 0)
                                break;
                }
-               nd->flags |= LOOKUP_CONTINUE;
                /* This does the actual lookups.. */
                err = do_lookup(nd, &this, &next);
                if (err)
                        break;
-               /* Check mountpoints.. */
-               follow_mount(&next.mnt, &next.dentry);
 
                err = -ENOENT;
                inode = next.dentry->d_inode;
@@ -783,10 +861,7 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                        goto out_dput;
 
                if (inode->i_op->follow_link) {
-                       mntget(next.mnt);
                        err = do_follow_link(&next, nd);
-                       dput(next.dentry);
-                       mntput(next.mnt);
                        if (err)
                                goto return_err;
                        err = -ENOENT;
@@ -796,11 +871,8 @@ static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
                        err = -ENOTDIR; 
                        if (!inode->i_op)
                                break;
-               } else {
-                       dput(nd->dentry);
-                       nd->mnt = next.mnt;
-                       nd->dentry = next.dentry;
-               }
+               } else
+                       path_to_nameidata(&next, nd);
                err = -ENOTDIR; 
                if (!inode->i_op->lookup)
                        break;
@@ -819,7 +891,7 @@ last_component:
                        case 2: 
                                if (this.name[1] != '.')
                                        break;
-                               follow_dotdot(&nd->mnt, &nd->dentry);
+                               follow_dotdot(nd);
                                inode = nd->dentry->d_inode;
                                /* fallthrough */
                        case 1:
@@ -833,22 +905,15 @@ last_component:
                err = do_lookup(nd, &this, &next);
                if (err)
                        break;
-               follow_mount(&next.mnt, &next.dentry);
                inode = next.dentry->d_inode;
                if ((lookup_flags & LOOKUP_FOLLOW)
                    && inode && inode->i_op && inode->i_op->follow_link) {
-                       mntget(next.mnt);
                        err = do_follow_link(&next, nd);
-                       dput(next.dentry);
-                       mntput(next.mnt);
                        if (err)
                                goto return_err;
                        inode = nd->dentry->d_inode;
-               } else {
-                       dput(nd->dentry);
-                       nd->mnt = next.mnt;
-                       nd->dentry = next.dentry;
-               }
+               } else
+                       path_to_nameidata(&next, nd);
                err = -ENOENT;
                if (!inode)
                        break;
@@ -884,7 +949,7 @@ return_reval:
 return_base:
                return 0;
 out_dput:
-               dput(next.dentry);
+               dput_path(&next, nd);
                break;
        }
        path_release(nd);
@@ -1027,10 +1092,75 @@ int fastcall path_lookup(const char *name, unsigned int flags, struct nameidata
 out:
        if (unlikely(current->audit_context
                     && nd && nd->dentry && nd->dentry->d_inode))
-               audit_inode(name, nd->dentry->d_inode);
+               audit_inode(name, nd->dentry->d_inode, flags);
        return retval;
 }
 
+static int __path_lookup_intent_open(const char *name, unsigned int lookup_flags,
+               struct nameidata *nd, int open_flags, int create_mode)
+{
+       struct file *filp = get_empty_filp();
+       int err;
+
+       if (filp == NULL)
+               return -ENFILE;
+       nd->intent.open.file = filp;
+       nd->intent.open.flags = open_flags;
+       nd->intent.open.create_mode = create_mode;
+       err = path_lookup(name, lookup_flags|LOOKUP_OPEN, nd);
+       if (IS_ERR(nd->intent.open.file)) {
+               if (err == 0) {
+                       err = PTR_ERR(nd->intent.open.file);
+                       path_release(nd);
+               }
+       } else if (err != 0)
+               release_open_intent(nd);
+       return err;
+}
+
+/**
+ * path_lookup_open - lookup a file path with open intent
+ * @name: pointer to file name
+ * @lookup_flags: lookup intent flags
+ * @nd: pointer to nameidata
+ * @open_flags: open intent flags
+ */
+int path_lookup_open(const char *name, unsigned int lookup_flags,
+               struct nameidata *nd, int open_flags)
+{
+       return __path_lookup_intent_open(name, lookup_flags, nd,
+                       open_flags, 0);
+}
+
+/**
+ * path_lookup_create - lookup a file path with open + create intent
+ * @name: pointer to file name
+ * @lookup_flags: lookup intent flags
+ * @nd: pointer to nameidata
+ * @open_flags: open intent flags
+ * @create_mode: create intent flags
+ */
+static int path_lookup_create(const char *name, unsigned int lookup_flags,
+                             struct nameidata *nd, int open_flags,
+                             int create_mode)
+{
+       return __path_lookup_intent_open(name, lookup_flags|LOOKUP_CREATE, nd,
+                       open_flags, create_mode);
+}
+
+int __user_path_lookup_open(const char __user *name, unsigned int lookup_flags,
+               struct nameidata *nd, int open_flags)
+{
+       char *tmp = getname(name);
+       int err = PTR_ERR(tmp);
+
+       if (!IS_ERR(tmp)) {
+               err = __path_lookup_intent_open(tmp, lookup_flags, nd, open_flags, 0);
+               putname(tmp);
+       }
+       return err;
+}
+
 /*
  * Restricted form of lookup. Doesn't follow links, single-component only,
  * needs parent already locked. Doesn't follow mounts.
@@ -1075,9 +1205,9 @@ out:
        return dentry;
 }
 
-struct dentry * lookup_hash(struct qstr *name, struct dentry * base)
+struct dentry * lookup_hash(struct nameidata *nd)
 {
-       return __lookup_hash(name, base, NULL);
+       return __lookup_hash(&nd->last, nd->dentry, nd);
 }
 
 /* SMP-safe */
@@ -1101,7 +1231,7 @@ struct dentry * lookup_one_len(const char * name, struct dentry * base, int len)
        }
        this.hash = end_name_hash(hash);
 
-       return lookup_hash(&this, base);
+       return __lookup_hash(&this, base, NULL);
 access:
        return ERR_PTR(-EACCES);
 }
@@ -1213,9 +1343,6 @@ static inline int may_create(struct inode *dir, struct dentry *child,
 }
 
 /* 
- * Special case: O_CREAT|O_EXCL implies O_NOFOLLOW for security
- * reasons.
- *
  * O_DIRECTORY translates into forcing a directory lookup.
  */
 static inline int lookup_flags(unsigned int f)
@@ -1225,9 +1352,6 @@ static inline int lookup_flags(unsigned int f)
        if (f & O_NOFOLLOW)
                retval &= ~LOOKUP_FOLLOW;
        
-       if ((f & (O_CREAT|O_EXCL)) == (O_CREAT|O_EXCL))
-               retval &= ~LOOKUP_FOLLOW;
-       
        if (f & O_DIRECTORY)
                retval |= LOOKUP_DIRECTORY;
 
@@ -1242,7 +1366,7 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
        struct dentry *p;
 
        if (p1 == p2) {
-               down(&p1->d_inode->i_sem);
+               mutex_lock(&p1->d_inode->i_mutex);
                return NULL;
        }
 
@@ -1250,30 +1374,30 @@ struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
 
        for (p = p1; p->d_parent != p; p = p->d_parent) {
                if (p->d_parent == p2) {
-                       down(&p2->d_inode->i_sem);
-                       down(&p1->d_inode->i_sem);
+                       mutex_lock(&p2->d_inode->i_mutex);
+                       mutex_lock(&p1->d_inode->i_mutex);
                        return p;
                }
        }
 
        for (p = p2; p->d_parent != p; p = p->d_parent) {
                if (p->d_parent == p1) {
-                       down(&p1->d_inode->i_sem);
-                       down(&p2->d_inode->i_sem);
+                       mutex_lock(&p1->d_inode->i_mutex);
+                       mutex_lock(&p2->d_inode->i_mutex);
                        return p;
                }
        }
 
-       down(&p1->d_inode->i_sem);
-       down(&p2->d_inode->i_sem);
+       mutex_lock(&p1->d_inode->i_mutex);
+       mutex_lock(&p2->d_inode->i_mutex);
        return NULL;
 }
 
 void unlock_rename(struct dentry *p1, struct dentry *p2)
 {
-       up(&p1->d_inode->i_sem);
+       mutex_unlock(&p1->d_inode->i_mutex);
        if (p1 != p2) {
-               up(&p2->d_inode->i_sem);
+               mutex_unlock(&p2->d_inode->i_mutex);
                up(&p1->d_inode->i_sb->s_vfs_rename_sem);
        }
 }
@@ -1295,10 +1419,8 @@ int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
                return error;
        DQUOT_INIT(dir);
        error = dir->i_op->create(dir, dentry, mode, nd);
-       if (!error) {
-               inode_dir_notify(dir, DN_CREATE);
-               security_inode_post_create(dir, dentry, mode);
-       }
+       if (!error)
+               fsnotify_create(dir, dentry->d_name.name);
        return error;
 }
 
@@ -1317,7 +1439,7 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
        if (S_ISDIR(inode->i_mode) && (flag & FMODE_WRITE))
                return -EISDIR;
 
-       error = permission(inode, acc_mode, nd);
+       error = vfs_permission(nd, acc_mode);
        if (error)
                return error;
 
@@ -1369,7 +1491,7 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
                if (!error) {
                        DQUOT_INIT(inode);
                        
-                       error = do_truncate(dentry, 0);
+                       error = do_truncate(dentry, 0, ATTR_MTIME|ATTR_CTIME, NULL);
                }
                put_write_access(inode);
                if (error)
@@ -1397,27 +1519,27 @@ int may_open(struct nameidata *nd, int acc_mode, int flag)
  */
 int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
 {
-       int acc_mode, error = 0;
-       struct dentry *dentry;
+       int acc_mode, error;
+       struct path path;
        struct dentry *dir;
        int count = 0;
 
        acc_mode = ACC_MODE(flag);
 
+       /* O_TRUNC implies we need access checks for write permissions */
+       if (flag & O_TRUNC)
+               acc_mode |= MAY_WRITE;
+
        /* Allow the LSM permission hook to distinguish append 
           access from general write access. */
        if (flag & O_APPEND)
                acc_mode |= MAY_APPEND;
 
-       /* Fill in the open() intent data */
-       nd->intent.open.flags = flag;
-       nd->intent.open.create_mode = mode;
-
        /*
         * The simplest case - just a plain lookup.
         */
        if (!(flag & O_CREAT)) {
-               error = path_lookup(pathname, lookup_flags(flag)|LOOKUP_OPEN, nd);
+               error = path_lookup_open(pathname, lookup_flags(flag), nd, flag);
                if (error)
                        return error;
                goto ok;
@@ -1426,7 +1548,7 @@ int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
        /*
         * Create - we need to know the parent.
         */
-       error = path_lookup(pathname, LOOKUP_PARENT|LOOKUP_OPEN|LOOKUP_CREATE, nd);
+       error = path_lookup_create(pathname, LOOKUP_PARENT, nd, flag, mode);
        if (error)
                return error;
 
@@ -1441,24 +1563,25 @@ int open_namei(const char * pathname, int flag, int mode, struct nameidata *nd)
 
        dir = nd->dentry;
        nd->flags &= ~LOOKUP_PARENT;
-       down(&dir->d_inode->i_sem);
-       dentry = __lookup_hash(&nd->last, nd->dentry, nd);
+       mutex_lock(&dir->d_inode->i_mutex);
+       path.dentry = lookup_hash(nd);
+       path.mnt = nd->mnt;
 
 do_last:
-       error = PTR_ERR(dentry);
-       if (IS_ERR(dentry)) {
-               up(&dir->d_inode->i_sem);
+       error = PTR_ERR(path.dentry);
+       if (IS_ERR(path.dentry)) {
+               mutex_unlock(&dir->d_inode->i_mutex);
                goto exit;
        }
 
        /* Negative dentry, just create the file */
-       if (!dentry->d_inode) {
+       if (!path.dentry->d_inode) {
                if (!IS_POSIXACL(dir->d_inode))
                        mode &= ~current->fs->umask;
-               error = vfs_create(dir->d_inode, dentry, mode, nd);
-               up(&dir->d_inode->i_sem);
+               error = vfs_create(dir->d_inode, path.dentry, mode, nd);
+               mutex_unlock(&dir->d_inode->i_mutex);
                dput(nd->dentry);
-               nd->dentry = dentry;
+               nd->dentry = path.dentry;
                if (error)
                        goto exit;
                /* Don't check for write permission, don't truncate */
@@ -1470,28 +1593,26 @@ do_last:
        /*
         * It already exists.
         */
-       up(&dir->d_inode->i_sem);
+       mutex_unlock(&dir->d_inode->i_mutex);
 
        error = -EEXIST;
        if (flag & O_EXCL)
                goto exit_dput;
 
-       if (d_mountpoint(dentry)) {
+       if (__follow_mount(&path)) {
                error = -ELOOP;
                if (flag & O_NOFOLLOW)
                        goto exit_dput;
-               while (__follow_down(&nd->mnt,&dentry) && d_mountpoint(dentry));
        }
        error = -ENOENT;
-       if (!dentry->d_inode)
+       if (!path.dentry->d_inode)
                goto exit_dput;
-       if (dentry->d_inode->i_op && dentry->d_inode->i_op->follow_link)
+       if (path.dentry->d_inode->i_op && path.dentry->d_inode->i_op->follow_link)
                goto do_link;
 
-       dput(nd->dentry);
-       nd->dentry = dentry;
+       path_to_nameidata(&path, nd);
        error = -EISDIR;
-       if (dentry->d_inode && S_ISDIR(dentry->d_inode->i_mode))
+       if (path.dentry->d_inode && S_ISDIR(path.dentry->d_inode->i_mode))
                goto exit;
 ok:
        error = may_open(nd, acc_mode, flag);
@@ -1500,8 +1621,10 @@ ok:
        return 0;
 
 exit_dput:
-       dput(dentry);
+       dput_path(&path, nd);
 exit:
+       if (!IS_ERR(nd->intent.open.file))
+               release_open_intent(nd);
        path_release(nd);
        return error;
 
@@ -1520,34 +1643,32 @@ do_link:
         * are done. Procfs-like symlinks just set LAST_BIND.
         */
        nd->flags |= LOOKUP_PARENT;
-       error = security_inode_follow_link(dentry, nd);
+       error = security_inode_follow_link(path.dentry, nd);
        if (error)
                goto exit_dput;
-       error = __do_follow_link(dentry, nd);
-       dput(dentry);
+       error = __do_follow_link(&path, nd);
        if (error)
                return error;
        nd->flags &= ~LOOKUP_PARENT;
-       if (nd->last_type == LAST_BIND) {
-               dentry = nd->dentry;
+       if (nd->last_type == LAST_BIND)
                goto ok;
-       }
        error = -EISDIR;
        if (nd->last_type != LAST_NORM)
                goto exit;
        if (nd->last.name[nd->last.len]) {
-               putname(nd->last.name);
+               __putname(nd->last.name);
                goto exit;
        }
        error = -ELOOP;
        if (count++==32) {
-               putname(nd->last.name);
+               __putname(nd->last.name);
                goto exit;
        }
        dir = nd->dentry;
-       down(&dir->d_inode->i_sem);
-       dentry = __lookup_hash(&nd->last, nd->dentry, nd);
-       putname(nd->last.name);
+       mutex_lock(&dir->d_inode->i_mutex);
+       path.dentry = lookup_hash(nd);
+       path.mnt = nd->mnt;
+       __putname(nd->last.name);
        goto do_last;
 }
 
@@ -1558,19 +1679,35 @@ do_link:
  *
  * Simple function to lookup and return a dentry and create it
  * if it doesn't exist.  Is SMP-safe.
+ *
+ * Returns with nd->dentry->d_inode->i_mutex locked.
  */
 struct dentry *lookup_create(struct nameidata *nd, int is_dir)
 {
-       struct dentry *dentry;
+       struct dentry *dentry = ERR_PTR(-EEXIST);
 
-       down(&nd->dentry->d_inode->i_sem);
-       dentry = ERR_PTR(-EEXIST);
+       mutex_lock(&nd->dentry->d_inode->i_mutex);
+       /*
+        * Yucky last component or no last component at all?
+        * (foo/., foo/.., /////)
+        */
        if (nd->last_type != LAST_NORM)
                goto fail;
        nd->flags &= ~LOOKUP_PARENT;
-       dentry = lookup_hash(&nd->last, nd->dentry);
+
+       /*
+        * Do the final lookup.
+        */
+       dentry = lookup_hash(nd);
        if (IS_ERR(dentry))
                goto fail;
+
+       /*
+        * Special case - lookup gave negative, but... we had foo/bar/
+        * From the vfs_mknod() POV we just have a negative dentry -
+        * all is fine. Let's be bastards - you had / on the end, you've
+        * been asking for (non-existent) directory. -ENOENT for you.
+        */
        if (!is_dir && nd->last.name[nd->last.len] && !dentry->d_inode)
                goto enoent;
        return dentry;
@@ -1601,10 +1738,8 @@ int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
 
        DQUOT_INIT(dir);
        error = dir->i_op->mknod(dir, dentry, mode, dev);
-       if (!error) {
-               inode_dir_notify(dir, DN_CREATE);
-               security_inode_post_mknod(dir, dentry, mode, dev);
-       }
+       if (!error)
+               fsnotify_create(dir, dentry->d_name.name);
        return error;
 }
 
@@ -1649,7 +1784,7 @@ asmlinkage long sys_mknod(const char __user * filename, int mode, unsigned dev)
                }
                dput(dentry);
        }
-       up(&nd.dentry->d_inode->i_sem);
+       mutex_unlock(&nd.dentry->d_inode->i_mutex);
        path_release(&nd);
 out:
        putname(tmp);
@@ -1674,10 +1809,8 @@ int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
        DQUOT_INIT(dir);
        error = dir->i_op->mkdir(dir, dentry, mode);
-       if (!error) {
-               inode_dir_notify(dir, DN_CREATE);
-               security_inode_post_mkdir(dir,dentry, mode);
-       }
+       if (!error)
+               fsnotify_mkdir(dir, dentry->d_name.name);
        return error;
 }
 
@@ -1703,7 +1836,7 @@ asmlinkage long sys_mkdir(const char __user * pathname, int mode)
                        error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
                        dput(dentry);
                }
-               up(&nd.dentry->d_inode->i_sem);
+               mutex_unlock(&nd.dentry->d_inode->i_mutex);
                path_release(&nd);
 out:
                putname(tmp);
@@ -1752,7 +1885,7 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
 
        DQUOT_INIT(dir);
 
-       down(&dentry->d_inode->i_sem);
+       mutex_lock(&dentry->d_inode->i_mutex);
        dentry_unhash(dentry);
        if (d_mountpoint(dentry))
                error = -EBUSY;
@@ -1764,9 +1897,8 @@ int vfs_rmdir(struct inode *dir, struct dentry *dentry)
                                dentry->d_inode->i_flags |= S_DEAD;
                }
        }
-       up(&dentry->d_inode->i_sem);
+       mutex_unlock(&dentry->d_inode->i_mutex);
        if (!error) {
-               inode_dir_notify(dir, DN_DELETE);
                d_delete(dentry);
        }
        dput(dentry);
@@ -1800,14 +1932,14 @@ asmlinkage long sys_rmdir(const char __user * pathname)
                        error = -EBUSY;
                        goto exit1;
        }
-       down(&nd.dentry->d_inode->i_sem);
-       dentry = lookup_hash(&nd.last, nd.dentry);
+       mutex_lock(&nd.dentry->d_inode->i_mutex);
+       dentry = lookup_hash(&nd);
        error = PTR_ERR(dentry);
        if (!IS_ERR(dentry)) {
                error = vfs_rmdir(nd.dentry->d_inode, dentry);
                dput(dentry);
        }
-       up(&nd.dentry->d_inode->i_sem);
+       mutex_unlock(&nd.dentry->d_inode->i_mutex);
 exit1:
        path_release(&nd);
 exit:
@@ -1827,7 +1959,7 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
 
        DQUOT_INIT(dir);
 
-       down(&dentry->d_inode->i_sem);
+       mutex_lock(&dentry->d_inode->i_mutex);
        if (d_mountpoint(dentry))
                error = -EBUSY;
        else {
@@ -1835,19 +1967,19 @@ int vfs_unlink(struct inode *dir, struct dentry *dentry)
                if (!error)
                        error = dir->i_op->unlink(dir, dentry);
        }
-       up(&dentry->d_inode->i_sem);
+       mutex_unlock(&dentry->d_inode->i_mutex);
 
        /* We don't d_delete() NFS sillyrenamed files--they still exist. */
        if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
                d_delete(dentry);
-               inode_dir_notify(dir, DN_DELETE);
        }
+
        return error;
 }
 
 /*
  * Make sure that the actual truncation of the file will occur outside its
- * directory's i_sem.  Truncate can take a long time if there is a lot of
+ * directory's i_mutex.  Truncate can take a long time if there is a lot of
  * writeout happening, and we don't want to prevent access to the directory
  * while waiting on the I/O.
  */
@@ -1869,8 +2001,8 @@ asmlinkage long sys_unlink(const char __user * pathname)
        error = -EISDIR;
        if (nd.last_type != LAST_NORM)
                goto exit1;
-       down(&nd.dentry->d_inode->i_sem);
-       dentry = lookup_hash(&nd.last, nd.dentry);
+       mutex_lock(&nd.dentry->d_inode->i_mutex);
+       dentry = lookup_hash(&nd);
        error = PTR_ERR(dentry);
        if (!IS_ERR(dentry)) {
                /* Why not before? Because we want correct error value */
@@ -1883,7 +2015,7 @@ asmlinkage long sys_unlink(const char __user * pathname)
        exit2:
                dput(dentry);
        }
-       up(&nd.dentry->d_inode->i_sem);
+       mutex_unlock(&nd.dentry->d_inode->i_mutex);
        if (inode)
                iput(inode);    /* truncate the inode here */
 exit1:
@@ -1914,10 +2046,8 @@ int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname, i
 
        DQUOT_INIT(dir);
        error = dir->i_op->symlink(dir, dentry, oldname);
-       if (!error) {
-               inode_dir_notify(dir, DN_CREATE);
-               security_inode_post_symlink(dir, dentry, oldname);
-       }
+       if (!error)
+               fsnotify_create(dir, dentry->d_name.name);
        return error;
 }
 
@@ -1945,7 +2075,7 @@ asmlinkage long sys_symlink(const char __user * oldname, const char __user * new
                        error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO);
                        dput(dentry);
                }
-               up(&nd.dentry->d_inode->i_sem);
+               mutex_unlock(&nd.dentry->d_inode->i_mutex);
                path_release(&nd);
 out:
                putname(to);
@@ -1983,14 +2113,12 @@ int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_de
        if (error)
                return error;
 
-       down(&old_dentry->d_inode->i_sem);
+       mutex_lock(&old_dentry->d_inode->i_mutex);
        DQUOT_INIT(dir);
        error = dir->i_op->link(old_dentry, dir, new_dentry);
-       up(&old_dentry->d_inode->i_sem);
-       if (!error) {
-               inode_dir_notify(dir, DN_CREATE);
-               security_inode_post_link(old_dentry, dir, new_dentry);
-       }
+       mutex_unlock(&old_dentry->d_inode->i_mutex);
+       if (!error)
+               fsnotify_create(dir, new_dentry->d_name.name);
        return error;
 }
 
@@ -2029,7 +2157,7 @@ asmlinkage long sys_link(const char __user * oldname, const char __user * newnam
                error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
                dput(new_dentry);
        }
-       up(&nd.dentry->d_inode->i_sem);
+       mutex_unlock(&nd.dentry->d_inode->i_mutex);
 out_release:
        path_release(&nd);
 out:
@@ -2050,7 +2178,7 @@ exit:
  *        sb->s_vfs_rename_sem. We might be more accurate, but that's another
  *        story.
  *     c) we have to lock _three_ objects - parents and victim (if it exists).
- *        And that - after we got ->i_sem on parents (until then we don't know
+ *        And that - after we got ->i_mutex on parents (until then we don't know
  *        whether the target exists).  Solution: try to be smart with locking
  *        order for inodes.  We rely on the fact that tree topology may change
  *        only under ->s_vfs_rename_sem _and_ that parent of the object we
@@ -2067,9 +2195,9 @@ exit:
  *        stuff into VFS), but the former is not going away. Solution: the same
  *        trick as in rmdir().
  *     e) conversion from fhandle to dentry may come in the wrong moment - when
- *        we are removing the target. Solution: we will have to grab ->i_sem
+ *        we are removing the target. Solution: we will have to grab ->i_mutex
  *        in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
- *        ->i_sem on parents, which works but leads to some truely excessive
+ *        ->i_mutex on parents, which works but leads to some truely excessive
  *        locking].
  */
 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
@@ -2094,7 +2222,7 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
 
        target = new_dentry->d_inode;
        if (target) {
-               down(&target->i_sem);
+               mutex_lock(&target->i_mutex);
                dentry_unhash(new_dentry);
        }
        if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
@@ -2104,16 +2232,13 @@ static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
        if (target) {
                if (!error)
                        target->i_flags |= S_DEAD;
-               up(&target->i_sem);
+               mutex_unlock(&target->i_mutex);
                if (d_unhashed(new_dentry))
                        d_rehash(new_dentry);
                dput(new_dentry);
        }
-       if (!error) {
+       if (!error)
                d_move(old_dentry,new_dentry);
-               security_inode_post_rename(old_dir, old_dentry,
-                                          new_dir, new_dentry);
-       }
        return error;
 }
 
@@ -2130,7 +2255,7 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
        dget(new_dentry);
        target = new_dentry->d_inode;
        if (target)
-               down(&target->i_sem);
+               mutex_lock(&target->i_mutex);
        if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
                error = -EBUSY;
        else
@@ -2139,10 +2264,9 @@ static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
                /* The following d_move() should become unconditional */
                if (!(old_dir->i_sb->s_type->fs_flags & FS_ODD_RENAME))
                        d_move(old_dentry, new_dentry);
-               security_inode_post_rename(old_dir, old_dentry, new_dir, new_dentry);
        }
        if (target)
-               up(&target->i_sem);
+               mutex_unlock(&target->i_mutex);
        dput(new_dentry);
        return error;
 }
@@ -2152,6 +2276,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 {
        int error;
        int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
+       const char *old_name;
 
        if (old_dentry->d_inode == new_dentry->d_inode)
                return 0;
@@ -2173,18 +2298,19 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
        DQUOT_INIT(old_dir);
        DQUOT_INIT(new_dir);
 
+       old_name = fsnotify_oldname_init(old_dentry->d_name.name);
+
        if (is_dir)
                error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
        else
                error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
        if (!error) {
-               if (old_dir == new_dir)
-                       inode_dir_notify(old_dir, DN_RENAME);
-               else {
-                       inode_dir_notify(old_dir, DN_DELETE);
-                       inode_dir_notify(new_dir, DN_CREATE);
-               }
+               const char *new_name = old_dentry->d_name.name;
+               fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
+                             new_dentry->d_inode, old_dentry->d_inode);
        }
+       fsnotify_oldname_free(old_name);
+
        return error;
 }
 
@@ -2219,7 +2345,7 @@ static inline int do_rename(const char * oldname, const char * newname)
 
        trap = lock_rename(new_dir, old_dir);
 
-       old_dentry = lookup_hash(&oldnd.last, old_dir);
+       old_dentry = lookup_hash(&oldnd);
        error = PTR_ERR(old_dentry);
        if (IS_ERR(old_dentry))
                goto exit3;
@@ -2239,7 +2365,7 @@ static inline int do_rename(const char * oldname, const char * newname)
        error = -EINVAL;
        if (old_dentry == trap)
                goto exit4;
-       new_dentry = lookup_hash(&newnd.last, new_dir);
+       new_dentry = lookup_hash(&newnd);
        error = PTR_ERR(new_dentry);
        if (IS_ERR(new_dentry))
                goto exit4;
@@ -2308,15 +2434,17 @@ out:
 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
 {
        struct nameidata nd;
-       int res;
+       void *cookie;
+
        nd.depth = 0;
-       res = dentry->d_inode->i_op->follow_link(dentry, &nd);
-       if (!res) {
-               res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
+       cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
+       if (!IS_ERR(cookie)) {
+               int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
                if (dentry->d_inode->i_op->put_link)
-                       dentry->d_inode->i_op->put_link(dentry, &nd);
+                       dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
+               cookie = ERR_PTR(res);
        }
-       return res;
+       return PTR_ERR(cookie);
 }
 
 int vfs_follow_link(struct nameidata *nd, const char *link)
@@ -2359,23 +2487,20 @@ int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
        return res;
 }
 
-int page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
+void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
 {
-       struct page *page;
+       struct page *page = NULL;
        nd_set_link(nd, page_getlink(dentry, &page));
-       return 0;
+       return page;
 }
 
-void page_put_link(struct dentry *dentry, struct nameidata *nd)
+void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
-       if (!IS_ERR(nd_get_link(nd))) {
-               struct page *page;
-               page = find_get_page(dentry->d_inode->i_mapping, 0);
-               if (!page)
-                       BUG();
+       struct page *page = cookie;
+
+       if (page) {
                kunmap(page);
                page_cache_release(page);
-               page_cache_release(page);
        }
 }
 
@@ -2443,6 +2568,8 @@ EXPORT_SYMBOL(path_lookup);
 EXPORT_SYMBOL(path_release);
 EXPORT_SYMBOL(path_walk);
 EXPORT_SYMBOL(permission);
+EXPORT_SYMBOL(vfs_permission);
+EXPORT_SYMBOL(file_permission);
 EXPORT_SYMBOL(unlock_rename);
 EXPORT_SYMBOL(vfs_create);
 EXPORT_SYMBOL(vfs_follow_link);