unroll do_last: loop in do_filp_open()
[safe/jmp/linux-2.6] / fs / namei.c
index 54d33df..fc6bed7 100644 (file)
@@ -1334,7 +1334,7 @@ static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
                return -ENOENT;
 
        BUG_ON(victim->d_parent->d_inode != dir);
-       audit_inode_child(victim->d_name.name, victim, dir);
+       audit_inode_child(victim, dir);
 
        error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
        if (error)
@@ -1590,6 +1590,153 @@ static int open_will_truncate(int flag, struct inode *inode)
        return (flag & O_TRUNC);
 }
 
+static struct file *finish_open(struct nameidata *nd,
+                               int open_flag, int flag, int acc_mode)
+{
+       struct file *filp;
+       int will_truncate;
+       int error;
+
+       will_truncate = open_will_truncate(flag, nd->path.dentry->d_inode);
+       if (will_truncate) {
+               error = mnt_want_write(nd->path.mnt);
+               if (error)
+                       goto exit;
+       }
+       error = may_open(&nd->path, acc_mode, open_flag);
+       if (error) {
+               if (will_truncate)
+                       mnt_drop_write(nd->path.mnt);
+               goto exit;
+       }
+       filp = nameidata_to_filp(nd);
+       if (!IS_ERR(filp)) {
+               error = ima_file_check(filp, acc_mode);
+               if (error) {
+                       fput(filp);
+                       filp = ERR_PTR(error);
+               }
+       }
+       if (!IS_ERR(filp)) {
+               if (acc_mode & MAY_WRITE)
+                       vfs_dq_init(nd->path.dentry->d_inode);
+
+               if (will_truncate) {
+                       error = handle_truncate(&nd->path);
+                       if (error) {
+                               fput(filp);
+                               filp = ERR_PTR(error);
+                       }
+               }
+       }
+       /*
+        * It is now safe to drop the mnt write
+        * because the filp has had a write taken
+        * on its behalf.
+        */
+       if (will_truncate)
+               mnt_drop_write(nd->path.mnt);
+       return filp;
+
+exit:
+       if (!IS_ERR(nd->intent.open.file))
+               release_open_intent(nd);
+       path_put(&nd->path);
+       return ERR_PTR(error);
+}
+
+static struct file *do_last(struct nameidata *nd, struct path *path,
+                           int open_flag, int flag, int acc_mode,
+                           int mode, const char *pathname,
+                           struct dentry *dir, int *is_link)
+{
+       struct file *filp;
+       int error;
+
+       *is_link = 0;
+
+       error = PTR_ERR(path->dentry);
+       if (IS_ERR(path->dentry)) {
+               mutex_unlock(&dir->d_inode->i_mutex);
+               goto exit;
+       }
+
+       if (IS_ERR(nd->intent.open.file)) {
+               error = PTR_ERR(nd->intent.open.file);
+               goto exit_mutex_unlock;
+       }
+
+       /* Negative dentry, just create the file */
+       if (!path->dentry->d_inode) {
+               /*
+                * This write is needed to ensure that a
+                * ro->rw transition does not occur between
+                * the time when the file is created and when
+                * a permanent write count is taken through
+                * the 'struct file' in nameidata_to_filp().
+                */
+               error = mnt_want_write(nd->path.mnt);
+               if (error)
+                       goto exit_mutex_unlock;
+               error = __open_namei_create(nd, path, open_flag, mode);
+               if (error) {
+                       mnt_drop_write(nd->path.mnt);
+                       goto exit;
+               }
+               filp = nameidata_to_filp(nd);
+               mnt_drop_write(nd->path.mnt);
+               if (!IS_ERR(filp)) {
+                       error = ima_file_check(filp, acc_mode);
+                       if (error) {
+                               fput(filp);
+                               filp = ERR_PTR(error);
+                       }
+               }
+               return filp;
+       }
+
+       /*
+        * It already exists.
+        */
+       mutex_unlock(&dir->d_inode->i_mutex);
+       audit_inode(pathname, path->dentry);
+
+       error = -EEXIST;
+       if (flag & O_EXCL)
+               goto exit_dput;
+
+       if (__follow_mount(path)) {
+               error = -ELOOP;
+               if (flag & O_NOFOLLOW)
+                       goto exit_dput;
+       }
+
+       error = -ENOENT;
+       if (!path->dentry->d_inode)
+               goto exit_dput;
+       if (path->dentry->d_inode->i_op->follow_link) {
+               *is_link = 1;
+               return NULL;
+       }
+
+       path_to_nameidata(path, nd);
+       error = -EISDIR;
+       if (S_ISDIR(path->dentry->d_inode->i_mode))
+               goto exit;
+       filp = finish_open(nd, open_flag, flag, acc_mode);
+       return filp;
+
+exit_mutex_unlock:
+       mutex_unlock(&dir->d_inode->i_mutex);
+exit_dput:
+       path_put_conditional(path, nd);
+exit:
+       if (!IS_ERR(nd->intent.open.file))
+               release_open_intent(nd);
+       path_put(&nd->path);
+       return ERR_PTR(error);
+}
+
 /*
  * Note that the low bits of the passed in "open_flag"
  * are not the same as in the local variable "flag". See
@@ -1604,9 +1751,9 @@ struct file *do_filp_open(int dfd, const char *pathname,
        struct path path;
        struct dentry *dir;
        int count = 0;
-       int will_truncate;
        int flag = open_to_namei_flags(open_flag);
        int force_reval = 0;
+       int is_link;
 
        /*
         * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
@@ -1698,132 +1845,20 @@ reval:
        mutex_lock(&dir->d_inode->i_mutex);
        path.dentry = lookup_hash(&nd);
        path.mnt = nd.path.mnt;
-
-do_last:
-       error = PTR_ERR(path.dentry);
-       if (IS_ERR(path.dentry)) {
-               mutex_unlock(&dir->d_inode->i_mutex);
-               goto exit;
-       }
-
-       if (IS_ERR(nd.intent.open.file)) {
-               error = PTR_ERR(nd.intent.open.file);
-               goto exit_mutex_unlock;
-       }
-
-       /* Negative dentry, just create the file */
-       if (!path.dentry->d_inode) {
-               /*
-                * This write is needed to ensure that a
-                * ro->rw transition does not occur between
-                * the time when the file is created and when
-                * a permanent write count is taken through
-                * the 'struct file' in nameidata_to_filp().
-                */
-               error = mnt_want_write(nd.path.mnt);
-               if (error)
-                       goto exit_mutex_unlock;
-               error = __open_namei_create(&nd, &path, open_flag, mode);
-               if (error) {
-                       mnt_drop_write(nd.path.mnt);
-                       goto exit;
-               }
-               filp = nameidata_to_filp(&nd);
-               mnt_drop_write(nd.path.mnt);
-               if (nd.root.mnt)
-                       path_put(&nd.root);
-               if (!IS_ERR(filp)) {
-                       error = ima_file_check(filp, acc_mode);
-                       if (error) {
-                               fput(filp);
-                               filp = ERR_PTR(error);
-                       }
-               }
-               return filp;
-       }
-
-       /*
-        * It already exists.
-        */
-       mutex_unlock(&dir->d_inode->i_mutex);
-       audit_inode(pathname, path.dentry);
-
-       error = -EEXIST;
-       if (flag & O_EXCL)
-               goto exit_dput;
-
-       if (__follow_mount(&path)) {
-               error = -ELOOP;
-               if (flag & O_NOFOLLOW)
-                       goto exit_dput;
-       }
-
-       error = -ENOENT;
-       if (!path.dentry->d_inode)
-               goto exit_dput;
-       if (path.dentry->d_inode->i_op->follow_link)
+       filp = do_last(&nd, &path, open_flag, flag, acc_mode, mode,
+                      pathname, dir, &is_link);
+       if (is_link)
                goto do_link;
+       if (nd.root.mnt)
+               path_put(&nd.root);
+       return filp;
 
-       path_to_nameidata(&path, &nd);
-       error = -EISDIR;
-       if (S_ISDIR(path.dentry->d_inode->i_mode))
-               goto exit;
 ok:
-       /*
-        * Consider:
-        * 1. may_open() truncates a file
-        * 2. a rw->ro mount transition occurs
-        * 3. nameidata_to_filp() fails due to
-        *    the ro mount.
-        * That would be inconsistent, and should
-        * be avoided. Taking this mnt write here
-        * ensures that (2) can not occur.
-        */
-       will_truncate = open_will_truncate(flag, nd.path.dentry->d_inode);
-       if (will_truncate) {
-               error = mnt_want_write(nd.path.mnt);
-               if (error)
-                       goto exit;
-       }
-       error = may_open(&nd.path, acc_mode, open_flag);
-       if (error) {
-               if (will_truncate)
-                       mnt_drop_write(nd.path.mnt);
-               goto exit;
-       }
-       filp = nameidata_to_filp(&nd);
-       if (!IS_ERR(filp)) {
-               error = ima_file_check(filp, acc_mode);
-               if (error) {
-                       fput(filp);
-                       filp = ERR_PTR(error);
-               }
-       }
-       if (!IS_ERR(filp)) {
-               if (acc_mode & MAY_WRITE)
-                       vfs_dq_init(nd.path.dentry->d_inode);
-
-               if (will_truncate) {
-                       error = handle_truncate(&nd.path);
-                       if (error) {
-                               fput(filp);
-                               filp = ERR_PTR(error);
-                       }
-               }
-       }
-       /*
-        * It is now safe to drop the mnt write
-        * because the filp has had a write taken
-        * on its behalf.
-        */
-       if (will_truncate)
-               mnt_drop_write(nd.path.mnt);
+       filp = finish_open(&nd, open_flag, flag, acc_mode);
        if (nd.root.mnt)
                path_put(&nd.root);
        return filp;
 
-exit_mutex_unlock:
-       mutex_unlock(&dir->d_inode->i_mutex);
 exit_dput:
        path_put_conditional(&path, &nd);
 exit:
@@ -1889,7 +1924,13 @@ do_link:
        path.dentry = lookup_hash(&nd);
        path.mnt = nd.path.mnt;
        __putname(nd.last.name);
-       goto do_last;
+       filp = do_last(&nd, &path, open_flag, flag, acc_mode, mode,
+                      pathname, dir, &is_link);
+       if (is_link)
+               goto do_link;
+       if (nd.root.mnt)
+               path_put(&nd.root);
+       return filp;
 }
 
 /**
@@ -2663,11 +2704,9 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
                error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
        else
                error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
-       if (!error) {
-               const char *new_name = old_dentry->d_name.name;
-               fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
+       if (!error)
+               fsnotify_move(old_dir, new_dir, old_name, is_dir,
                              new_dentry->d_inode, old_dentry);
-       }
        fsnotify_oldname_free(old_name);
 
        return error;