xref: /openbmc/linux/fs/namei.c (revision 643d1f7f)
1 /*
2  *  linux/fs/namei.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6 
7 /*
8  * Some corrections by tytso.
9  */
10 
11 /* [Feb 1997 T. Schoebel-Theuer] Complete rewrite of the pathname
12  * lookup logic.
13  */
14 /* [Feb-Apr 2000, AV] Rewrite to the new namespace architecture.
15  */
16 
17 #include <linux/init.h>
18 #include <linux/module.h>
19 #include <linux/slab.h>
20 #include <linux/fs.h>
21 #include <linux/namei.h>
22 #include <linux/quotaops.h>
23 #include <linux/pagemap.h>
24 #include <linux/fsnotify.h>
25 #include <linux/personality.h>
26 #include <linux/security.h>
27 #include <linux/syscalls.h>
28 #include <linux/mount.h>
29 #include <linux/audit.h>
30 #include <linux/capability.h>
31 #include <linux/file.h>
32 #include <linux/fcntl.h>
33 #include <asm/namei.h>
34 #include <asm/uaccess.h>
35 
36 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
37 
38 /* [Feb-1997 T. Schoebel-Theuer]
39  * Fundamental changes in the pathname lookup mechanisms (namei)
40  * were necessary because of omirr.  The reason is that omirr needs
41  * to know the _real_ pathname, not the user-supplied one, in case
42  * of symlinks (and also when transname replacements occur).
43  *
44  * The new code replaces the old recursive symlink resolution with
45  * an iterative one (in case of non-nested symlink chains).  It does
46  * this with calls to <fs>_follow_link().
47  * As a side effect, dir_namei(), _namei() and follow_link() are now
48  * replaced with a single function lookup_dentry() that can handle all
49  * the special cases of the former code.
50  *
51  * With the new dcache, the pathname is stored at each inode, at least as
52  * long as the refcount of the inode is positive.  As a side effect, the
53  * size of the dcache depends on the inode cache and thus is dynamic.
54  *
55  * [29-Apr-1998 C. Scott Ananian] Updated above description of symlink
56  * resolution to correspond with current state of the code.
57  *
58  * Note that the symlink resolution is not *completely* iterative.
59  * There is still a significant amount of tail- and mid- recursion in
60  * the algorithm.  Also, note that <fs>_readlink() is not used in
61  * lookup_dentry(): lookup_dentry() on the result of <fs>_readlink()
62  * may return different results than <fs>_follow_link().  Many virtual
63  * filesystems (including /proc) exhibit this behavior.
64  */
65 
66 /* [24-Feb-97 T. Schoebel-Theuer] Side effects caused by new implementation:
67  * New symlink semantics: when open() is called with flags O_CREAT | O_EXCL
68  * and the name already exists in form of a symlink, try to create the new
69  * name indicated by the symlink. The old code always complained that the
70  * name already exists, due to not following the symlink even if its target
71  * is nonexistent.  The new semantics affects also mknod() and link() when
72  * the name is a symlink pointing to a non-existant name.
73  *
74  * I don't know which semantics is the right one, since I have no access
75  * to standards. But I found by trial that HP-UX 9.0 has the full "new"
76  * semantics implemented, while SunOS 4.1.1 and Solaris (SunOS 5.4) have the
77  * "old" one. Personally, I think the new semantics is much more logical.
78  * Note that "ln old new" where "new" is a symlink pointing to a non-existing
79  * file does succeed in both HP-UX and SunOs, but not in Solaris
80  * and in the old Linux semantics.
81  */
82 
83 /* [16-Dec-97 Kevin Buhr] For security reasons, we change some symlink
84  * semantics.  See the comments in "open_namei" and "do_link" below.
85  *
86  * [10-Sep-98 Alan Modra] Another symlink change.
87  */
88 
89 /* [Feb-Apr 2000 AV] Complete rewrite. Rules for symlinks:
90  *	inside the path - always follow.
91  *	in the last component in creation/removal/renaming - never follow.
92  *	if LOOKUP_FOLLOW passed - follow.
93  *	if the pathname has trailing slashes - follow.
94  *	otherwise - don't follow.
95  * (applied in that order).
96  *
97  * [Jun 2000 AV] Inconsistent behaviour of open() in case if flags==O_CREAT
98  * restored for 2.4. This is the last surviving part of old 4.2BSD bug.
99  * During the 2.4 we need to fix the userland stuff depending on it -
100  * hopefully we will be able to get rid of that wart in 2.5. So far only
101  * XEmacs seems to be relying on it...
102  */
103 /*
104  * [Sep 2001 AV] Single-semaphore locking scheme (kudos to David Holland)
105  * implemented.  Let's see if raised priority of ->s_vfs_rename_mutex gives
106  * any extra contention...
107  */
108 
109 static int fastcall link_path_walk(const char *name, struct nameidata *nd);
110 
111 /* In order to reduce some races, while at the same time doing additional
112  * checking and hopefully speeding things up, we copy filenames to the
113  * kernel data space before using them..
114  *
115  * POSIX.1 2.4: an empty pathname is invalid (ENOENT).
116  * PATH_MAX includes the nul terminator --RR.
117  */
118 static int do_getname(const char __user *filename, char *page)
119 {
120 	int retval;
121 	unsigned long len = PATH_MAX;
122 
123 	if (!segment_eq(get_fs(), KERNEL_DS)) {
124 		if ((unsigned long) filename >= TASK_SIZE)
125 			return -EFAULT;
126 		if (TASK_SIZE - (unsigned long) filename < PATH_MAX)
127 			len = TASK_SIZE - (unsigned long) filename;
128 	}
129 
130 	retval = strncpy_from_user(page, filename, len);
131 	if (retval > 0) {
132 		if (retval < len)
133 			return 0;
134 		return -ENAMETOOLONG;
135 	} else if (!retval)
136 		retval = -ENOENT;
137 	return retval;
138 }
139 
140 char * getname(const char __user * filename)
141 {
142 	char *tmp, *result;
143 
144 	result = ERR_PTR(-ENOMEM);
145 	tmp = __getname();
146 	if (tmp)  {
147 		int retval = do_getname(filename, tmp);
148 
149 		result = tmp;
150 		if (retval < 0) {
151 			__putname(tmp);
152 			result = ERR_PTR(retval);
153 		}
154 	}
155 	audit_getname(result);
156 	return result;
157 }
158 
159 #ifdef CONFIG_AUDITSYSCALL
160 void putname(const char *name)
161 {
162 	if (unlikely(!audit_dummy_context()))
163 		audit_putname(name);
164 	else
165 		__putname(name);
166 }
167 EXPORT_SYMBOL(putname);
168 #endif
169 
170 
171 /**
172  * generic_permission  -  check for access rights on a Posix-like filesystem
173  * @inode:	inode to check access rights for
174  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
175  * @check_acl:	optional callback to check for Posix ACLs
176  *
177  * Used to check for read/write/execute permissions on a file.
178  * We use "fsuid" for this, letting us set arbitrary permissions
179  * for filesystem access without changing the "normal" uids which
180  * are used for other things..
181  */
182 int generic_permission(struct inode *inode, int mask,
183 		int (*check_acl)(struct inode *inode, int mask))
184 {
185 	umode_t			mode = inode->i_mode;
186 
187 	if (current->fsuid == inode->i_uid)
188 		mode >>= 6;
189 	else {
190 		if (IS_POSIXACL(inode) && (mode & S_IRWXG) && check_acl) {
191 			int error = check_acl(inode, mask);
192 			if (error == -EACCES)
193 				goto check_capabilities;
194 			else if (error != -EAGAIN)
195 				return error;
196 		}
197 
198 		if (in_group_p(inode->i_gid))
199 			mode >>= 3;
200 	}
201 
202 	/*
203 	 * If the DACs are ok we don't need any capability check.
204 	 */
205 	if (((mode & mask & (MAY_READ|MAY_WRITE|MAY_EXEC)) == mask))
206 		return 0;
207 
208  check_capabilities:
209 	/*
210 	 * Read/write DACs are always overridable.
211 	 * Executable DACs are overridable if at least one exec bit is set.
212 	 */
213 	if (!(mask & MAY_EXEC) ||
214 	    (inode->i_mode & S_IXUGO) || S_ISDIR(inode->i_mode))
215 		if (capable(CAP_DAC_OVERRIDE))
216 			return 0;
217 
218 	/*
219 	 * Searching includes executable on directories, else just read.
220 	 */
221 	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
222 		if (capable(CAP_DAC_READ_SEARCH))
223 			return 0;
224 
225 	return -EACCES;
226 }
227 
228 int permission(struct inode *inode, int mask, struct nameidata *nd)
229 {
230 	int retval, submask;
231 	struct vfsmount *mnt = NULL;
232 
233 	if (nd)
234 		mnt = nd->mnt;
235 
236 	if (mask & MAY_WRITE) {
237 		umode_t mode = inode->i_mode;
238 
239 		/*
240 		 * Nobody gets write access to a read-only fs.
241 		 */
242 		if (IS_RDONLY(inode) &&
243 		    (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
244 			return -EROFS;
245 
246 		/*
247 		 * Nobody gets write access to an immutable file.
248 		 */
249 		if (IS_IMMUTABLE(inode))
250 			return -EACCES;
251 	}
252 
253 	if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
254 		/*
255 		 * MAY_EXEC on regular files is denied if the fs is mounted
256 		 * with the "noexec" flag.
257 		 */
258 		if (mnt && (mnt->mnt_flags & MNT_NOEXEC))
259 			return -EACCES;
260 	}
261 
262 	/* Ordinary permission routines do not understand MAY_APPEND. */
263 	submask = mask & ~MAY_APPEND;
264 	if (inode->i_op && inode->i_op->permission) {
265 		retval = inode->i_op->permission(inode, submask, nd);
266 		if (!retval) {
267 			/*
268 			 * Exec permission on a regular file is denied if none
269 			 * of the execute bits are set.
270 			 *
271 			 * This check should be done by the ->permission()
272 			 * method.
273 			 */
274 			if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode) &&
275 			    !(inode->i_mode & S_IXUGO))
276 				return -EACCES;
277 		}
278 	} else {
279 		retval = generic_permission(inode, submask, NULL);
280 	}
281 	if (retval)
282 		return retval;
283 
284 	return security_inode_permission(inode, mask, nd);
285 }
286 
287 /**
288  * vfs_permission  -  check for access rights to a given path
289  * @nd:		lookup result that describes the path
290  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
291  *
292  * Used to check for read/write/execute permissions on a path.
293  * We use "fsuid" for this, letting us set arbitrary permissions
294  * for filesystem access without changing the "normal" uids which
295  * are used for other things.
296  */
297 int vfs_permission(struct nameidata *nd, int mask)
298 {
299 	return permission(nd->dentry->d_inode, mask, nd);
300 }
301 
302 /**
303  * file_permission  -  check for additional access rights to a given file
304  * @file:	file to check access rights for
305  * @mask:	right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
306  *
307  * Used to check for read/write/execute permissions on an already opened
308  * file.
309  *
310  * Note:
311  *	Do not use this function in new code.  All access checks should
312  *	be done using vfs_permission().
313  */
314 int file_permission(struct file *file, int mask)
315 {
316 	return permission(file->f_path.dentry->d_inode, mask, NULL);
317 }
318 
319 /*
320  * get_write_access() gets write permission for a file.
321  * put_write_access() releases this write permission.
322  * This is used for regular files.
323  * We cannot support write (and maybe mmap read-write shared) accesses and
324  * MAP_DENYWRITE mmappings simultaneously. The i_writecount field of an inode
325  * can have the following values:
326  * 0: no writers, no VM_DENYWRITE mappings
327  * < 0: (-i_writecount) vm_area_structs with VM_DENYWRITE set exist
328  * > 0: (i_writecount) users are writing to the file.
329  *
330  * Normally we operate on that counter with atomic_{inc,dec} and it's safe
331  * except for the cases where we don't hold i_writecount yet. Then we need to
332  * use {get,deny}_write_access() - these functions check the sign and refuse
333  * to do the change if sign is wrong. Exclusion between them is provided by
334  * the inode->i_lock spinlock.
335  */
336 
337 int get_write_access(struct inode * inode)
338 {
339 	spin_lock(&inode->i_lock);
340 	if (atomic_read(&inode->i_writecount) < 0) {
341 		spin_unlock(&inode->i_lock);
342 		return -ETXTBSY;
343 	}
344 	atomic_inc(&inode->i_writecount);
345 	spin_unlock(&inode->i_lock);
346 
347 	return 0;
348 }
349 
350 int deny_write_access(struct file * file)
351 {
352 	struct inode *inode = file->f_path.dentry->d_inode;
353 
354 	spin_lock(&inode->i_lock);
355 	if (atomic_read(&inode->i_writecount) > 0) {
356 		spin_unlock(&inode->i_lock);
357 		return -ETXTBSY;
358 	}
359 	atomic_dec(&inode->i_writecount);
360 	spin_unlock(&inode->i_lock);
361 
362 	return 0;
363 }
364 
365 void path_release(struct nameidata *nd)
366 {
367 	dput(nd->dentry);
368 	mntput(nd->mnt);
369 }
370 
371 /*
372  * umount() mustn't call path_release()/mntput() as that would clear
373  * mnt_expiry_mark
374  */
375 void path_release_on_umount(struct nameidata *nd)
376 {
377 	dput(nd->dentry);
378 	mntput_no_expire(nd->mnt);
379 }
380 
381 /**
382  * release_open_intent - free up open intent resources
383  * @nd: pointer to nameidata
384  */
385 void release_open_intent(struct nameidata *nd)
386 {
387 	if (nd->intent.open.file->f_path.dentry == NULL)
388 		put_filp(nd->intent.open.file);
389 	else
390 		fput(nd->intent.open.file);
391 }
392 
393 static inline struct dentry *
394 do_revalidate(struct dentry *dentry, struct nameidata *nd)
395 {
396 	int status = dentry->d_op->d_revalidate(dentry, nd);
397 	if (unlikely(status <= 0)) {
398 		/*
399 		 * The dentry failed validation.
400 		 * If d_revalidate returned 0 attempt to invalidate
401 		 * the dentry otherwise d_revalidate is asking us
402 		 * to return a fail status.
403 		 */
404 		if (!status) {
405 			if (!d_invalidate(dentry)) {
406 				dput(dentry);
407 				dentry = NULL;
408 			}
409 		} else {
410 			dput(dentry);
411 			dentry = ERR_PTR(status);
412 		}
413 	}
414 	return dentry;
415 }
416 
417 /*
418  * Internal lookup() using the new generic dcache.
419  * SMP-safe
420  */
421 static struct dentry * cached_lookup(struct dentry * parent, struct qstr * name, struct nameidata *nd)
422 {
423 	struct dentry * dentry = __d_lookup(parent, name);
424 
425 	/* lockess __d_lookup may fail due to concurrent d_move()
426 	 * in some unrelated directory, so try with d_lookup
427 	 */
428 	if (!dentry)
429 		dentry = d_lookup(parent, name);
430 
431 	if (dentry && dentry->d_op && dentry->d_op->d_revalidate)
432 		dentry = do_revalidate(dentry, nd);
433 
434 	return dentry;
435 }
436 
437 /*
438  * Short-cut version of permission(), for calling by
439  * path_walk(), when dcache lock is held.  Combines parts
440  * of permission() and generic_permission(), and tests ONLY for
441  * MAY_EXEC permission.
442  *
443  * If appropriate, check DAC only.  If not appropriate, or
444  * short-cut DAC fails, then call permission() to do more
445  * complete permission check.
446  */
447 static int exec_permission_lite(struct inode *inode,
448 				       struct nameidata *nd)
449 {
450 	umode_t	mode = inode->i_mode;
451 
452 	if (inode->i_op && inode->i_op->permission)
453 		return -EAGAIN;
454 
455 	if (current->fsuid == inode->i_uid)
456 		mode >>= 6;
457 	else if (in_group_p(inode->i_gid))
458 		mode >>= 3;
459 
460 	if (mode & MAY_EXEC)
461 		goto ok;
462 
463 	if ((inode->i_mode & S_IXUGO) && capable(CAP_DAC_OVERRIDE))
464 		goto ok;
465 
466 	if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_OVERRIDE))
467 		goto ok;
468 
469 	if (S_ISDIR(inode->i_mode) && capable(CAP_DAC_READ_SEARCH))
470 		goto ok;
471 
472 	return -EACCES;
473 ok:
474 	return security_inode_permission(inode, MAY_EXEC, nd);
475 }
476 
477 /*
478  * This is called when everything else fails, and we actually have
479  * to go to the low-level filesystem to find out what we should do..
480  *
481  * We get the directory semaphore, and after getting that we also
482  * make sure that nobody added the entry to the dcache in the meantime..
483  * SMP-safe
484  */
485 static struct dentry * real_lookup(struct dentry * parent, struct qstr * name, struct nameidata *nd)
486 {
487 	struct dentry * result;
488 	struct inode *dir = parent->d_inode;
489 
490 	mutex_lock(&dir->i_mutex);
491 	/*
492 	 * First re-do the cached lookup just in case it was created
493 	 * while we waited for the directory semaphore..
494 	 *
495 	 * FIXME! This could use version numbering or similar to
496 	 * avoid unnecessary cache lookups.
497 	 *
498 	 * The "dcache_lock" is purely to protect the RCU list walker
499 	 * from concurrent renames at this point (we mustn't get false
500 	 * negatives from the RCU list walk here, unlike the optimistic
501 	 * fast walk).
502 	 *
503 	 * so doing d_lookup() (with seqlock), instead of lockfree __d_lookup
504 	 */
505 	result = d_lookup(parent, name);
506 	if (!result) {
507 		struct dentry * dentry = d_alloc(parent, name);
508 		result = ERR_PTR(-ENOMEM);
509 		if (dentry) {
510 			result = dir->i_op->lookup(dir, dentry, nd);
511 			if (result)
512 				dput(dentry);
513 			else
514 				result = dentry;
515 		}
516 		mutex_unlock(&dir->i_mutex);
517 		return result;
518 	}
519 
520 	/*
521 	 * Uhhuh! Nasty case: the cache was re-populated while
522 	 * we waited on the semaphore. Need to revalidate.
523 	 */
524 	mutex_unlock(&dir->i_mutex);
525 	if (result->d_op && result->d_op->d_revalidate) {
526 		result = do_revalidate(result, nd);
527 		if (!result)
528 			result = ERR_PTR(-ENOENT);
529 	}
530 	return result;
531 }
532 
533 static int __emul_lookup_dentry(const char *, struct nameidata *);
534 
535 /* SMP-safe */
536 static __always_inline int
537 walk_init_root(const char *name, struct nameidata *nd)
538 {
539 	struct fs_struct *fs = current->fs;
540 
541 	read_lock(&fs->lock);
542 	if (fs->altroot && !(nd->flags & LOOKUP_NOALT)) {
543 		nd->mnt = mntget(fs->altrootmnt);
544 		nd->dentry = dget(fs->altroot);
545 		read_unlock(&fs->lock);
546 		if (__emul_lookup_dentry(name,nd))
547 			return 0;
548 		read_lock(&fs->lock);
549 	}
550 	nd->mnt = mntget(fs->rootmnt);
551 	nd->dentry = dget(fs->root);
552 	read_unlock(&fs->lock);
553 	return 1;
554 }
555 
556 static __always_inline int __vfs_follow_link(struct nameidata *nd, const char *link)
557 {
558 	int res = 0;
559 	char *name;
560 	if (IS_ERR(link))
561 		goto fail;
562 
563 	if (*link == '/') {
564 		path_release(nd);
565 		if (!walk_init_root(link, nd))
566 			/* weird __emul_prefix() stuff did it */
567 			goto out;
568 	}
569 	res = link_path_walk(link, nd);
570 out:
571 	if (nd->depth || res || nd->last_type!=LAST_NORM)
572 		return res;
573 	/*
574 	 * If it is an iterative symlinks resolution in open_namei() we
575 	 * have to copy the last component. And all that crap because of
576 	 * bloody create() on broken symlinks. Furrfu...
577 	 */
578 	name = __getname();
579 	if (unlikely(!name)) {
580 		path_release(nd);
581 		return -ENOMEM;
582 	}
583 	strcpy(name, nd->last.name);
584 	nd->last.name = name;
585 	return 0;
586 fail:
587 	path_release(nd);
588 	return PTR_ERR(link);
589 }
590 
591 static inline void dput_path(struct path *path, struct nameidata *nd)
592 {
593 	dput(path->dentry);
594 	if (path->mnt != nd->mnt)
595 		mntput(path->mnt);
596 }
597 
598 static inline void path_to_nameidata(struct path *path, struct nameidata *nd)
599 {
600 	dput(nd->dentry);
601 	if (nd->mnt != path->mnt)
602 		mntput(nd->mnt);
603 	nd->mnt = path->mnt;
604 	nd->dentry = path->dentry;
605 }
606 
607 static __always_inline int __do_follow_link(struct path *path, struct nameidata *nd)
608 {
609 	int error;
610 	void *cookie;
611 	struct dentry *dentry = path->dentry;
612 
613 	touch_atime(path->mnt, dentry);
614 	nd_set_link(nd, NULL);
615 
616 	if (path->mnt != nd->mnt) {
617 		path_to_nameidata(path, nd);
618 		dget(dentry);
619 	}
620 	mntget(path->mnt);
621 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
622 	error = PTR_ERR(cookie);
623 	if (!IS_ERR(cookie)) {
624 		char *s = nd_get_link(nd);
625 		error = 0;
626 		if (s)
627 			error = __vfs_follow_link(nd, s);
628 		if (dentry->d_inode->i_op->put_link)
629 			dentry->d_inode->i_op->put_link(dentry, nd, cookie);
630 	}
631 	dput(dentry);
632 	mntput(path->mnt);
633 
634 	return error;
635 }
636 
637 /*
638  * This limits recursive symlink follows to 8, while
639  * limiting consecutive symlinks to 40.
640  *
641  * Without that kind of total limit, nasty chains of consecutive
642  * symlinks can cause almost arbitrarily long lookups.
643  */
644 static inline int do_follow_link(struct path *path, struct nameidata *nd)
645 {
646 	int err = -ELOOP;
647 	if (current->link_count >= MAX_NESTED_LINKS)
648 		goto loop;
649 	if (current->total_link_count >= 40)
650 		goto loop;
651 	BUG_ON(nd->depth >= MAX_NESTED_LINKS);
652 	cond_resched();
653 	err = security_inode_follow_link(path->dentry, nd);
654 	if (err)
655 		goto loop;
656 	current->link_count++;
657 	current->total_link_count++;
658 	nd->depth++;
659 	err = __do_follow_link(path, nd);
660 	current->link_count--;
661 	nd->depth--;
662 	return err;
663 loop:
664 	dput_path(path, nd);
665 	path_release(nd);
666 	return err;
667 }
668 
669 int follow_up(struct vfsmount **mnt, struct dentry **dentry)
670 {
671 	struct vfsmount *parent;
672 	struct dentry *mountpoint;
673 	spin_lock(&vfsmount_lock);
674 	parent=(*mnt)->mnt_parent;
675 	if (parent == *mnt) {
676 		spin_unlock(&vfsmount_lock);
677 		return 0;
678 	}
679 	mntget(parent);
680 	mountpoint=dget((*mnt)->mnt_mountpoint);
681 	spin_unlock(&vfsmount_lock);
682 	dput(*dentry);
683 	*dentry = mountpoint;
684 	mntput(*mnt);
685 	*mnt = parent;
686 	return 1;
687 }
688 
689 /* no need for dcache_lock, as serialization is taken care in
690  * namespace.c
691  */
692 static int __follow_mount(struct path *path)
693 {
694 	int res = 0;
695 	while (d_mountpoint(path->dentry)) {
696 		struct vfsmount *mounted = lookup_mnt(path->mnt, path->dentry);
697 		if (!mounted)
698 			break;
699 		dput(path->dentry);
700 		if (res)
701 			mntput(path->mnt);
702 		path->mnt = mounted;
703 		path->dentry = dget(mounted->mnt_root);
704 		res = 1;
705 	}
706 	return res;
707 }
708 
709 static void follow_mount(struct vfsmount **mnt, struct dentry **dentry)
710 {
711 	while (d_mountpoint(*dentry)) {
712 		struct vfsmount *mounted = lookup_mnt(*mnt, *dentry);
713 		if (!mounted)
714 			break;
715 		dput(*dentry);
716 		mntput(*mnt);
717 		*mnt = mounted;
718 		*dentry = dget(mounted->mnt_root);
719 	}
720 }
721 
722 /* no need for dcache_lock, as serialization is taken care in
723  * namespace.c
724  */
725 int follow_down(struct vfsmount **mnt, struct dentry **dentry)
726 {
727 	struct vfsmount *mounted;
728 
729 	mounted = lookup_mnt(*mnt, *dentry);
730 	if (mounted) {
731 		dput(*dentry);
732 		mntput(*mnt);
733 		*mnt = mounted;
734 		*dentry = dget(mounted->mnt_root);
735 		return 1;
736 	}
737 	return 0;
738 }
739 
740 static __always_inline void follow_dotdot(struct nameidata *nd)
741 {
742 	struct fs_struct *fs = current->fs;
743 
744 	while(1) {
745 		struct vfsmount *parent;
746 		struct dentry *old = nd->dentry;
747 
748                 read_lock(&fs->lock);
749 		if (nd->dentry == fs->root &&
750 		    nd->mnt == fs->rootmnt) {
751                         read_unlock(&fs->lock);
752 			break;
753 		}
754                 read_unlock(&fs->lock);
755 		spin_lock(&dcache_lock);
756 		if (nd->dentry != nd->mnt->mnt_root) {
757 			nd->dentry = dget(nd->dentry->d_parent);
758 			spin_unlock(&dcache_lock);
759 			dput(old);
760 			break;
761 		}
762 		spin_unlock(&dcache_lock);
763 		spin_lock(&vfsmount_lock);
764 		parent = nd->mnt->mnt_parent;
765 		if (parent == nd->mnt) {
766 			spin_unlock(&vfsmount_lock);
767 			break;
768 		}
769 		mntget(parent);
770 		nd->dentry = dget(nd->mnt->mnt_mountpoint);
771 		spin_unlock(&vfsmount_lock);
772 		dput(old);
773 		mntput(nd->mnt);
774 		nd->mnt = parent;
775 	}
776 	follow_mount(&nd->mnt, &nd->dentry);
777 }
778 
779 /*
780  *  It's more convoluted than I'd like it to be, but... it's still fairly
781  *  small and for now I'd prefer to have fast path as straight as possible.
782  *  It _is_ time-critical.
783  */
784 static int do_lookup(struct nameidata *nd, struct qstr *name,
785 		     struct path *path)
786 {
787 	struct vfsmount *mnt = nd->mnt;
788 	struct dentry *dentry = __d_lookup(nd->dentry, name);
789 
790 	if (!dentry)
791 		goto need_lookup;
792 	if (dentry->d_op && dentry->d_op->d_revalidate)
793 		goto need_revalidate;
794 done:
795 	path->mnt = mnt;
796 	path->dentry = dentry;
797 	__follow_mount(path);
798 	return 0;
799 
800 need_lookup:
801 	dentry = real_lookup(nd->dentry, name, nd);
802 	if (IS_ERR(dentry))
803 		goto fail;
804 	goto done;
805 
806 need_revalidate:
807 	dentry = do_revalidate(dentry, nd);
808 	if (!dentry)
809 		goto need_lookup;
810 	if (IS_ERR(dentry))
811 		goto fail;
812 	goto done;
813 
814 fail:
815 	return PTR_ERR(dentry);
816 }
817 
818 /*
819  * Name resolution.
820  * This is the basic name resolution function, turning a pathname into
821  * the final dentry. We expect 'base' to be positive and a directory.
822  *
823  * Returns 0 and nd will have valid dentry and mnt on success.
824  * Returns error and drops reference to input namei data on failure.
825  */
826 static fastcall int __link_path_walk(const char * name, struct nameidata *nd)
827 {
828 	struct path next;
829 	struct inode *inode;
830 	int err;
831 	unsigned int lookup_flags = nd->flags;
832 
833 	while (*name=='/')
834 		name++;
835 	if (!*name)
836 		goto return_reval;
837 
838 	inode = nd->dentry->d_inode;
839 	if (nd->depth)
840 		lookup_flags = LOOKUP_FOLLOW | (nd->flags & LOOKUP_CONTINUE);
841 
842 	/* At this point we know we have a real path component. */
843 	for(;;) {
844 		unsigned long hash;
845 		struct qstr this;
846 		unsigned int c;
847 
848 		nd->flags |= LOOKUP_CONTINUE;
849 		err = exec_permission_lite(inode, nd);
850 		if (err == -EAGAIN)
851 			err = vfs_permission(nd, MAY_EXEC);
852  		if (err)
853 			break;
854 
855 		this.name = name;
856 		c = *(const unsigned char *)name;
857 
858 		hash = init_name_hash();
859 		do {
860 			name++;
861 			hash = partial_name_hash(c, hash);
862 			c = *(const unsigned char *)name;
863 		} while (c && (c != '/'));
864 		this.len = name - (const char *) this.name;
865 		this.hash = end_name_hash(hash);
866 
867 		/* remove trailing slashes? */
868 		if (!c)
869 			goto last_component;
870 		while (*++name == '/');
871 		if (!*name)
872 			goto last_with_slashes;
873 
874 		/*
875 		 * "." and ".." are special - ".." especially so because it has
876 		 * to be able to know about the current root directory and
877 		 * parent relationships.
878 		 */
879 		if (this.name[0] == '.') switch (this.len) {
880 			default:
881 				break;
882 			case 2:
883 				if (this.name[1] != '.')
884 					break;
885 				follow_dotdot(nd);
886 				inode = nd->dentry->d_inode;
887 				/* fallthrough */
888 			case 1:
889 				continue;
890 		}
891 		/*
892 		 * See if the low-level filesystem might want
893 		 * to use its own hash..
894 		 */
895 		if (nd->dentry->d_op && nd->dentry->d_op->d_hash) {
896 			err = nd->dentry->d_op->d_hash(nd->dentry, &this);
897 			if (err < 0)
898 				break;
899 		}
900 		/* This does the actual lookups.. */
901 		err = do_lookup(nd, &this, &next);
902 		if (err)
903 			break;
904 
905 		err = -ENOENT;
906 		inode = next.dentry->d_inode;
907 		if (!inode)
908 			goto out_dput;
909 		err = -ENOTDIR;
910 		if (!inode->i_op)
911 			goto out_dput;
912 
913 		if (inode->i_op->follow_link) {
914 			err = do_follow_link(&next, nd);
915 			if (err)
916 				goto return_err;
917 			err = -ENOENT;
918 			inode = nd->dentry->d_inode;
919 			if (!inode)
920 				break;
921 			err = -ENOTDIR;
922 			if (!inode->i_op)
923 				break;
924 		} else
925 			path_to_nameidata(&next, nd);
926 		err = -ENOTDIR;
927 		if (!inode->i_op->lookup)
928 			break;
929 		continue;
930 		/* here ends the main loop */
931 
932 last_with_slashes:
933 		lookup_flags |= LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
934 last_component:
935 		/* Clear LOOKUP_CONTINUE iff it was previously unset */
936 		nd->flags &= lookup_flags | ~LOOKUP_CONTINUE;
937 		if (lookup_flags & LOOKUP_PARENT)
938 			goto lookup_parent;
939 		if (this.name[0] == '.') switch (this.len) {
940 			default:
941 				break;
942 			case 2:
943 				if (this.name[1] != '.')
944 					break;
945 				follow_dotdot(nd);
946 				inode = nd->dentry->d_inode;
947 				/* fallthrough */
948 			case 1:
949 				goto return_reval;
950 		}
951 		if (nd->dentry->d_op && nd->dentry->d_op->d_hash) {
952 			err = nd->dentry->d_op->d_hash(nd->dentry, &this);
953 			if (err < 0)
954 				break;
955 		}
956 		err = do_lookup(nd, &this, &next);
957 		if (err)
958 			break;
959 		inode = next.dentry->d_inode;
960 		if ((lookup_flags & LOOKUP_FOLLOW)
961 		    && inode && inode->i_op && inode->i_op->follow_link) {
962 			err = do_follow_link(&next, nd);
963 			if (err)
964 				goto return_err;
965 			inode = nd->dentry->d_inode;
966 		} else
967 			path_to_nameidata(&next, nd);
968 		err = -ENOENT;
969 		if (!inode)
970 			break;
971 		if (lookup_flags & LOOKUP_DIRECTORY) {
972 			err = -ENOTDIR;
973 			if (!inode->i_op || !inode->i_op->lookup)
974 				break;
975 		}
976 		goto return_base;
977 lookup_parent:
978 		nd->last = this;
979 		nd->last_type = LAST_NORM;
980 		if (this.name[0] != '.')
981 			goto return_base;
982 		if (this.len == 1)
983 			nd->last_type = LAST_DOT;
984 		else if (this.len == 2 && this.name[1] == '.')
985 			nd->last_type = LAST_DOTDOT;
986 		else
987 			goto return_base;
988 return_reval:
989 		/*
990 		 * We bypassed the ordinary revalidation routines.
991 		 * We may need to check the cached dentry for staleness.
992 		 */
993 		if (nd->dentry && nd->dentry->d_sb &&
994 		    (nd->dentry->d_sb->s_type->fs_flags & FS_REVAL_DOT)) {
995 			err = -ESTALE;
996 			/* Note: we do not d_invalidate() */
997 			if (!nd->dentry->d_op->d_revalidate(nd->dentry, nd))
998 				break;
999 		}
1000 return_base:
1001 		return 0;
1002 out_dput:
1003 		dput_path(&next, nd);
1004 		break;
1005 	}
1006 	path_release(nd);
1007 return_err:
1008 	return err;
1009 }
1010 
1011 /*
1012  * Wrapper to retry pathname resolution whenever the underlying
1013  * file system returns an ESTALE.
1014  *
1015  * Retry the whole path once, forcing real lookup requests
1016  * instead of relying on the dcache.
1017  */
1018 static int fastcall link_path_walk(const char *name, struct nameidata *nd)
1019 {
1020 	struct nameidata save = *nd;
1021 	int result;
1022 
1023 	/* make sure the stuff we saved doesn't go away */
1024 	dget(save.dentry);
1025 	mntget(save.mnt);
1026 
1027 	result = __link_path_walk(name, nd);
1028 	if (result == -ESTALE) {
1029 		*nd = save;
1030 		dget(nd->dentry);
1031 		mntget(nd->mnt);
1032 		nd->flags |= LOOKUP_REVAL;
1033 		result = __link_path_walk(name, nd);
1034 	}
1035 
1036 	dput(save.dentry);
1037 	mntput(save.mnt);
1038 
1039 	return result;
1040 }
1041 
1042 static int fastcall path_walk(const char * name, struct nameidata *nd)
1043 {
1044 	current->total_link_count = 0;
1045 	return link_path_walk(name, nd);
1046 }
1047 
1048 /*
1049  * SMP-safe: Returns 1 and nd will have valid dentry and mnt, if
1050  * everything is done. Returns 0 and drops input nd, if lookup failed;
1051  */
1052 static int __emul_lookup_dentry(const char *name, struct nameidata *nd)
1053 {
1054 	if (path_walk(name, nd))
1055 		return 0;		/* something went wrong... */
1056 
1057 	if (!nd->dentry->d_inode || S_ISDIR(nd->dentry->d_inode->i_mode)) {
1058 		struct dentry *old_dentry = nd->dentry;
1059 		struct vfsmount *old_mnt = nd->mnt;
1060 		struct qstr last = nd->last;
1061 		int last_type = nd->last_type;
1062 		struct fs_struct *fs = current->fs;
1063 
1064 		/*
1065 		 * NAME was not found in alternate root or it's a directory.
1066 		 * Try to find it in the normal root:
1067 		 */
1068 		nd->last_type = LAST_ROOT;
1069 		read_lock(&fs->lock);
1070 		nd->mnt = mntget(fs->rootmnt);
1071 		nd->dentry = dget(fs->root);
1072 		read_unlock(&fs->lock);
1073 		if (path_walk(name, nd) == 0) {
1074 			if (nd->dentry->d_inode) {
1075 				dput(old_dentry);
1076 				mntput(old_mnt);
1077 				return 1;
1078 			}
1079 			path_release(nd);
1080 		}
1081 		nd->dentry = old_dentry;
1082 		nd->mnt = old_mnt;
1083 		nd->last = last;
1084 		nd->last_type = last_type;
1085 	}
1086 	return 1;
1087 }
1088 
1089 void set_fs_altroot(void)
1090 {
1091 	char *emul = __emul_prefix();
1092 	struct nameidata nd;
1093 	struct vfsmount *mnt = NULL, *oldmnt;
1094 	struct dentry *dentry = NULL, *olddentry;
1095 	int err;
1096 	struct fs_struct *fs = current->fs;
1097 
1098 	if (!emul)
1099 		goto set_it;
1100 	err = path_lookup(emul, LOOKUP_FOLLOW|LOOKUP_DIRECTORY|LOOKUP_NOALT, &nd);
1101 	if (!err) {
1102 		mnt = nd.mnt;
1103 		dentry = nd.dentry;
1104 	}
1105 set_it:
1106 	write_lock(&fs->lock);
1107 	oldmnt = fs->altrootmnt;
1108 	olddentry = fs->altroot;
1109 	fs->altrootmnt = mnt;
1110 	fs->altroot = dentry;
1111 	write_unlock(&fs->lock);
1112 	if (olddentry) {
1113 		dput(olddentry);
1114 		mntput(oldmnt);
1115 	}
1116 }
1117 
1118 /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
1119 static int fastcall do_path_lookup(int dfd, const char *name,
1120 				unsigned int flags, struct nameidata *nd)
1121 {
1122 	int retval = 0;
1123 	int fput_needed;
1124 	struct file *file;
1125 	struct fs_struct *fs = current->fs;
1126 
1127 	nd->last_type = LAST_ROOT; /* if there are only slashes... */
1128 	nd->flags = flags;
1129 	nd->depth = 0;
1130 
1131 	if (*name=='/') {
1132 		read_lock(&fs->lock);
1133 		if (fs->altroot && !(nd->flags & LOOKUP_NOALT)) {
1134 			nd->mnt = mntget(fs->altrootmnt);
1135 			nd->dentry = dget(fs->altroot);
1136 			read_unlock(&fs->lock);
1137 			if (__emul_lookup_dentry(name,nd))
1138 				goto out; /* found in altroot */
1139 			read_lock(&fs->lock);
1140 		}
1141 		nd->mnt = mntget(fs->rootmnt);
1142 		nd->dentry = dget(fs->root);
1143 		read_unlock(&fs->lock);
1144 	} else if (dfd == AT_FDCWD) {
1145 		read_lock(&fs->lock);
1146 		nd->mnt = mntget(fs->pwdmnt);
1147 		nd->dentry = dget(fs->pwd);
1148 		read_unlock(&fs->lock);
1149 	} else {
1150 		struct dentry *dentry;
1151 
1152 		file = fget_light(dfd, &fput_needed);
1153 		retval = -EBADF;
1154 		if (!file)
1155 			goto out_fail;
1156 
1157 		dentry = file->f_path.dentry;
1158 
1159 		retval = -ENOTDIR;
1160 		if (!S_ISDIR(dentry->d_inode->i_mode))
1161 			goto fput_fail;
1162 
1163 		retval = file_permission(file, MAY_EXEC);
1164 		if (retval)
1165 			goto fput_fail;
1166 
1167 		nd->mnt = mntget(file->f_path.mnt);
1168 		nd->dentry = dget(dentry);
1169 
1170 		fput_light(file, fput_needed);
1171 	}
1172 
1173 	retval = path_walk(name, nd);
1174 out:
1175 	if (unlikely(!retval && !audit_dummy_context() && nd->dentry &&
1176 				nd->dentry->d_inode))
1177 		audit_inode(name, nd->dentry);
1178 out_fail:
1179 	return retval;
1180 
1181 fput_fail:
1182 	fput_light(file, fput_needed);
1183 	goto out_fail;
1184 }
1185 
1186 int fastcall path_lookup(const char *name, unsigned int flags,
1187 			struct nameidata *nd)
1188 {
1189 	return do_path_lookup(AT_FDCWD, name, flags, nd);
1190 }
1191 
1192 /**
1193  * vfs_path_lookup - lookup a file path relative to a dentry-vfsmount pair
1194  * @dentry:  pointer to dentry of the base directory
1195  * @mnt: pointer to vfs mount of the base directory
1196  * @name: pointer to file name
1197  * @flags: lookup flags
1198  * @nd: pointer to nameidata
1199  */
1200 int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
1201 		    const char *name, unsigned int flags,
1202 		    struct nameidata *nd)
1203 {
1204 	int retval;
1205 
1206 	/* same as do_path_lookup */
1207 	nd->last_type = LAST_ROOT;
1208 	nd->flags = flags;
1209 	nd->depth = 0;
1210 
1211 	nd->mnt = mntget(mnt);
1212 	nd->dentry = dget(dentry);
1213 
1214 	retval = path_walk(name, nd);
1215 	if (unlikely(!retval && !audit_dummy_context() && nd->dentry &&
1216 				nd->dentry->d_inode))
1217 		audit_inode(name, nd->dentry);
1218 
1219 	return retval;
1220 
1221 }
1222 
1223 static int __path_lookup_intent_open(int dfd, const char *name,
1224 		unsigned int lookup_flags, struct nameidata *nd,
1225 		int open_flags, int create_mode)
1226 {
1227 	struct file *filp = get_empty_filp();
1228 	int err;
1229 
1230 	if (filp == NULL)
1231 		return -ENFILE;
1232 	nd->intent.open.file = filp;
1233 	nd->intent.open.flags = open_flags;
1234 	nd->intent.open.create_mode = create_mode;
1235 	err = do_path_lookup(dfd, name, lookup_flags|LOOKUP_OPEN, nd);
1236 	if (IS_ERR(nd->intent.open.file)) {
1237 		if (err == 0) {
1238 			err = PTR_ERR(nd->intent.open.file);
1239 			path_release(nd);
1240 		}
1241 	} else if (err != 0)
1242 		release_open_intent(nd);
1243 	return err;
1244 }
1245 
1246 /**
1247  * path_lookup_open - lookup a file path with open intent
1248  * @dfd: the directory to use as base, or AT_FDCWD
1249  * @name: pointer to file name
1250  * @lookup_flags: lookup intent flags
1251  * @nd: pointer to nameidata
1252  * @open_flags: open intent flags
1253  */
1254 int path_lookup_open(int dfd, const char *name, unsigned int lookup_flags,
1255 		struct nameidata *nd, int open_flags)
1256 {
1257 	return __path_lookup_intent_open(dfd, name, lookup_flags, nd,
1258 			open_flags, 0);
1259 }
1260 
1261 /**
1262  * path_lookup_create - lookup a file path with open + create intent
1263  * @dfd: the directory to use as base, or AT_FDCWD
1264  * @name: pointer to file name
1265  * @lookup_flags: lookup intent flags
1266  * @nd: pointer to nameidata
1267  * @open_flags: open intent flags
1268  * @create_mode: create intent flags
1269  */
1270 static int path_lookup_create(int dfd, const char *name,
1271 			      unsigned int lookup_flags, struct nameidata *nd,
1272 			      int open_flags, int create_mode)
1273 {
1274 	return __path_lookup_intent_open(dfd, name, lookup_flags|LOOKUP_CREATE,
1275 			nd, open_flags, create_mode);
1276 }
1277 
1278 int __user_path_lookup_open(const char __user *name, unsigned int lookup_flags,
1279 		struct nameidata *nd, int open_flags)
1280 {
1281 	char *tmp = getname(name);
1282 	int err = PTR_ERR(tmp);
1283 
1284 	if (!IS_ERR(tmp)) {
1285 		err = __path_lookup_intent_open(AT_FDCWD, tmp, lookup_flags, nd, open_flags, 0);
1286 		putname(tmp);
1287 	}
1288 	return err;
1289 }
1290 
1291 static struct dentry *__lookup_hash(struct qstr *name,
1292 		struct dentry *base, struct nameidata *nd)
1293 {
1294 	struct dentry *dentry;
1295 	struct inode *inode;
1296 	int err;
1297 
1298 	inode = base->d_inode;
1299 
1300 	/*
1301 	 * See if the low-level filesystem might want
1302 	 * to use its own hash..
1303 	 */
1304 	if (base->d_op && base->d_op->d_hash) {
1305 		err = base->d_op->d_hash(base, name);
1306 		dentry = ERR_PTR(err);
1307 		if (err < 0)
1308 			goto out;
1309 	}
1310 
1311 	dentry = cached_lookup(base, name, nd);
1312 	if (!dentry) {
1313 		struct dentry *new = d_alloc(base, name);
1314 		dentry = ERR_PTR(-ENOMEM);
1315 		if (!new)
1316 			goto out;
1317 		dentry = inode->i_op->lookup(inode, new, nd);
1318 		if (!dentry)
1319 			dentry = new;
1320 		else
1321 			dput(new);
1322 	}
1323 out:
1324 	return dentry;
1325 }
1326 
1327 /*
1328  * Restricted form of lookup. Doesn't follow links, single-component only,
1329  * needs parent already locked. Doesn't follow mounts.
1330  * SMP-safe.
1331  */
1332 static struct dentry *lookup_hash(struct nameidata *nd)
1333 {
1334 	int err;
1335 
1336 	err = permission(nd->dentry->d_inode, MAY_EXEC, nd);
1337 	if (err)
1338 		return ERR_PTR(err);
1339 	return __lookup_hash(&nd->last, nd->dentry, nd);
1340 }
1341 
1342 static int __lookup_one_len(const char *name, struct qstr *this,
1343 		struct dentry *base, int len)
1344 {
1345 	unsigned long hash;
1346 	unsigned int c;
1347 
1348 	this->name = name;
1349 	this->len = len;
1350 	if (!len)
1351 		return -EACCES;
1352 
1353 	hash = init_name_hash();
1354 	while (len--) {
1355 		c = *(const unsigned char *)name++;
1356 		if (c == '/' || c == '\0')
1357 			return -EACCES;
1358 		hash = partial_name_hash(c, hash);
1359 	}
1360 	this->hash = end_name_hash(hash);
1361 	return 0;
1362 }
1363 
1364 /**
1365  * lookup_one_len:  filesystem helper to lookup single pathname component
1366  * @name:	pathname component to lookup
1367  * @base:	base directory to lookup from
1368  * @len:	maximum length @len should be interpreted to
1369  *
1370  * Note that this routine is purely a helper for filesystem useage and should
1371  * not be called by generic code.  Also note that by using this function to
1372  * nameidata argument is passed to the filesystem methods and a filesystem
1373  * using this helper needs to be prepared for that.
1374  */
1375 struct dentry *lookup_one_len(const char *name, struct dentry *base, int len)
1376 {
1377 	int err;
1378 	struct qstr this;
1379 
1380 	err = __lookup_one_len(name, &this, base, len);
1381 	if (err)
1382 		return ERR_PTR(err);
1383 
1384 	err = permission(base->d_inode, MAY_EXEC, NULL);
1385 	if (err)
1386 		return ERR_PTR(err);
1387 	return __lookup_hash(&this, base, NULL);
1388 }
1389 
1390 /**
1391  * lookup_one_noperm - bad hack for sysfs
1392  * @name:	pathname component to lookup
1393  * @base:	base directory to lookup from
1394  *
1395  * This is a variant of lookup_one_len that doesn't perform any permission
1396  * checks.   It's a horrible hack to work around the braindead sysfs
1397  * architecture and should not be used anywhere else.
1398  *
1399  * DON'T USE THIS FUNCTION EVER, thanks.
1400  */
1401 struct dentry *lookup_one_noperm(const char *name, struct dentry *base)
1402 {
1403 	int err;
1404 	struct qstr this;
1405 
1406 	err = __lookup_one_len(name, &this, base, strlen(name));
1407 	if (err)
1408 		return ERR_PTR(err);
1409 	return __lookup_hash(&this, base, NULL);
1410 }
1411 
1412 int fastcall __user_walk_fd(int dfd, const char __user *name, unsigned flags,
1413 			    struct nameidata *nd)
1414 {
1415 	char *tmp = getname(name);
1416 	int err = PTR_ERR(tmp);
1417 
1418 	if (!IS_ERR(tmp)) {
1419 		err = do_path_lookup(dfd, tmp, flags, nd);
1420 		putname(tmp);
1421 	}
1422 	return err;
1423 }
1424 
1425 int fastcall __user_walk(const char __user *name, unsigned flags, struct nameidata *nd)
1426 {
1427 	return __user_walk_fd(AT_FDCWD, name, flags, nd);
1428 }
1429 
1430 /*
1431  * It's inline, so penalty for filesystems that don't use sticky bit is
1432  * minimal.
1433  */
1434 static inline int check_sticky(struct inode *dir, struct inode *inode)
1435 {
1436 	if (!(dir->i_mode & S_ISVTX))
1437 		return 0;
1438 	if (inode->i_uid == current->fsuid)
1439 		return 0;
1440 	if (dir->i_uid == current->fsuid)
1441 		return 0;
1442 	return !capable(CAP_FOWNER);
1443 }
1444 
1445 /*
1446  *	Check whether we can remove a link victim from directory dir, check
1447  *  whether the type of victim is right.
1448  *  1. We can't do it if dir is read-only (done in permission())
1449  *  2. We should have write and exec permissions on dir
1450  *  3. We can't remove anything from append-only dir
1451  *  4. We can't do anything with immutable dir (done in permission())
1452  *  5. If the sticky bit on dir is set we should either
1453  *	a. be owner of dir, or
1454  *	b. be owner of victim, or
1455  *	c. have CAP_FOWNER capability
1456  *  6. If the victim is append-only or immutable we can't do antyhing with
1457  *     links pointing to it.
1458  *  7. If we were asked to remove a directory and victim isn't one - ENOTDIR.
1459  *  8. If we were asked to remove a non-directory and victim isn't one - EISDIR.
1460  *  9. We can't remove a root or mountpoint.
1461  * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
1462  *     nfs_async_unlink().
1463  */
1464 static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
1465 {
1466 	int error;
1467 
1468 	if (!victim->d_inode)
1469 		return -ENOENT;
1470 
1471 	BUG_ON(victim->d_parent->d_inode != dir);
1472 	audit_inode_child(victim->d_name.name, victim, dir);
1473 
1474 	error = permission(dir,MAY_WRITE | MAY_EXEC, NULL);
1475 	if (error)
1476 		return error;
1477 	if (IS_APPEND(dir))
1478 		return -EPERM;
1479 	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
1480 	    IS_IMMUTABLE(victim->d_inode))
1481 		return -EPERM;
1482 	if (isdir) {
1483 		if (!S_ISDIR(victim->d_inode->i_mode))
1484 			return -ENOTDIR;
1485 		if (IS_ROOT(victim))
1486 			return -EBUSY;
1487 	} else if (S_ISDIR(victim->d_inode->i_mode))
1488 		return -EISDIR;
1489 	if (IS_DEADDIR(dir))
1490 		return -ENOENT;
1491 	if (victim->d_flags & DCACHE_NFSFS_RENAMED)
1492 		return -EBUSY;
1493 	return 0;
1494 }
1495 
1496 /*	Check whether we can create an object with dentry child in directory
1497  *  dir.
1498  *  1. We can't do it if child already exists (open has special treatment for
1499  *     this case, but since we are inlined it's OK)
1500  *  2. We can't do it if dir is read-only (done in permission())
1501  *  3. We should have write and exec permissions on dir
1502  *  4. We can't do it if dir is immutable (done in permission())
1503  */
1504 static inline int may_create(struct inode *dir, struct dentry *child,
1505 			     struct nameidata *nd)
1506 {
1507 	if (child->d_inode)
1508 		return -EEXIST;
1509 	if (IS_DEADDIR(dir))
1510 		return -ENOENT;
1511 	return permission(dir,MAY_WRITE | MAY_EXEC, nd);
1512 }
1513 
1514 /*
1515  * O_DIRECTORY translates into forcing a directory lookup.
1516  */
1517 static inline int lookup_flags(unsigned int f)
1518 {
1519 	unsigned long retval = LOOKUP_FOLLOW;
1520 
1521 	if (f & O_NOFOLLOW)
1522 		retval &= ~LOOKUP_FOLLOW;
1523 
1524 	if (f & O_DIRECTORY)
1525 		retval |= LOOKUP_DIRECTORY;
1526 
1527 	return retval;
1528 }
1529 
1530 /*
1531  * p1 and p2 should be directories on the same fs.
1532  */
1533 struct dentry *lock_rename(struct dentry *p1, struct dentry *p2)
1534 {
1535 	struct dentry *p;
1536 
1537 	if (p1 == p2) {
1538 		mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
1539 		return NULL;
1540 	}
1541 
1542 	mutex_lock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
1543 
1544 	for (p = p1; p->d_parent != p; p = p->d_parent) {
1545 		if (p->d_parent == p2) {
1546 			mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_PARENT);
1547 			mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_CHILD);
1548 			return p;
1549 		}
1550 	}
1551 
1552 	for (p = p2; p->d_parent != p; p = p->d_parent) {
1553 		if (p->d_parent == p1) {
1554 			mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
1555 			mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
1556 			return p;
1557 		}
1558 	}
1559 
1560 	mutex_lock_nested(&p1->d_inode->i_mutex, I_MUTEX_PARENT);
1561 	mutex_lock_nested(&p2->d_inode->i_mutex, I_MUTEX_CHILD);
1562 	return NULL;
1563 }
1564 
1565 void unlock_rename(struct dentry *p1, struct dentry *p2)
1566 {
1567 	mutex_unlock(&p1->d_inode->i_mutex);
1568 	if (p1 != p2) {
1569 		mutex_unlock(&p2->d_inode->i_mutex);
1570 		mutex_unlock(&p1->d_inode->i_sb->s_vfs_rename_mutex);
1571 	}
1572 }
1573 
1574 int vfs_create(struct inode *dir, struct dentry *dentry, int mode,
1575 		struct nameidata *nd)
1576 {
1577 	int error = may_create(dir, dentry, nd);
1578 
1579 	if (error)
1580 		return error;
1581 
1582 	if (!dir->i_op || !dir->i_op->create)
1583 		return -EACCES;	/* shouldn't it be ENOSYS? */
1584 	mode &= S_IALLUGO;
1585 	mode |= S_IFREG;
1586 	error = security_inode_create(dir, dentry, mode);
1587 	if (error)
1588 		return error;
1589 	DQUOT_INIT(dir);
1590 	error = dir->i_op->create(dir, dentry, mode, nd);
1591 	if (!error)
1592 		fsnotify_create(dir, dentry);
1593 	return error;
1594 }
1595 
1596 int may_open(struct nameidata *nd, int acc_mode, int flag)
1597 {
1598 	struct dentry *dentry = nd->dentry;
1599 	struct inode *inode = dentry->d_inode;
1600 	int error;
1601 
1602 	if (!inode)
1603 		return -ENOENT;
1604 
1605 	if (S_ISLNK(inode->i_mode))
1606 		return -ELOOP;
1607 
1608 	if (S_ISDIR(inode->i_mode) && (acc_mode & MAY_WRITE))
1609 		return -EISDIR;
1610 
1611 	/*
1612 	 * FIFO's, sockets and device files are special: they don't
1613 	 * actually live on the filesystem itself, and as such you
1614 	 * can write to them even if the filesystem is read-only.
1615 	 */
1616 	if (S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
1617 	    	flag &= ~O_TRUNC;
1618 	} else if (S_ISBLK(inode->i_mode) || S_ISCHR(inode->i_mode)) {
1619 		if (nd->mnt->mnt_flags & MNT_NODEV)
1620 			return -EACCES;
1621 
1622 		flag &= ~O_TRUNC;
1623 	} else if (IS_RDONLY(inode) && (acc_mode & MAY_WRITE))
1624 		return -EROFS;
1625 
1626 	error = vfs_permission(nd, acc_mode);
1627 	if (error)
1628 		return error;
1629 	/*
1630 	 * An append-only file must be opened in append mode for writing.
1631 	 */
1632 	if (IS_APPEND(inode)) {
1633 		if  ((flag & FMODE_WRITE) && !(flag & O_APPEND))
1634 			return -EPERM;
1635 		if (flag & O_TRUNC)
1636 			return -EPERM;
1637 	}
1638 
1639 	/* O_NOATIME can only be set by the owner or superuser */
1640 	if (flag & O_NOATIME)
1641 		if (!is_owner_or_cap(inode))
1642 			return -EPERM;
1643 
1644 	/*
1645 	 * Ensure there are no outstanding leases on the file.
1646 	 */
1647 	error = break_lease(inode, flag);
1648 	if (error)
1649 		return error;
1650 
1651 	if (flag & O_TRUNC) {
1652 		error = get_write_access(inode);
1653 		if (error)
1654 			return error;
1655 
1656 		/*
1657 		 * Refuse to truncate files with mandatory locks held on them.
1658 		 */
1659 		error = locks_verify_locked(inode);
1660 		if (!error) {
1661 			DQUOT_INIT(inode);
1662 
1663 			error = do_truncate(dentry, 0,
1664 					    ATTR_MTIME|ATTR_CTIME|ATTR_OPEN,
1665 					    NULL);
1666 		}
1667 		put_write_access(inode);
1668 		if (error)
1669 			return error;
1670 	} else
1671 		if (flag & FMODE_WRITE)
1672 			DQUOT_INIT(inode);
1673 
1674 	return 0;
1675 }
1676 
1677 static int open_namei_create(struct nameidata *nd, struct path *path,
1678 				int flag, int mode)
1679 {
1680 	int error;
1681 	struct dentry *dir = nd->dentry;
1682 
1683 	if (!IS_POSIXACL(dir->d_inode))
1684 		mode &= ~current->fs->umask;
1685 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
1686 	mutex_unlock(&dir->d_inode->i_mutex);
1687 	dput(nd->dentry);
1688 	nd->dentry = path->dentry;
1689 	if (error)
1690 		return error;
1691 	/* Don't check for write permission, don't truncate */
1692 	return may_open(nd, 0, flag & ~O_TRUNC);
1693 }
1694 
1695 /*
1696  *	open_namei()
1697  *
1698  * namei for open - this is in fact almost the whole open-routine.
1699  *
1700  * Note that the low bits of "flag" aren't the same as in the open
1701  * system call - they are 00 - no permissions needed
1702  *			  01 - read permission needed
1703  *			  10 - write permission needed
1704  *			  11 - read/write permissions needed
1705  * which is a lot more logical, and also allows the "no perm" needed
1706  * for symlinks (where the permissions are checked later).
1707  * SMP-safe
1708  */
1709 int open_namei(int dfd, const char *pathname, int flag,
1710 		int mode, struct nameidata *nd)
1711 {
1712 	int acc_mode, error;
1713 	struct path path;
1714 	struct dentry *dir;
1715 	int count = 0;
1716 
1717 	acc_mode = ACC_MODE(flag);
1718 
1719 	/* O_TRUNC implies we need access checks for write permissions */
1720 	if (flag & O_TRUNC)
1721 		acc_mode |= MAY_WRITE;
1722 
1723 	/* Allow the LSM permission hook to distinguish append
1724 	   access from general write access. */
1725 	if (flag & O_APPEND)
1726 		acc_mode |= MAY_APPEND;
1727 
1728 	/*
1729 	 * The simplest case - just a plain lookup.
1730 	 */
1731 	if (!(flag & O_CREAT)) {
1732 		error = path_lookup_open(dfd, pathname, lookup_flags(flag),
1733 					 nd, flag);
1734 		if (error)
1735 			return error;
1736 		goto ok;
1737 	}
1738 
1739 	/*
1740 	 * Create - we need to know the parent.
1741 	 */
1742 	error = path_lookup_create(dfd,pathname,LOOKUP_PARENT,nd,flag,mode);
1743 	if (error)
1744 		return error;
1745 
1746 	/*
1747 	 * We have the parent and last component. First of all, check
1748 	 * that we are not asked to creat(2) an obvious directory - that
1749 	 * will not do.
1750 	 */
1751 	error = -EISDIR;
1752 	if (nd->last_type != LAST_NORM || nd->last.name[nd->last.len])
1753 		goto exit;
1754 
1755 	dir = nd->dentry;
1756 	nd->flags &= ~LOOKUP_PARENT;
1757 	mutex_lock(&dir->d_inode->i_mutex);
1758 	path.dentry = lookup_hash(nd);
1759 	path.mnt = nd->mnt;
1760 
1761 do_last:
1762 	error = PTR_ERR(path.dentry);
1763 	if (IS_ERR(path.dentry)) {
1764 		mutex_unlock(&dir->d_inode->i_mutex);
1765 		goto exit;
1766 	}
1767 
1768 	if (IS_ERR(nd->intent.open.file)) {
1769 		mutex_unlock(&dir->d_inode->i_mutex);
1770 		error = PTR_ERR(nd->intent.open.file);
1771 		goto exit_dput;
1772 	}
1773 
1774 	/* Negative dentry, just create the file */
1775 	if (!path.dentry->d_inode) {
1776 		error = open_namei_create(nd, &path, flag, mode);
1777 		if (error)
1778 			goto exit;
1779 		return 0;
1780 	}
1781 
1782 	/*
1783 	 * It already exists.
1784 	 */
1785 	mutex_unlock(&dir->d_inode->i_mutex);
1786 	audit_inode(pathname, path.dentry);
1787 
1788 	error = -EEXIST;
1789 	if (flag & O_EXCL)
1790 		goto exit_dput;
1791 
1792 	if (__follow_mount(&path)) {
1793 		error = -ELOOP;
1794 		if (flag & O_NOFOLLOW)
1795 			goto exit_dput;
1796 	}
1797 
1798 	error = -ENOENT;
1799 	if (!path.dentry->d_inode)
1800 		goto exit_dput;
1801 	if (path.dentry->d_inode->i_op && path.dentry->d_inode->i_op->follow_link)
1802 		goto do_link;
1803 
1804 	path_to_nameidata(&path, nd);
1805 	error = -EISDIR;
1806 	if (path.dentry->d_inode && S_ISDIR(path.dentry->d_inode->i_mode))
1807 		goto exit;
1808 ok:
1809 	error = may_open(nd, acc_mode, flag);
1810 	if (error)
1811 		goto exit;
1812 	return 0;
1813 
1814 exit_dput:
1815 	dput_path(&path, nd);
1816 exit:
1817 	if (!IS_ERR(nd->intent.open.file))
1818 		release_open_intent(nd);
1819 	path_release(nd);
1820 	return error;
1821 
1822 do_link:
1823 	error = -ELOOP;
1824 	if (flag & O_NOFOLLOW)
1825 		goto exit_dput;
1826 	/*
1827 	 * This is subtle. Instead of calling do_follow_link() we do the
1828 	 * thing by hands. The reason is that this way we have zero link_count
1829 	 * and path_walk() (called from ->follow_link) honoring LOOKUP_PARENT.
1830 	 * After that we have the parent and last component, i.e.
1831 	 * we are in the same situation as after the first path_walk().
1832 	 * Well, almost - if the last component is normal we get its copy
1833 	 * stored in nd->last.name and we will have to putname() it when we
1834 	 * are done. Procfs-like symlinks just set LAST_BIND.
1835 	 */
1836 	nd->flags |= LOOKUP_PARENT;
1837 	error = security_inode_follow_link(path.dentry, nd);
1838 	if (error)
1839 		goto exit_dput;
1840 	error = __do_follow_link(&path, nd);
1841 	if (error) {
1842 		/* Does someone understand code flow here? Or it is only
1843 		 * me so stupid? Anathema to whoever designed this non-sense
1844 		 * with "intent.open".
1845 		 */
1846 		release_open_intent(nd);
1847 		return error;
1848 	}
1849 	nd->flags &= ~LOOKUP_PARENT;
1850 	if (nd->last_type == LAST_BIND)
1851 		goto ok;
1852 	error = -EISDIR;
1853 	if (nd->last_type != LAST_NORM)
1854 		goto exit;
1855 	if (nd->last.name[nd->last.len]) {
1856 		__putname(nd->last.name);
1857 		goto exit;
1858 	}
1859 	error = -ELOOP;
1860 	if (count++==32) {
1861 		__putname(nd->last.name);
1862 		goto exit;
1863 	}
1864 	dir = nd->dentry;
1865 	mutex_lock(&dir->d_inode->i_mutex);
1866 	path.dentry = lookup_hash(nd);
1867 	path.mnt = nd->mnt;
1868 	__putname(nd->last.name);
1869 	goto do_last;
1870 }
1871 
1872 /**
1873  * lookup_create - lookup a dentry, creating it if it doesn't exist
1874  * @nd: nameidata info
1875  * @is_dir: directory flag
1876  *
1877  * Simple function to lookup and return a dentry and create it
1878  * if it doesn't exist.  Is SMP-safe.
1879  *
1880  * Returns with nd->dentry->d_inode->i_mutex locked.
1881  */
1882 struct dentry *lookup_create(struct nameidata *nd, int is_dir)
1883 {
1884 	struct dentry *dentry = ERR_PTR(-EEXIST);
1885 
1886 	mutex_lock_nested(&nd->dentry->d_inode->i_mutex, I_MUTEX_PARENT);
1887 	/*
1888 	 * Yucky last component or no last component at all?
1889 	 * (foo/., foo/.., /////)
1890 	 */
1891 	if (nd->last_type != LAST_NORM)
1892 		goto fail;
1893 	nd->flags &= ~LOOKUP_PARENT;
1894 	nd->flags |= LOOKUP_CREATE;
1895 	nd->intent.open.flags = O_EXCL;
1896 
1897 	/*
1898 	 * Do the final lookup.
1899 	 */
1900 	dentry = lookup_hash(nd);
1901 	if (IS_ERR(dentry))
1902 		goto fail;
1903 
1904 	/*
1905 	 * Special case - lookup gave negative, but... we had foo/bar/
1906 	 * From the vfs_mknod() POV we just have a negative dentry -
1907 	 * all is fine. Let's be bastards - you had / on the end, you've
1908 	 * been asking for (non-existent) directory. -ENOENT for you.
1909 	 */
1910 	if (!is_dir && nd->last.name[nd->last.len] && !dentry->d_inode)
1911 		goto enoent;
1912 	return dentry;
1913 enoent:
1914 	dput(dentry);
1915 	dentry = ERR_PTR(-ENOENT);
1916 fail:
1917 	return dentry;
1918 }
1919 EXPORT_SYMBOL_GPL(lookup_create);
1920 
1921 int vfs_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
1922 {
1923 	int error = may_create(dir, dentry, NULL);
1924 
1925 	if (error)
1926 		return error;
1927 
1928 	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
1929 		return -EPERM;
1930 
1931 	if (!dir->i_op || !dir->i_op->mknod)
1932 		return -EPERM;
1933 
1934 	error = security_inode_mknod(dir, dentry, mode, dev);
1935 	if (error)
1936 		return error;
1937 
1938 	DQUOT_INIT(dir);
1939 	error = dir->i_op->mknod(dir, dentry, mode, dev);
1940 	if (!error)
1941 		fsnotify_create(dir, dentry);
1942 	return error;
1943 }
1944 
1945 asmlinkage long sys_mknodat(int dfd, const char __user *filename, int mode,
1946 				unsigned dev)
1947 {
1948 	int error = 0;
1949 	char * tmp;
1950 	struct dentry * dentry;
1951 	struct nameidata nd;
1952 
1953 	if (S_ISDIR(mode))
1954 		return -EPERM;
1955 	tmp = getname(filename);
1956 	if (IS_ERR(tmp))
1957 		return PTR_ERR(tmp);
1958 
1959 	error = do_path_lookup(dfd, tmp, LOOKUP_PARENT, &nd);
1960 	if (error)
1961 		goto out;
1962 	dentry = lookup_create(&nd, 0);
1963 	error = PTR_ERR(dentry);
1964 
1965 	if (!IS_POSIXACL(nd.dentry->d_inode))
1966 		mode &= ~current->fs->umask;
1967 	if (!IS_ERR(dentry)) {
1968 		switch (mode & S_IFMT) {
1969 		case 0: case S_IFREG:
1970 			error = vfs_create(nd.dentry->d_inode,dentry,mode,&nd);
1971 			break;
1972 		case S_IFCHR: case S_IFBLK:
1973 			error = vfs_mknod(nd.dentry->d_inode,dentry,mode,
1974 					new_decode_dev(dev));
1975 			break;
1976 		case S_IFIFO: case S_IFSOCK:
1977 			error = vfs_mknod(nd.dentry->d_inode,dentry,mode,0);
1978 			break;
1979 		case S_IFDIR:
1980 			error = -EPERM;
1981 			break;
1982 		default:
1983 			error = -EINVAL;
1984 		}
1985 		dput(dentry);
1986 	}
1987 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
1988 	path_release(&nd);
1989 out:
1990 	putname(tmp);
1991 
1992 	return error;
1993 }
1994 
1995 asmlinkage long sys_mknod(const char __user *filename, int mode, unsigned dev)
1996 {
1997 	return sys_mknodat(AT_FDCWD, filename, mode, dev);
1998 }
1999 
2000 int vfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
2001 {
2002 	int error = may_create(dir, dentry, NULL);
2003 
2004 	if (error)
2005 		return error;
2006 
2007 	if (!dir->i_op || !dir->i_op->mkdir)
2008 		return -EPERM;
2009 
2010 	mode &= (S_IRWXUGO|S_ISVTX);
2011 	error = security_inode_mkdir(dir, dentry, mode);
2012 	if (error)
2013 		return error;
2014 
2015 	DQUOT_INIT(dir);
2016 	error = dir->i_op->mkdir(dir, dentry, mode);
2017 	if (!error)
2018 		fsnotify_mkdir(dir, dentry);
2019 	return error;
2020 }
2021 
2022 asmlinkage long sys_mkdirat(int dfd, const char __user *pathname, int mode)
2023 {
2024 	int error = 0;
2025 	char * tmp;
2026 	struct dentry *dentry;
2027 	struct nameidata nd;
2028 
2029 	tmp = getname(pathname);
2030 	error = PTR_ERR(tmp);
2031 	if (IS_ERR(tmp))
2032 		goto out_err;
2033 
2034 	error = do_path_lookup(dfd, tmp, LOOKUP_PARENT, &nd);
2035 	if (error)
2036 		goto out;
2037 	dentry = lookup_create(&nd, 1);
2038 	error = PTR_ERR(dentry);
2039 	if (IS_ERR(dentry))
2040 		goto out_unlock;
2041 
2042 	if (!IS_POSIXACL(nd.dentry->d_inode))
2043 		mode &= ~current->fs->umask;
2044 	error = vfs_mkdir(nd.dentry->d_inode, dentry, mode);
2045 	dput(dentry);
2046 out_unlock:
2047 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
2048 	path_release(&nd);
2049 out:
2050 	putname(tmp);
2051 out_err:
2052 	return error;
2053 }
2054 
2055 asmlinkage long sys_mkdir(const char __user *pathname, int mode)
2056 {
2057 	return sys_mkdirat(AT_FDCWD, pathname, mode);
2058 }
2059 
2060 /*
2061  * We try to drop the dentry early: we should have
2062  * a usage count of 2 if we're the only user of this
2063  * dentry, and if that is true (possibly after pruning
2064  * the dcache), then we drop the dentry now.
2065  *
2066  * A low-level filesystem can, if it choses, legally
2067  * do a
2068  *
2069  *	if (!d_unhashed(dentry))
2070  *		return -EBUSY;
2071  *
2072  * if it cannot handle the case of removing a directory
2073  * that is still in use by something else..
2074  */
2075 void dentry_unhash(struct dentry *dentry)
2076 {
2077 	dget(dentry);
2078 	shrink_dcache_parent(dentry);
2079 	spin_lock(&dcache_lock);
2080 	spin_lock(&dentry->d_lock);
2081 	if (atomic_read(&dentry->d_count) == 2)
2082 		__d_drop(dentry);
2083 	spin_unlock(&dentry->d_lock);
2084 	spin_unlock(&dcache_lock);
2085 }
2086 
2087 int vfs_rmdir(struct inode *dir, struct dentry *dentry)
2088 {
2089 	int error = may_delete(dir, dentry, 1);
2090 
2091 	if (error)
2092 		return error;
2093 
2094 	if (!dir->i_op || !dir->i_op->rmdir)
2095 		return -EPERM;
2096 
2097 	DQUOT_INIT(dir);
2098 
2099 	mutex_lock(&dentry->d_inode->i_mutex);
2100 	dentry_unhash(dentry);
2101 	if (d_mountpoint(dentry))
2102 		error = -EBUSY;
2103 	else {
2104 		error = security_inode_rmdir(dir, dentry);
2105 		if (!error) {
2106 			error = dir->i_op->rmdir(dir, dentry);
2107 			if (!error)
2108 				dentry->d_inode->i_flags |= S_DEAD;
2109 		}
2110 	}
2111 	mutex_unlock(&dentry->d_inode->i_mutex);
2112 	if (!error) {
2113 		d_delete(dentry);
2114 	}
2115 	dput(dentry);
2116 
2117 	return error;
2118 }
2119 
2120 static long do_rmdir(int dfd, const char __user *pathname)
2121 {
2122 	int error = 0;
2123 	char * name;
2124 	struct dentry *dentry;
2125 	struct nameidata nd;
2126 
2127 	name = getname(pathname);
2128 	if(IS_ERR(name))
2129 		return PTR_ERR(name);
2130 
2131 	error = do_path_lookup(dfd, name, LOOKUP_PARENT, &nd);
2132 	if (error)
2133 		goto exit;
2134 
2135 	switch(nd.last_type) {
2136 		case LAST_DOTDOT:
2137 			error = -ENOTEMPTY;
2138 			goto exit1;
2139 		case LAST_DOT:
2140 			error = -EINVAL;
2141 			goto exit1;
2142 		case LAST_ROOT:
2143 			error = -EBUSY;
2144 			goto exit1;
2145 	}
2146 	mutex_lock_nested(&nd.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2147 	dentry = lookup_hash(&nd);
2148 	error = PTR_ERR(dentry);
2149 	if (IS_ERR(dentry))
2150 		goto exit2;
2151 	error = vfs_rmdir(nd.dentry->d_inode, dentry);
2152 	dput(dentry);
2153 exit2:
2154 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
2155 exit1:
2156 	path_release(&nd);
2157 exit:
2158 	putname(name);
2159 	return error;
2160 }
2161 
2162 asmlinkage long sys_rmdir(const char __user *pathname)
2163 {
2164 	return do_rmdir(AT_FDCWD, pathname);
2165 }
2166 
2167 int vfs_unlink(struct inode *dir, struct dentry *dentry)
2168 {
2169 	int error = may_delete(dir, dentry, 0);
2170 
2171 	if (error)
2172 		return error;
2173 
2174 	if (!dir->i_op || !dir->i_op->unlink)
2175 		return -EPERM;
2176 
2177 	DQUOT_INIT(dir);
2178 
2179 	mutex_lock(&dentry->d_inode->i_mutex);
2180 	if (d_mountpoint(dentry))
2181 		error = -EBUSY;
2182 	else {
2183 		error = security_inode_unlink(dir, dentry);
2184 		if (!error)
2185 			error = dir->i_op->unlink(dir, dentry);
2186 	}
2187 	mutex_unlock(&dentry->d_inode->i_mutex);
2188 
2189 	/* We don't d_delete() NFS sillyrenamed files--they still exist. */
2190 	if (!error && !(dentry->d_flags & DCACHE_NFSFS_RENAMED)) {
2191 		d_delete(dentry);
2192 	}
2193 
2194 	return error;
2195 }
2196 
2197 /*
2198  * Make sure that the actual truncation of the file will occur outside its
2199  * directory's i_mutex.  Truncate can take a long time if there is a lot of
2200  * writeout happening, and we don't want to prevent access to the directory
2201  * while waiting on the I/O.
2202  */
2203 static long do_unlinkat(int dfd, const char __user *pathname)
2204 {
2205 	int error = 0;
2206 	char * name;
2207 	struct dentry *dentry;
2208 	struct nameidata nd;
2209 	struct inode *inode = NULL;
2210 
2211 	name = getname(pathname);
2212 	if(IS_ERR(name))
2213 		return PTR_ERR(name);
2214 
2215 	error = do_path_lookup(dfd, name, LOOKUP_PARENT, &nd);
2216 	if (error)
2217 		goto exit;
2218 	error = -EISDIR;
2219 	if (nd.last_type != LAST_NORM)
2220 		goto exit1;
2221 	mutex_lock_nested(&nd.dentry->d_inode->i_mutex, I_MUTEX_PARENT);
2222 	dentry = lookup_hash(&nd);
2223 	error = PTR_ERR(dentry);
2224 	if (!IS_ERR(dentry)) {
2225 		/* Why not before? Because we want correct error value */
2226 		if (nd.last.name[nd.last.len])
2227 			goto slashes;
2228 		inode = dentry->d_inode;
2229 		if (inode)
2230 			atomic_inc(&inode->i_count);
2231 		error = vfs_unlink(nd.dentry->d_inode, dentry);
2232 	exit2:
2233 		dput(dentry);
2234 	}
2235 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
2236 	if (inode)
2237 		iput(inode);	/* truncate the inode here */
2238 exit1:
2239 	path_release(&nd);
2240 exit:
2241 	putname(name);
2242 	return error;
2243 
2244 slashes:
2245 	error = !dentry->d_inode ? -ENOENT :
2246 		S_ISDIR(dentry->d_inode->i_mode) ? -EISDIR : -ENOTDIR;
2247 	goto exit2;
2248 }
2249 
2250 asmlinkage long sys_unlinkat(int dfd, const char __user *pathname, int flag)
2251 {
2252 	if ((flag & ~AT_REMOVEDIR) != 0)
2253 		return -EINVAL;
2254 
2255 	if (flag & AT_REMOVEDIR)
2256 		return do_rmdir(dfd, pathname);
2257 
2258 	return do_unlinkat(dfd, pathname);
2259 }
2260 
2261 asmlinkage long sys_unlink(const char __user *pathname)
2262 {
2263 	return do_unlinkat(AT_FDCWD, pathname);
2264 }
2265 
2266 int vfs_symlink(struct inode *dir, struct dentry *dentry, const char *oldname, int mode)
2267 {
2268 	int error = may_create(dir, dentry, NULL);
2269 
2270 	if (error)
2271 		return error;
2272 
2273 	if (!dir->i_op || !dir->i_op->symlink)
2274 		return -EPERM;
2275 
2276 	error = security_inode_symlink(dir, dentry, oldname);
2277 	if (error)
2278 		return error;
2279 
2280 	DQUOT_INIT(dir);
2281 	error = dir->i_op->symlink(dir, dentry, oldname);
2282 	if (!error)
2283 		fsnotify_create(dir, dentry);
2284 	return error;
2285 }
2286 
2287 asmlinkage long sys_symlinkat(const char __user *oldname,
2288 			      int newdfd, const char __user *newname)
2289 {
2290 	int error = 0;
2291 	char * from;
2292 	char * to;
2293 	struct dentry *dentry;
2294 	struct nameidata nd;
2295 
2296 	from = getname(oldname);
2297 	if(IS_ERR(from))
2298 		return PTR_ERR(from);
2299 	to = getname(newname);
2300 	error = PTR_ERR(to);
2301 	if (IS_ERR(to))
2302 		goto out_putname;
2303 
2304 	error = do_path_lookup(newdfd, to, LOOKUP_PARENT, &nd);
2305 	if (error)
2306 		goto out;
2307 	dentry = lookup_create(&nd, 0);
2308 	error = PTR_ERR(dentry);
2309 	if (IS_ERR(dentry))
2310 		goto out_unlock;
2311 
2312 	error = vfs_symlink(nd.dentry->d_inode, dentry, from, S_IALLUGO);
2313 	dput(dentry);
2314 out_unlock:
2315 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
2316 	path_release(&nd);
2317 out:
2318 	putname(to);
2319 out_putname:
2320 	putname(from);
2321 	return error;
2322 }
2323 
2324 asmlinkage long sys_symlink(const char __user *oldname, const char __user *newname)
2325 {
2326 	return sys_symlinkat(oldname, AT_FDCWD, newname);
2327 }
2328 
2329 int vfs_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2330 {
2331 	struct inode *inode = old_dentry->d_inode;
2332 	int error;
2333 
2334 	if (!inode)
2335 		return -ENOENT;
2336 
2337 	error = may_create(dir, new_dentry, NULL);
2338 	if (error)
2339 		return error;
2340 
2341 	if (dir->i_sb != inode->i_sb)
2342 		return -EXDEV;
2343 
2344 	/*
2345 	 * A link to an append-only or immutable file cannot be created.
2346 	 */
2347 	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
2348 		return -EPERM;
2349 	if (!dir->i_op || !dir->i_op->link)
2350 		return -EPERM;
2351 	if (S_ISDIR(old_dentry->d_inode->i_mode))
2352 		return -EPERM;
2353 
2354 	error = security_inode_link(old_dentry, dir, new_dentry);
2355 	if (error)
2356 		return error;
2357 
2358 	mutex_lock(&old_dentry->d_inode->i_mutex);
2359 	DQUOT_INIT(dir);
2360 	error = dir->i_op->link(old_dentry, dir, new_dentry);
2361 	mutex_unlock(&old_dentry->d_inode->i_mutex);
2362 	if (!error)
2363 		fsnotify_create(dir, new_dentry);
2364 	return error;
2365 }
2366 
2367 /*
2368  * Hardlinks are often used in delicate situations.  We avoid
2369  * security-related surprises by not following symlinks on the
2370  * newname.  --KAB
2371  *
2372  * We don't follow them on the oldname either to be compatible
2373  * with linux 2.0, and to avoid hard-linking to directories
2374  * and other special files.  --ADM
2375  */
2376 asmlinkage long sys_linkat(int olddfd, const char __user *oldname,
2377 			   int newdfd, const char __user *newname,
2378 			   int flags)
2379 {
2380 	struct dentry *new_dentry;
2381 	struct nameidata nd, old_nd;
2382 	int error;
2383 	char * to;
2384 
2385 	if ((flags & ~AT_SYMLINK_FOLLOW) != 0)
2386 		return -EINVAL;
2387 
2388 	to = getname(newname);
2389 	if (IS_ERR(to))
2390 		return PTR_ERR(to);
2391 
2392 	error = __user_walk_fd(olddfd, oldname,
2393 			       flags & AT_SYMLINK_FOLLOW ? LOOKUP_FOLLOW : 0,
2394 			       &old_nd);
2395 	if (error)
2396 		goto exit;
2397 	error = do_path_lookup(newdfd, to, LOOKUP_PARENT, &nd);
2398 	if (error)
2399 		goto out;
2400 	error = -EXDEV;
2401 	if (old_nd.mnt != nd.mnt)
2402 		goto out_release;
2403 	new_dentry = lookup_create(&nd, 0);
2404 	error = PTR_ERR(new_dentry);
2405 	if (IS_ERR(new_dentry))
2406 		goto out_unlock;
2407 	error = vfs_link(old_nd.dentry, nd.dentry->d_inode, new_dentry);
2408 	dput(new_dentry);
2409 out_unlock:
2410 	mutex_unlock(&nd.dentry->d_inode->i_mutex);
2411 out_release:
2412 	path_release(&nd);
2413 out:
2414 	path_release(&old_nd);
2415 exit:
2416 	putname(to);
2417 
2418 	return error;
2419 }
2420 
2421 asmlinkage long sys_link(const char __user *oldname, const char __user *newname)
2422 {
2423 	return sys_linkat(AT_FDCWD, oldname, AT_FDCWD, newname, 0);
2424 }
2425 
2426 /*
2427  * The worst of all namespace operations - renaming directory. "Perverted"
2428  * doesn't even start to describe it. Somebody in UCB had a heck of a trip...
2429  * Problems:
2430  *	a) we can get into loop creation. Check is done in is_subdir().
2431  *	b) race potential - two innocent renames can create a loop together.
2432  *	   That's where 4.4 screws up. Current fix: serialization on
2433  *	   sb->s_vfs_rename_mutex. We might be more accurate, but that's another
2434  *	   story.
2435  *	c) we have to lock _three_ objects - parents and victim (if it exists).
2436  *	   And that - after we got ->i_mutex on parents (until then we don't know
2437  *	   whether the target exists).  Solution: try to be smart with locking
2438  *	   order for inodes.  We rely on the fact that tree topology may change
2439  *	   only under ->s_vfs_rename_mutex _and_ that parent of the object we
2440  *	   move will be locked.  Thus we can rank directories by the tree
2441  *	   (ancestors first) and rank all non-directories after them.
2442  *	   That works since everybody except rename does "lock parent, lookup,
2443  *	   lock child" and rename is under ->s_vfs_rename_mutex.
2444  *	   HOWEVER, it relies on the assumption that any object with ->lookup()
2445  *	   has no more than 1 dentry.  If "hybrid" objects will ever appear,
2446  *	   we'd better make sure that there's no link(2) for them.
2447  *	d) some filesystems don't support opened-but-unlinked directories,
2448  *	   either because of layout or because they are not ready to deal with
2449  *	   all cases correctly. The latter will be fixed (taking this sort of
2450  *	   stuff into VFS), but the former is not going away. Solution: the same
2451  *	   trick as in rmdir().
2452  *	e) conversion from fhandle to dentry may come in the wrong moment - when
2453  *	   we are removing the target. Solution: we will have to grab ->i_mutex
2454  *	   in the fhandle_to_dentry code. [FIXME - current nfsfh.c relies on
2455  *	   ->i_mutex on parents, which works but leads to some truely excessive
2456  *	   locking].
2457  */
2458 static int vfs_rename_dir(struct inode *old_dir, struct dentry *old_dentry,
2459 			  struct inode *new_dir, struct dentry *new_dentry)
2460 {
2461 	int error = 0;
2462 	struct inode *target;
2463 
2464 	/*
2465 	 * If we are going to change the parent - check write permissions,
2466 	 * we'll need to flip '..'.
2467 	 */
2468 	if (new_dir != old_dir) {
2469 		error = permission(old_dentry->d_inode, MAY_WRITE, NULL);
2470 		if (error)
2471 			return error;
2472 	}
2473 
2474 	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
2475 	if (error)
2476 		return error;
2477 
2478 	target = new_dentry->d_inode;
2479 	if (target) {
2480 		mutex_lock(&target->i_mutex);
2481 		dentry_unhash(new_dentry);
2482 	}
2483 	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
2484 		error = -EBUSY;
2485 	else
2486 		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
2487 	if (target) {
2488 		if (!error)
2489 			target->i_flags |= S_DEAD;
2490 		mutex_unlock(&target->i_mutex);
2491 		if (d_unhashed(new_dentry))
2492 			d_rehash(new_dentry);
2493 		dput(new_dentry);
2494 	}
2495 	if (!error)
2496 		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
2497 			d_move(old_dentry,new_dentry);
2498 	return error;
2499 }
2500 
2501 static int vfs_rename_other(struct inode *old_dir, struct dentry *old_dentry,
2502 			    struct inode *new_dir, struct dentry *new_dentry)
2503 {
2504 	struct inode *target;
2505 	int error;
2506 
2507 	error = security_inode_rename(old_dir, old_dentry, new_dir, new_dentry);
2508 	if (error)
2509 		return error;
2510 
2511 	dget(new_dentry);
2512 	target = new_dentry->d_inode;
2513 	if (target)
2514 		mutex_lock(&target->i_mutex);
2515 	if (d_mountpoint(old_dentry)||d_mountpoint(new_dentry))
2516 		error = -EBUSY;
2517 	else
2518 		error = old_dir->i_op->rename(old_dir, old_dentry, new_dir, new_dentry);
2519 	if (!error) {
2520 		if (!(old_dir->i_sb->s_type->fs_flags & FS_RENAME_DOES_D_MOVE))
2521 			d_move(old_dentry, new_dentry);
2522 	}
2523 	if (target)
2524 		mutex_unlock(&target->i_mutex);
2525 	dput(new_dentry);
2526 	return error;
2527 }
2528 
2529 int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
2530 	       struct inode *new_dir, struct dentry *new_dentry)
2531 {
2532 	int error;
2533 	int is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
2534 	const char *old_name;
2535 
2536 	if (old_dentry->d_inode == new_dentry->d_inode)
2537  		return 0;
2538 
2539 	error = may_delete(old_dir, old_dentry, is_dir);
2540 	if (error)
2541 		return error;
2542 
2543 	if (!new_dentry->d_inode)
2544 		error = may_create(new_dir, new_dentry, NULL);
2545 	else
2546 		error = may_delete(new_dir, new_dentry, is_dir);
2547 	if (error)
2548 		return error;
2549 
2550 	if (!old_dir->i_op || !old_dir->i_op->rename)
2551 		return -EPERM;
2552 
2553 	DQUOT_INIT(old_dir);
2554 	DQUOT_INIT(new_dir);
2555 
2556 	old_name = fsnotify_oldname_init(old_dentry->d_name.name);
2557 
2558 	if (is_dir)
2559 		error = vfs_rename_dir(old_dir,old_dentry,new_dir,new_dentry);
2560 	else
2561 		error = vfs_rename_other(old_dir,old_dentry,new_dir,new_dentry);
2562 	if (!error) {
2563 		const char *new_name = old_dentry->d_name.name;
2564 		fsnotify_move(old_dir, new_dir, old_name, new_name, is_dir,
2565 			      new_dentry->d_inode, old_dentry);
2566 	}
2567 	fsnotify_oldname_free(old_name);
2568 
2569 	return error;
2570 }
2571 
2572 static int do_rename(int olddfd, const char *oldname,
2573 			int newdfd, const char *newname)
2574 {
2575 	int error = 0;
2576 	struct dentry * old_dir, * new_dir;
2577 	struct dentry * old_dentry, *new_dentry;
2578 	struct dentry * trap;
2579 	struct nameidata oldnd, newnd;
2580 
2581 	error = do_path_lookup(olddfd, oldname, LOOKUP_PARENT, &oldnd);
2582 	if (error)
2583 		goto exit;
2584 
2585 	error = do_path_lookup(newdfd, newname, LOOKUP_PARENT, &newnd);
2586 	if (error)
2587 		goto exit1;
2588 
2589 	error = -EXDEV;
2590 	if (oldnd.mnt != newnd.mnt)
2591 		goto exit2;
2592 
2593 	old_dir = oldnd.dentry;
2594 	error = -EBUSY;
2595 	if (oldnd.last_type != LAST_NORM)
2596 		goto exit2;
2597 
2598 	new_dir = newnd.dentry;
2599 	if (newnd.last_type != LAST_NORM)
2600 		goto exit2;
2601 
2602 	trap = lock_rename(new_dir, old_dir);
2603 
2604 	old_dentry = lookup_hash(&oldnd);
2605 	error = PTR_ERR(old_dentry);
2606 	if (IS_ERR(old_dentry))
2607 		goto exit3;
2608 	/* source must exist */
2609 	error = -ENOENT;
2610 	if (!old_dentry->d_inode)
2611 		goto exit4;
2612 	/* unless the source is a directory trailing slashes give -ENOTDIR */
2613 	if (!S_ISDIR(old_dentry->d_inode->i_mode)) {
2614 		error = -ENOTDIR;
2615 		if (oldnd.last.name[oldnd.last.len])
2616 			goto exit4;
2617 		if (newnd.last.name[newnd.last.len])
2618 			goto exit4;
2619 	}
2620 	/* source should not be ancestor of target */
2621 	error = -EINVAL;
2622 	if (old_dentry == trap)
2623 		goto exit4;
2624 	new_dentry = lookup_hash(&newnd);
2625 	error = PTR_ERR(new_dentry);
2626 	if (IS_ERR(new_dentry))
2627 		goto exit4;
2628 	/* target should not be an ancestor of source */
2629 	error = -ENOTEMPTY;
2630 	if (new_dentry == trap)
2631 		goto exit5;
2632 
2633 	error = vfs_rename(old_dir->d_inode, old_dentry,
2634 				   new_dir->d_inode, new_dentry);
2635 exit5:
2636 	dput(new_dentry);
2637 exit4:
2638 	dput(old_dentry);
2639 exit3:
2640 	unlock_rename(new_dir, old_dir);
2641 exit2:
2642 	path_release(&newnd);
2643 exit1:
2644 	path_release(&oldnd);
2645 exit:
2646 	return error;
2647 }
2648 
2649 asmlinkage long sys_renameat(int olddfd, const char __user *oldname,
2650 			     int newdfd, const char __user *newname)
2651 {
2652 	int error;
2653 	char * from;
2654 	char * to;
2655 
2656 	from = getname(oldname);
2657 	if(IS_ERR(from))
2658 		return PTR_ERR(from);
2659 	to = getname(newname);
2660 	error = PTR_ERR(to);
2661 	if (!IS_ERR(to)) {
2662 		error = do_rename(olddfd, from, newdfd, to);
2663 		putname(to);
2664 	}
2665 	putname(from);
2666 	return error;
2667 }
2668 
2669 asmlinkage long sys_rename(const char __user *oldname, const char __user *newname)
2670 {
2671 	return sys_renameat(AT_FDCWD, oldname, AT_FDCWD, newname);
2672 }
2673 
2674 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
2675 {
2676 	int len;
2677 
2678 	len = PTR_ERR(link);
2679 	if (IS_ERR(link))
2680 		goto out;
2681 
2682 	len = strlen(link);
2683 	if (len > (unsigned) buflen)
2684 		len = buflen;
2685 	if (copy_to_user(buffer, link, len))
2686 		len = -EFAULT;
2687 out:
2688 	return len;
2689 }
2690 
2691 /*
2692  * A helper for ->readlink().  This should be used *ONLY* for symlinks that
2693  * have ->follow_link() touching nd only in nd_set_link().  Using (or not
2694  * using) it for any given inode is up to filesystem.
2695  */
2696 int generic_readlink(struct dentry *dentry, char __user *buffer, int buflen)
2697 {
2698 	struct nameidata nd;
2699 	void *cookie;
2700 
2701 	nd.depth = 0;
2702 	cookie = dentry->d_inode->i_op->follow_link(dentry, &nd);
2703 	if (!IS_ERR(cookie)) {
2704 		int res = vfs_readlink(dentry, buffer, buflen, nd_get_link(&nd));
2705 		if (dentry->d_inode->i_op->put_link)
2706 			dentry->d_inode->i_op->put_link(dentry, &nd, cookie);
2707 		cookie = ERR_PTR(res);
2708 	}
2709 	return PTR_ERR(cookie);
2710 }
2711 
2712 int vfs_follow_link(struct nameidata *nd, const char *link)
2713 {
2714 	return __vfs_follow_link(nd, link);
2715 }
2716 
2717 /* get the link contents into pagecache */
2718 static char *page_getlink(struct dentry * dentry, struct page **ppage)
2719 {
2720 	struct page * page;
2721 	struct address_space *mapping = dentry->d_inode->i_mapping;
2722 	page = read_mapping_page(mapping, 0, NULL);
2723 	if (IS_ERR(page))
2724 		return (char*)page;
2725 	*ppage = page;
2726 	return kmap(page);
2727 }
2728 
2729 int page_readlink(struct dentry *dentry, char __user *buffer, int buflen)
2730 {
2731 	struct page *page = NULL;
2732 	char *s = page_getlink(dentry, &page);
2733 	int res = vfs_readlink(dentry,buffer,buflen,s);
2734 	if (page) {
2735 		kunmap(page);
2736 		page_cache_release(page);
2737 	}
2738 	return res;
2739 }
2740 
2741 void *page_follow_link_light(struct dentry *dentry, struct nameidata *nd)
2742 {
2743 	struct page *page = NULL;
2744 	nd_set_link(nd, page_getlink(dentry, &page));
2745 	return page;
2746 }
2747 
2748 void page_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
2749 {
2750 	struct page *page = cookie;
2751 
2752 	if (page) {
2753 		kunmap(page);
2754 		page_cache_release(page);
2755 	}
2756 }
2757 
2758 int __page_symlink(struct inode *inode, const char *symname, int len,
2759 		gfp_t gfp_mask)
2760 {
2761 	struct address_space *mapping = inode->i_mapping;
2762 	struct page *page;
2763 	void *fsdata;
2764 	int err;
2765 	char *kaddr;
2766 
2767 retry:
2768 	err = pagecache_write_begin(NULL, mapping, 0, len-1,
2769 				AOP_FLAG_UNINTERRUPTIBLE, &page, &fsdata);
2770 	if (err)
2771 		goto fail;
2772 
2773 	kaddr = kmap_atomic(page, KM_USER0);
2774 	memcpy(kaddr, symname, len-1);
2775 	kunmap_atomic(kaddr, KM_USER0);
2776 
2777 	err = pagecache_write_end(NULL, mapping, 0, len-1, len-1,
2778 							page, fsdata);
2779 	if (err < 0)
2780 		goto fail;
2781 	if (err < len-1)
2782 		goto retry;
2783 
2784 	mark_inode_dirty(inode);
2785 	return 0;
2786 fail:
2787 	return err;
2788 }
2789 
2790 int page_symlink(struct inode *inode, const char *symname, int len)
2791 {
2792 	return __page_symlink(inode, symname, len,
2793 			mapping_gfp_mask(inode->i_mapping));
2794 }
2795 
2796 const struct inode_operations page_symlink_inode_operations = {
2797 	.readlink	= generic_readlink,
2798 	.follow_link	= page_follow_link_light,
2799 	.put_link	= page_put_link,
2800 };
2801 
2802 EXPORT_SYMBOL(__user_walk);
2803 EXPORT_SYMBOL(__user_walk_fd);
2804 EXPORT_SYMBOL(follow_down);
2805 EXPORT_SYMBOL(follow_up);
2806 EXPORT_SYMBOL(get_write_access); /* binfmt_aout */
2807 EXPORT_SYMBOL(getname);
2808 EXPORT_SYMBOL(lock_rename);
2809 EXPORT_SYMBOL(lookup_one_len);
2810 EXPORT_SYMBOL(page_follow_link_light);
2811 EXPORT_SYMBOL(page_put_link);
2812 EXPORT_SYMBOL(page_readlink);
2813 EXPORT_SYMBOL(__page_symlink);
2814 EXPORT_SYMBOL(page_symlink);
2815 EXPORT_SYMBOL(page_symlink_inode_operations);
2816 EXPORT_SYMBOL(path_lookup);
2817 EXPORT_SYMBOL(vfs_path_lookup);
2818 EXPORT_SYMBOL(path_release);
2819 EXPORT_SYMBOL(permission);
2820 EXPORT_SYMBOL(vfs_permission);
2821 EXPORT_SYMBOL(file_permission);
2822 EXPORT_SYMBOL(unlock_rename);
2823 EXPORT_SYMBOL(vfs_create);
2824 EXPORT_SYMBOL(vfs_follow_link);
2825 EXPORT_SYMBOL(vfs_link);
2826 EXPORT_SYMBOL(vfs_mkdir);
2827 EXPORT_SYMBOL(vfs_mknod);
2828 EXPORT_SYMBOL(generic_permission);
2829 EXPORT_SYMBOL(vfs_readlink);
2830 EXPORT_SYMBOL(vfs_rename);
2831 EXPORT_SYMBOL(vfs_rmdir);
2832 EXPORT_SYMBOL(vfs_symlink);
2833 EXPORT_SYMBOL(vfs_unlink);
2834 EXPORT_SYMBOL(dentry_unhash);
2835 EXPORT_SYMBOL(generic_readlink);
2836