cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

dir.c (23535B)


      1/*
      2 * JFFS2 -- Journalling Flash File System, Version 2.
      3 *
      4 * Copyright © 2001-2007 Red Hat, Inc.
      5 * Copyright © 2004-2010 David Woodhouse <dwmw2@infradead.org>
      6 *
      7 * Created by David Woodhouse <dwmw2@infradead.org>
      8 *
      9 * For licensing information, see the file 'LICENCE' in this directory.
     10 *
     11 */
     12
     13#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
     14
     15#include <linux/kernel.h>
     16#include <linux/slab.h>
     17#include <linux/fs.h>
     18#include <linux/crc32.h>
     19#include <linux/jffs2.h>
     20#include "jffs2_fs_i.h"
     21#include "jffs2_fs_sb.h"
     22#include <linux/time.h>
     23#include "nodelist.h"
     24
     25static int jffs2_readdir (struct file *, struct dir_context *);
     26
     27static int jffs2_create (struct user_namespace *, struct inode *,
     28		         struct dentry *, umode_t, bool);
     29static struct dentry *jffs2_lookup (struct inode *,struct dentry *,
     30				    unsigned int);
     31static int jffs2_link (struct dentry *,struct inode *,struct dentry *);
     32static int jffs2_unlink (struct inode *,struct dentry *);
     33static int jffs2_symlink (struct user_namespace *, struct inode *,
     34			  struct dentry *, const char *);
     35static int jffs2_mkdir (struct user_namespace *, struct inode *,struct dentry *,
     36			umode_t);
     37static int jffs2_rmdir (struct inode *,struct dentry *);
     38static int jffs2_mknod (struct user_namespace *, struct inode *,struct dentry *,
     39			umode_t,dev_t);
     40static int jffs2_rename (struct user_namespace *, struct inode *,
     41			 struct dentry *, struct inode *, struct dentry *,
     42			 unsigned int);
     43
     44const struct file_operations jffs2_dir_operations =
     45{
     46	.read =		generic_read_dir,
     47	.iterate_shared=jffs2_readdir,
     48	.unlocked_ioctl=jffs2_ioctl,
     49	.fsync =	jffs2_fsync,
     50	.llseek =	generic_file_llseek,
     51};
     52
     53
     54const struct inode_operations jffs2_dir_inode_operations =
     55{
     56	.create =	jffs2_create,
     57	.lookup =	jffs2_lookup,
     58	.link =		jffs2_link,
     59	.unlink =	jffs2_unlink,
     60	.symlink =	jffs2_symlink,
     61	.mkdir =	jffs2_mkdir,
     62	.rmdir =	jffs2_rmdir,
     63	.mknod =	jffs2_mknod,
     64	.rename =	jffs2_rename,
     65	.get_acl =	jffs2_get_acl,
     66	.set_acl =	jffs2_set_acl,
     67	.setattr =	jffs2_setattr,
     68	.listxattr =	jffs2_listxattr,
     69};
     70
     71/***********************************************************************/
     72
     73
     74/* We keep the dirent list sorted in increasing order of name hash,
     75   and we use the same hash function as the dentries. Makes this
     76   nice and simple
     77*/
     78static struct dentry *jffs2_lookup(struct inode *dir_i, struct dentry *target,
     79				   unsigned int flags)
     80{
     81	struct jffs2_inode_info *dir_f;
     82	struct jffs2_full_dirent *fd = NULL, *fd_list;
     83	uint32_t ino = 0;
     84	struct inode *inode = NULL;
     85	unsigned int nhash;
     86
     87	jffs2_dbg(1, "jffs2_lookup()\n");
     88
     89	if (target->d_name.len > JFFS2_MAX_NAME_LEN)
     90		return ERR_PTR(-ENAMETOOLONG);
     91
     92	dir_f = JFFS2_INODE_INFO(dir_i);
     93
     94	/* The 'nhash' on the fd_list is not the same as the dentry hash */
     95	nhash = full_name_hash(NULL, target->d_name.name, target->d_name.len);
     96
     97	mutex_lock(&dir_f->sem);
     98
     99	/* NB: The 2.2 backport will need to explicitly check for '.' and '..' here */
    100	for (fd_list = dir_f->dents; fd_list && fd_list->nhash <= nhash; fd_list = fd_list->next) {
    101		if (fd_list->nhash == nhash &&
    102		    (!fd || fd_list->version > fd->version) &&
    103		    strlen(fd_list->name) == target->d_name.len &&
    104		    !strncmp(fd_list->name, target->d_name.name, target->d_name.len)) {
    105			fd = fd_list;
    106		}
    107	}
    108	if (fd)
    109		ino = fd->ino;
    110	mutex_unlock(&dir_f->sem);
    111	if (ino) {
    112		inode = jffs2_iget(dir_i->i_sb, ino);
    113		if (IS_ERR(inode))
    114			pr_warn("iget() failed for ino #%u\n", ino);
    115	}
    116
    117	return d_splice_alias(inode, target);
    118}
    119
    120/***********************************************************************/
    121
    122
    123static int jffs2_readdir(struct file *file, struct dir_context *ctx)
    124{
    125	struct inode *inode = file_inode(file);
    126	struct jffs2_inode_info *f = JFFS2_INODE_INFO(inode);
    127	struct jffs2_full_dirent *fd;
    128	unsigned long curofs = 1;
    129
    130	jffs2_dbg(1, "jffs2_readdir() for dir_i #%lu\n", inode->i_ino);
    131
    132	if (!dir_emit_dots(file, ctx))
    133		return 0;
    134
    135	mutex_lock(&f->sem);
    136	for (fd = f->dents; fd; fd = fd->next) {
    137		curofs++;
    138		/* First loop: curofs = 2; pos = 2 */
    139		if (curofs < ctx->pos) {
    140			jffs2_dbg(2, "Skipping dirent: \"%s\", ino #%u, type %d, because curofs %ld < offset %ld\n",
    141				  fd->name, fd->ino, fd->type, curofs, (unsigned long)ctx->pos);
    142			continue;
    143		}
    144		if (!fd->ino) {
    145			jffs2_dbg(2, "Skipping deletion dirent \"%s\"\n",
    146				  fd->name);
    147			ctx->pos++;
    148			continue;
    149		}
    150		jffs2_dbg(2, "Dirent %ld: \"%s\", ino #%u, type %d\n",
    151			  (unsigned long)ctx->pos, fd->name, fd->ino, fd->type);
    152		if (!dir_emit(ctx, fd->name, strlen(fd->name), fd->ino, fd->type))
    153			break;
    154		ctx->pos++;
    155	}
    156	mutex_unlock(&f->sem);
    157	return 0;
    158}
    159
    160/***********************************************************************/
    161
    162
    163static int jffs2_create(struct user_namespace *mnt_userns, struct inode *dir_i,
    164			struct dentry *dentry, umode_t mode, bool excl)
    165{
    166	struct jffs2_raw_inode *ri;
    167	struct jffs2_inode_info *f, *dir_f;
    168	struct jffs2_sb_info *c;
    169	struct inode *inode;
    170	int ret;
    171
    172	ri = jffs2_alloc_raw_inode();
    173	if (!ri)
    174		return -ENOMEM;
    175
    176	c = JFFS2_SB_INFO(dir_i->i_sb);
    177
    178	jffs2_dbg(1, "%s()\n", __func__);
    179
    180	inode = jffs2_new_inode(dir_i, mode, ri);
    181
    182	if (IS_ERR(inode)) {
    183		jffs2_dbg(1, "jffs2_new_inode() failed\n");
    184		jffs2_free_raw_inode(ri);
    185		return PTR_ERR(inode);
    186	}
    187
    188	inode->i_op = &jffs2_file_inode_operations;
    189	inode->i_fop = &jffs2_file_operations;
    190	inode->i_mapping->a_ops = &jffs2_file_address_operations;
    191	inode->i_mapping->nrpages = 0;
    192
    193	f = JFFS2_INODE_INFO(inode);
    194	dir_f = JFFS2_INODE_INFO(dir_i);
    195
    196	/* jffs2_do_create() will want to lock it, _after_ reserving
    197	   space and taking c-alloc_sem. If we keep it locked here,
    198	   lockdep gets unhappy (although it's a false positive;
    199	   nothing else will be looking at this inode yet so there's
    200	   no chance of AB-BA deadlock involving its f->sem). */
    201	mutex_unlock(&f->sem);
    202
    203	ret = jffs2_do_create(c, dir_f, f, ri, &dentry->d_name);
    204	if (ret)
    205		goto fail;
    206
    207	dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(ri->ctime));
    208
    209	jffs2_free_raw_inode(ri);
    210
    211	jffs2_dbg(1, "%s(): Created ino #%lu with mode %o, nlink %d(%d). nrpages %ld\n",
    212		  __func__, inode->i_ino, inode->i_mode, inode->i_nlink,
    213		  f->inocache->pino_nlink, inode->i_mapping->nrpages);
    214
    215	d_instantiate_new(dentry, inode);
    216	return 0;
    217
    218 fail:
    219	iget_failed(inode);
    220	jffs2_free_raw_inode(ri);
    221	return ret;
    222}
    223
    224/***********************************************************************/
    225
    226
    227static int jffs2_unlink(struct inode *dir_i, struct dentry *dentry)
    228{
    229	struct jffs2_sb_info *c = JFFS2_SB_INFO(dir_i->i_sb);
    230	struct jffs2_inode_info *dir_f = JFFS2_INODE_INFO(dir_i);
    231	struct jffs2_inode_info *dead_f = JFFS2_INODE_INFO(d_inode(dentry));
    232	int ret;
    233	uint32_t now = JFFS2_NOW();
    234
    235	ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
    236			      dentry->d_name.len, dead_f, now);
    237	if (dead_f->inocache)
    238		set_nlink(d_inode(dentry), dead_f->inocache->pino_nlink);
    239	if (!ret)
    240		dir_i->i_mtime = dir_i->i_ctime = ITIME(now);
    241	return ret;
    242}
    243/***********************************************************************/
    244
    245
    246static int jffs2_link (struct dentry *old_dentry, struct inode *dir_i, struct dentry *dentry)
    247{
    248	struct jffs2_sb_info *c = JFFS2_SB_INFO(old_dentry->d_sb);
    249	struct jffs2_inode_info *f = JFFS2_INODE_INFO(d_inode(old_dentry));
    250	struct jffs2_inode_info *dir_f = JFFS2_INODE_INFO(dir_i);
    251	int ret;
    252	uint8_t type;
    253	uint32_t now;
    254
    255	/* Don't let people make hard links to bad inodes. */
    256	if (!f->inocache)
    257		return -EIO;
    258
    259	if (d_is_dir(old_dentry))
    260		return -EPERM;
    261
    262	/* XXX: This is ugly */
    263	type = (d_inode(old_dentry)->i_mode & S_IFMT) >> 12;
    264	if (!type) type = DT_REG;
    265
    266	now = JFFS2_NOW();
    267	ret = jffs2_do_link(c, dir_f, f->inocache->ino, type, dentry->d_name.name, dentry->d_name.len, now);
    268
    269	if (!ret) {
    270		mutex_lock(&f->sem);
    271		set_nlink(d_inode(old_dentry), ++f->inocache->pino_nlink);
    272		mutex_unlock(&f->sem);
    273		d_instantiate(dentry, d_inode(old_dentry));
    274		dir_i->i_mtime = dir_i->i_ctime = ITIME(now);
    275		ihold(d_inode(old_dentry));
    276	}
    277	return ret;
    278}
    279
    280/***********************************************************************/
    281
    282static int jffs2_symlink (struct user_namespace *mnt_userns, struct inode *dir_i,
    283			  struct dentry *dentry, const char *target)
    284{
    285	struct jffs2_inode_info *f, *dir_f;
    286	struct jffs2_sb_info *c;
    287	struct inode *inode;
    288	struct jffs2_raw_inode *ri;
    289	struct jffs2_raw_dirent *rd;
    290	struct jffs2_full_dnode *fn;
    291	struct jffs2_full_dirent *fd;
    292	int namelen;
    293	uint32_t alloclen;
    294	int ret, targetlen = strlen(target);
    295
    296	/* FIXME: If you care. We'd need to use frags for the target
    297	   if it grows much more than this */
    298	if (targetlen > 254)
    299		return -ENAMETOOLONG;
    300
    301	ri = jffs2_alloc_raw_inode();
    302
    303	if (!ri)
    304		return -ENOMEM;
    305
    306	c = JFFS2_SB_INFO(dir_i->i_sb);
    307
    308	/* Try to reserve enough space for both node and dirent.
    309	 * Just the node will do for now, though
    310	 */
    311	namelen = dentry->d_name.len;
    312	ret = jffs2_reserve_space(c, sizeof(*ri) + targetlen, &alloclen,
    313				  ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
    314
    315	if (ret) {
    316		jffs2_free_raw_inode(ri);
    317		return ret;
    318	}
    319
    320	inode = jffs2_new_inode(dir_i, S_IFLNK | S_IRWXUGO, ri);
    321
    322	if (IS_ERR(inode)) {
    323		jffs2_free_raw_inode(ri);
    324		jffs2_complete_reservation(c);
    325		return PTR_ERR(inode);
    326	}
    327
    328	inode->i_op = &jffs2_symlink_inode_operations;
    329
    330	f = JFFS2_INODE_INFO(inode);
    331
    332	inode->i_size = targetlen;
    333	ri->isize = ri->dsize = ri->csize = cpu_to_je32(inode->i_size);
    334	ri->totlen = cpu_to_je32(sizeof(*ri) + inode->i_size);
    335	ri->hdr_crc = cpu_to_je32(crc32(0, ri, sizeof(struct jffs2_unknown_node)-4));
    336
    337	ri->compr = JFFS2_COMPR_NONE;
    338	ri->data_crc = cpu_to_je32(crc32(0, target, targetlen));
    339	ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
    340
    341	fn = jffs2_write_dnode(c, f, ri, target, targetlen, ALLOC_NORMAL);
    342
    343	jffs2_free_raw_inode(ri);
    344
    345	if (IS_ERR(fn)) {
    346		/* Eeek. Wave bye bye */
    347		mutex_unlock(&f->sem);
    348		jffs2_complete_reservation(c);
    349		ret = PTR_ERR(fn);
    350		goto fail;
    351	}
    352
    353	/* We use f->target field to store the target path. */
    354	f->target = kmemdup(target, targetlen + 1, GFP_KERNEL);
    355	if (!f->target) {
    356		pr_warn("Can't allocate %d bytes of memory\n", targetlen + 1);
    357		mutex_unlock(&f->sem);
    358		jffs2_complete_reservation(c);
    359		ret = -ENOMEM;
    360		goto fail;
    361	}
    362	inode->i_link = f->target;
    363
    364	jffs2_dbg(1, "%s(): symlink's target '%s' cached\n",
    365		  __func__, (char *)f->target);
    366
    367	/* No data here. Only a metadata node, which will be
    368	   obsoleted by the first data write
    369	*/
    370	f->metadata = fn;
    371	mutex_unlock(&f->sem);
    372
    373	jffs2_complete_reservation(c);
    374
    375	ret = jffs2_init_security(inode, dir_i, &dentry->d_name);
    376	if (ret)
    377		goto fail;
    378
    379	ret = jffs2_init_acl_post(inode);
    380	if (ret)
    381		goto fail;
    382
    383	ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
    384				  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
    385	if (ret)
    386		goto fail;
    387
    388	rd = jffs2_alloc_raw_dirent();
    389	if (!rd) {
    390		/* Argh. Now we treat it like a normal delete */
    391		jffs2_complete_reservation(c);
    392		ret = -ENOMEM;
    393		goto fail;
    394	}
    395
    396	dir_f = JFFS2_INODE_INFO(dir_i);
    397	mutex_lock(&dir_f->sem);
    398
    399	rd->magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
    400	rd->nodetype = cpu_to_je16(JFFS2_NODETYPE_DIRENT);
    401	rd->totlen = cpu_to_je32(sizeof(*rd) + namelen);
    402	rd->hdr_crc = cpu_to_je32(crc32(0, rd, sizeof(struct jffs2_unknown_node)-4));
    403
    404	rd->pino = cpu_to_je32(dir_i->i_ino);
    405	rd->version = cpu_to_je32(++dir_f->highest_version);
    406	rd->ino = cpu_to_je32(inode->i_ino);
    407	rd->mctime = cpu_to_je32(JFFS2_NOW());
    408	rd->nsize = namelen;
    409	rd->type = DT_LNK;
    410	rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
    411	rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
    412
    413	fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
    414
    415	if (IS_ERR(fd)) {
    416		/* dirent failed to write. Delete the inode normally
    417		   as if it were the final unlink() */
    418		jffs2_complete_reservation(c);
    419		jffs2_free_raw_dirent(rd);
    420		mutex_unlock(&dir_f->sem);
    421		ret = PTR_ERR(fd);
    422		goto fail;
    423	}
    424
    425	dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
    426
    427	jffs2_free_raw_dirent(rd);
    428
    429	/* Link the fd into the inode's list, obsoleting an old
    430	   one if necessary. */
    431	jffs2_add_fd_to_list(c, fd, &dir_f->dents);
    432
    433	mutex_unlock(&dir_f->sem);
    434	jffs2_complete_reservation(c);
    435
    436	d_instantiate_new(dentry, inode);
    437	return 0;
    438
    439 fail:
    440	iget_failed(inode);
    441	return ret;
    442}
    443
    444
    445static int jffs2_mkdir (struct user_namespace *mnt_userns, struct inode *dir_i,
    446		        struct dentry *dentry, umode_t mode)
    447{
    448	struct jffs2_inode_info *f, *dir_f;
    449	struct jffs2_sb_info *c;
    450	struct inode *inode;
    451	struct jffs2_raw_inode *ri;
    452	struct jffs2_raw_dirent *rd;
    453	struct jffs2_full_dnode *fn;
    454	struct jffs2_full_dirent *fd;
    455	int namelen;
    456	uint32_t alloclen;
    457	int ret;
    458
    459	mode |= S_IFDIR;
    460
    461	ri = jffs2_alloc_raw_inode();
    462	if (!ri)
    463		return -ENOMEM;
    464
    465	c = JFFS2_SB_INFO(dir_i->i_sb);
    466
    467	/* Try to reserve enough space for both node and dirent.
    468	 * Just the node will do for now, though
    469	 */
    470	namelen = dentry->d_name.len;
    471	ret = jffs2_reserve_space(c, sizeof(*ri), &alloclen, ALLOC_NORMAL,
    472				  JFFS2_SUMMARY_INODE_SIZE);
    473
    474	if (ret) {
    475		jffs2_free_raw_inode(ri);
    476		return ret;
    477	}
    478
    479	inode = jffs2_new_inode(dir_i, mode, ri);
    480
    481	if (IS_ERR(inode)) {
    482		jffs2_free_raw_inode(ri);
    483		jffs2_complete_reservation(c);
    484		return PTR_ERR(inode);
    485	}
    486
    487	inode->i_op = &jffs2_dir_inode_operations;
    488	inode->i_fop = &jffs2_dir_operations;
    489
    490	f = JFFS2_INODE_INFO(inode);
    491
    492	/* Directories get nlink 2 at start */
    493	set_nlink(inode, 2);
    494	/* but ic->pino_nlink is the parent ino# */
    495	f->inocache->pino_nlink = dir_i->i_ino;
    496
    497	ri->data_crc = cpu_to_je32(0);
    498	ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
    499
    500	fn = jffs2_write_dnode(c, f, ri, NULL, 0, ALLOC_NORMAL);
    501
    502	jffs2_free_raw_inode(ri);
    503
    504	if (IS_ERR(fn)) {
    505		/* Eeek. Wave bye bye */
    506		mutex_unlock(&f->sem);
    507		jffs2_complete_reservation(c);
    508		ret = PTR_ERR(fn);
    509		goto fail;
    510	}
    511	/* No data here. Only a metadata node, which will be
    512	   obsoleted by the first data write
    513	*/
    514	f->metadata = fn;
    515	mutex_unlock(&f->sem);
    516
    517	jffs2_complete_reservation(c);
    518
    519	ret = jffs2_init_security(inode, dir_i, &dentry->d_name);
    520	if (ret)
    521		goto fail;
    522
    523	ret = jffs2_init_acl_post(inode);
    524	if (ret)
    525		goto fail;
    526
    527	ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
    528				  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
    529	if (ret)
    530		goto fail;
    531
    532	rd = jffs2_alloc_raw_dirent();
    533	if (!rd) {
    534		/* Argh. Now we treat it like a normal delete */
    535		jffs2_complete_reservation(c);
    536		ret = -ENOMEM;
    537		goto fail;
    538	}
    539
    540	dir_f = JFFS2_INODE_INFO(dir_i);
    541	mutex_lock(&dir_f->sem);
    542
    543	rd->magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
    544	rd->nodetype = cpu_to_je16(JFFS2_NODETYPE_DIRENT);
    545	rd->totlen = cpu_to_je32(sizeof(*rd) + namelen);
    546	rd->hdr_crc = cpu_to_je32(crc32(0, rd, sizeof(struct jffs2_unknown_node)-4));
    547
    548	rd->pino = cpu_to_je32(dir_i->i_ino);
    549	rd->version = cpu_to_je32(++dir_f->highest_version);
    550	rd->ino = cpu_to_je32(inode->i_ino);
    551	rd->mctime = cpu_to_je32(JFFS2_NOW());
    552	rd->nsize = namelen;
    553	rd->type = DT_DIR;
    554	rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
    555	rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
    556
    557	fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
    558
    559	if (IS_ERR(fd)) {
    560		/* dirent failed to write. Delete the inode normally
    561		   as if it were the final unlink() */
    562		jffs2_complete_reservation(c);
    563		jffs2_free_raw_dirent(rd);
    564		mutex_unlock(&dir_f->sem);
    565		ret = PTR_ERR(fd);
    566		goto fail;
    567	}
    568
    569	dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
    570	inc_nlink(dir_i);
    571
    572	jffs2_free_raw_dirent(rd);
    573
    574	/* Link the fd into the inode's list, obsoleting an old
    575	   one if necessary. */
    576	jffs2_add_fd_to_list(c, fd, &dir_f->dents);
    577
    578	mutex_unlock(&dir_f->sem);
    579	jffs2_complete_reservation(c);
    580
    581	d_instantiate_new(dentry, inode);
    582	return 0;
    583
    584 fail:
    585	iget_failed(inode);
    586	return ret;
    587}
    588
    589static int jffs2_rmdir (struct inode *dir_i, struct dentry *dentry)
    590{
    591	struct jffs2_sb_info *c = JFFS2_SB_INFO(dir_i->i_sb);
    592	struct jffs2_inode_info *dir_f = JFFS2_INODE_INFO(dir_i);
    593	struct jffs2_inode_info *f = JFFS2_INODE_INFO(d_inode(dentry));
    594	struct jffs2_full_dirent *fd;
    595	int ret;
    596	uint32_t now = JFFS2_NOW();
    597
    598	mutex_lock(&f->sem);
    599	for (fd = f->dents ; fd; fd = fd->next) {
    600		if (fd->ino) {
    601			mutex_unlock(&f->sem);
    602			return -ENOTEMPTY;
    603		}
    604	}
    605	mutex_unlock(&f->sem);
    606
    607	ret = jffs2_do_unlink(c, dir_f, dentry->d_name.name,
    608			      dentry->d_name.len, f, now);
    609	if (!ret) {
    610		dir_i->i_mtime = dir_i->i_ctime = ITIME(now);
    611		clear_nlink(d_inode(dentry));
    612		drop_nlink(dir_i);
    613	}
    614	return ret;
    615}
    616
    617static int jffs2_mknod (struct user_namespace *mnt_userns, struct inode *dir_i,
    618		        struct dentry *dentry, umode_t mode, dev_t rdev)
    619{
    620	struct jffs2_inode_info *f, *dir_f;
    621	struct jffs2_sb_info *c;
    622	struct inode *inode;
    623	struct jffs2_raw_inode *ri;
    624	struct jffs2_raw_dirent *rd;
    625	struct jffs2_full_dnode *fn;
    626	struct jffs2_full_dirent *fd;
    627	int namelen;
    628	union jffs2_device_node dev;
    629	int devlen = 0;
    630	uint32_t alloclen;
    631	int ret;
    632
    633	ri = jffs2_alloc_raw_inode();
    634	if (!ri)
    635		return -ENOMEM;
    636
    637	c = JFFS2_SB_INFO(dir_i->i_sb);
    638
    639	if (S_ISBLK(mode) || S_ISCHR(mode))
    640		devlen = jffs2_encode_dev(&dev, rdev);
    641
    642	/* Try to reserve enough space for both node and dirent.
    643	 * Just the node will do for now, though
    644	 */
    645	namelen = dentry->d_name.len;
    646	ret = jffs2_reserve_space(c, sizeof(*ri) + devlen, &alloclen,
    647				  ALLOC_NORMAL, JFFS2_SUMMARY_INODE_SIZE);
    648
    649	if (ret) {
    650		jffs2_free_raw_inode(ri);
    651		return ret;
    652	}
    653
    654	inode = jffs2_new_inode(dir_i, mode, ri);
    655
    656	if (IS_ERR(inode)) {
    657		jffs2_free_raw_inode(ri);
    658		jffs2_complete_reservation(c);
    659		return PTR_ERR(inode);
    660	}
    661	inode->i_op = &jffs2_file_inode_operations;
    662	init_special_inode(inode, inode->i_mode, rdev);
    663
    664	f = JFFS2_INODE_INFO(inode);
    665
    666	ri->dsize = ri->csize = cpu_to_je32(devlen);
    667	ri->totlen = cpu_to_je32(sizeof(*ri) + devlen);
    668	ri->hdr_crc = cpu_to_je32(crc32(0, ri, sizeof(struct jffs2_unknown_node)-4));
    669
    670	ri->compr = JFFS2_COMPR_NONE;
    671	ri->data_crc = cpu_to_je32(crc32(0, &dev, devlen));
    672	ri->node_crc = cpu_to_je32(crc32(0, ri, sizeof(*ri)-8));
    673
    674	fn = jffs2_write_dnode(c, f, ri, (char *)&dev, devlen, ALLOC_NORMAL);
    675
    676	jffs2_free_raw_inode(ri);
    677
    678	if (IS_ERR(fn)) {
    679		/* Eeek. Wave bye bye */
    680		mutex_unlock(&f->sem);
    681		jffs2_complete_reservation(c);
    682		ret = PTR_ERR(fn);
    683		goto fail;
    684	}
    685	/* No data here. Only a metadata node, which will be
    686	   obsoleted by the first data write
    687	*/
    688	f->metadata = fn;
    689	mutex_unlock(&f->sem);
    690
    691	jffs2_complete_reservation(c);
    692
    693	ret = jffs2_init_security(inode, dir_i, &dentry->d_name);
    694	if (ret)
    695		goto fail;
    696
    697	ret = jffs2_init_acl_post(inode);
    698	if (ret)
    699		goto fail;
    700
    701	ret = jffs2_reserve_space(c, sizeof(*rd)+namelen, &alloclen,
    702				  ALLOC_NORMAL, JFFS2_SUMMARY_DIRENT_SIZE(namelen));
    703	if (ret)
    704		goto fail;
    705
    706	rd = jffs2_alloc_raw_dirent();
    707	if (!rd) {
    708		/* Argh. Now we treat it like a normal delete */
    709		jffs2_complete_reservation(c);
    710		ret = -ENOMEM;
    711		goto fail;
    712	}
    713
    714	dir_f = JFFS2_INODE_INFO(dir_i);
    715	mutex_lock(&dir_f->sem);
    716
    717	rd->magic = cpu_to_je16(JFFS2_MAGIC_BITMASK);
    718	rd->nodetype = cpu_to_je16(JFFS2_NODETYPE_DIRENT);
    719	rd->totlen = cpu_to_je32(sizeof(*rd) + namelen);
    720	rd->hdr_crc = cpu_to_je32(crc32(0, rd, sizeof(struct jffs2_unknown_node)-4));
    721
    722	rd->pino = cpu_to_je32(dir_i->i_ino);
    723	rd->version = cpu_to_je32(++dir_f->highest_version);
    724	rd->ino = cpu_to_je32(inode->i_ino);
    725	rd->mctime = cpu_to_je32(JFFS2_NOW());
    726	rd->nsize = namelen;
    727
    728	/* XXX: This is ugly. */
    729	rd->type = (mode & S_IFMT) >> 12;
    730
    731	rd->node_crc = cpu_to_je32(crc32(0, rd, sizeof(*rd)-8));
    732	rd->name_crc = cpu_to_je32(crc32(0, dentry->d_name.name, namelen));
    733
    734	fd = jffs2_write_dirent(c, dir_f, rd, dentry->d_name.name, namelen, ALLOC_NORMAL);
    735
    736	if (IS_ERR(fd)) {
    737		/* dirent failed to write. Delete the inode normally
    738		   as if it were the final unlink() */
    739		jffs2_complete_reservation(c);
    740		jffs2_free_raw_dirent(rd);
    741		mutex_unlock(&dir_f->sem);
    742		ret = PTR_ERR(fd);
    743		goto fail;
    744	}
    745
    746	dir_i->i_mtime = dir_i->i_ctime = ITIME(je32_to_cpu(rd->mctime));
    747
    748	jffs2_free_raw_dirent(rd);
    749
    750	/* Link the fd into the inode's list, obsoleting an old
    751	   one if necessary. */
    752	jffs2_add_fd_to_list(c, fd, &dir_f->dents);
    753
    754	mutex_unlock(&dir_f->sem);
    755	jffs2_complete_reservation(c);
    756
    757	d_instantiate_new(dentry, inode);
    758	return 0;
    759
    760 fail:
    761	iget_failed(inode);
    762	return ret;
    763}
    764
    765static int jffs2_rename (struct user_namespace *mnt_userns,
    766			 struct inode *old_dir_i, struct dentry *old_dentry,
    767			 struct inode *new_dir_i, struct dentry *new_dentry,
    768			 unsigned int flags)
    769{
    770	int ret;
    771	struct jffs2_sb_info *c = JFFS2_SB_INFO(old_dir_i->i_sb);
    772	struct jffs2_inode_info *victim_f = NULL;
    773	uint8_t type;
    774	uint32_t now;
    775
    776	if (flags & ~RENAME_NOREPLACE)
    777		return -EINVAL;
    778
    779	/* The VFS will check for us and prevent trying to rename a
    780	 * file over a directory and vice versa, but if it's a directory,
    781	 * the VFS can't check whether the victim is empty. The filesystem
    782	 * needs to do that for itself.
    783	 */
    784	if (d_really_is_positive(new_dentry)) {
    785		victim_f = JFFS2_INODE_INFO(d_inode(new_dentry));
    786		if (d_is_dir(new_dentry)) {
    787			struct jffs2_full_dirent *fd;
    788
    789			mutex_lock(&victim_f->sem);
    790			for (fd = victim_f->dents; fd; fd = fd->next) {
    791				if (fd->ino) {
    792					mutex_unlock(&victim_f->sem);
    793					return -ENOTEMPTY;
    794				}
    795			}
    796			mutex_unlock(&victim_f->sem);
    797		}
    798	}
    799
    800	/* XXX: We probably ought to alloc enough space for
    801	   both nodes at the same time. Writing the new link,
    802	   then getting -ENOSPC, is quite bad :)
    803	*/
    804
    805	/* Make a hard link */
    806
    807	/* XXX: This is ugly */
    808	type = (d_inode(old_dentry)->i_mode & S_IFMT) >> 12;
    809	if (!type) type = DT_REG;
    810
    811	now = JFFS2_NOW();
    812	ret = jffs2_do_link(c, JFFS2_INODE_INFO(new_dir_i),
    813			    d_inode(old_dentry)->i_ino, type,
    814			    new_dentry->d_name.name, new_dentry->d_name.len, now);
    815
    816	if (ret)
    817		return ret;
    818
    819	if (victim_f) {
    820		/* There was a victim. Kill it off nicely */
    821		if (d_is_dir(new_dentry))
    822			clear_nlink(d_inode(new_dentry));
    823		else
    824			drop_nlink(d_inode(new_dentry));
    825		/* Don't oops if the victim was a dirent pointing to an
    826		   inode which didn't exist. */
    827		if (victim_f->inocache) {
    828			mutex_lock(&victim_f->sem);
    829			if (d_is_dir(new_dentry))
    830				victim_f->inocache->pino_nlink = 0;
    831			else
    832				victim_f->inocache->pino_nlink--;
    833			mutex_unlock(&victim_f->sem);
    834		}
    835	}
    836
    837	/* If it was a directory we moved, and there was no victim,
    838	   increase i_nlink on its new parent */
    839	if (d_is_dir(old_dentry) && !victim_f)
    840		inc_nlink(new_dir_i);
    841
    842	/* Unlink the original */
    843	ret = jffs2_do_unlink(c, JFFS2_INODE_INFO(old_dir_i),
    844			      old_dentry->d_name.name, old_dentry->d_name.len, NULL, now);
    845
    846	/* We don't touch inode->i_nlink */
    847
    848	if (ret) {
    849		/* Oh shit. We really ought to make a single node which can do both atomically */
    850		struct jffs2_inode_info *f = JFFS2_INODE_INFO(d_inode(old_dentry));
    851		mutex_lock(&f->sem);
    852		inc_nlink(d_inode(old_dentry));
    853		if (f->inocache && !d_is_dir(old_dentry))
    854			f->inocache->pino_nlink++;
    855		mutex_unlock(&f->sem);
    856
    857		pr_notice("%s(): Link succeeded, unlink failed (err %d). You now have a hard link\n",
    858			  __func__, ret);
    859		/*
    860		 * We can't keep the target in dcache after that.
    861		 * For one thing, we can't afford dentry aliases for directories.
    862		 * For another, if there was a victim, we _can't_ set new inode
    863		 * for that sucker and we have to trigger mount eviction - the
    864		 * caller won't do it on its own since we are returning an error.
    865		 */
    866		d_invalidate(new_dentry);
    867		new_dir_i->i_mtime = new_dir_i->i_ctime = ITIME(now);
    868		return ret;
    869	}
    870
    871	if (d_is_dir(old_dentry))
    872		drop_nlink(old_dir_i);
    873
    874	new_dir_i->i_mtime = new_dir_i->i_ctime = old_dir_i->i_mtime = old_dir_i->i_ctime = ITIME(now);
    875
    876	return 0;
    877}
    878