dentry = dget(result);	}	while(dentry->d_flags & DCACHE_NFSD_DISCONNECTED) {		/* LOOP INVARIANT */		/* haven't found a place in the tree yet, but we do have a free path		 * from dentry down to result, and dentry is a directory.		 * Have a hold on dentry and result */		struct dentry *pdentry;		struct inode *parent;		pdentry = nfsd_findparent(dentry);		err = PTR_ERR(pdentry);		if (IS_ERR(pdentry))			goto err_dentry;		parent = pdentry->d_inode;		err = -EACCES;		if (!parent) {			dput(pdentry);			goto err_dentry;		}		tmp = splice(dentry, pdentry);		if (tmp != dentry) {			/* Something wrong.  We need to drop the whole dentry->result path			 * whatever it was			 */			struct dentry *d;			for (d=result ; d ; d=(d->d_parent == d)?NULL:d->d_parent)				d_drop(d);		}		if (IS_ERR(tmp)) {			err = PTR_ERR(tmp);			dput(pdentry);			goto err_dentry;		}		if (tmp != dentry) {			/* we lost a race,  try again			 */			dput(pdentry);			dput(tmp);			dput(dentry);			dput(result);	/* this will discard the whole free path, so we can up the semaphore */			up(&sb->s_nfsd_free_path_sem);			goto retry;		}		dput(dentry);		dentry = pdentry;	}	dput(dentry);	up(&sb->s_nfsd_free_path_sem);	return result;err_dentry:	dput(dentry);err_result:	dput(result);	up(&sb->s_nfsd_free_path_sem);err_out:	if (err == -ESTALE)		nfsdstats.fh_stale++;	return ERR_PTR(err);}/* * Perform sanity checks on the dentry in a client's file handle. * * Note that the file handle dentry may need to be freed even after * an error return. * * This is only called at the start of an nfsproc call, so fhp points to * a svc_fh which is all 0 except for the over-the-wire file handle. */u32fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, int type, int access){	struct knfsd_fh	*fh = &fhp->fh_handle;	struct svc_export *exp;	struct dentry	*dentry;	struct inode	*inode;	u32		error = 0;	dprintk("nfsd: fh_verify(%s)\n", SVCFH_fmt(fhp));	if (!fhp->fh_dentry) {		kdev_t xdev;		ino_t xino;		__u32 *datap=NULL;		int data_left = fh->fh_size/4;		int nfsdev;		error = nfserr_stale;		if (rqstp->rq_vers == 3)			error = nfserr_badhandle;		if (fh->fh_version == 1) {						datap = fh->fh_auth;			if (--data_left<0) goto out;			switch (fh->fh_auth_type) {			case 0: break;			default: goto out;			}			switch (fh->fh_fsid_type) {			case 0:				if ((data_left-=2)<0) goto out;				nfsdev = ntohl(*datap++);				xdev = MKDEV(nfsdev>>16, nfsdev&0xFFFF);				xino = *datap++;				break;			default:				goto out;			}		} else {			if (fh->fh_size != NFS_FHSIZE)				goto out;			/* assume old filehandle format */			xdev = u32_to_kdev_t(fh->ofh_xdev);			xino = u32_to_ino_t(fh->ofh_xino);		}		/*		 * Look up the export entry.		 */		error = nfserr_stale; 		exp = exp_get(rqstp->rq_client, xdev, xino);		if (!exp) {			/* export entry revoked */			nfsdstats.fh_stale++;			goto out;		}		/* Check if the request originated from a secure port. */		error = nfserr_perm;		if (!rqstp->rq_secure && EX_SECURE(exp)) {			printk(KERN_WARNING			       "nfsd: request from insecure port (%08x:%d)!\n",			       ntohl(rqstp->rq_addr.sin_addr.s_addr),			       ntohs(rqstp->rq_addr.sin_port));			goto out;		}		/* Set user creds if we haven't done so already. */		nfsd_setuser(rqstp, exp);		/*		 * Look up the dentry using the NFS file handle.		 */		error = nfserr_stale;		if (rqstp->rq_vers == 3)			error = nfserr_badhandle;		if (fh->fh_version == 1) {			/* if fileid_type != 0, and super_operations provide fh_to_dentry lookup,			 *  then should use that */			switch (fh->fh_fileid_type) {			case 0:				dentry = dget(exp->ex_dentry);				break;			default:				dentry = find_fh_dentry(exp->ex_dentry->d_inode->i_sb,							datap, data_left, fh->fh_fileid_type,							!(exp->ex_flags & NFSEXP_NOSUBTREECHECK));			}		} else {			__u32 tfh[3];			tfh[0] = fh->ofh_ino;			tfh[1] = fh->ofh_generation;			tfh[2] = fh->ofh_dirino;			dentry = find_fh_dentry(exp->ex_dentry->d_inode->i_sb,						tfh, 3, fh->ofh_dirino?2:1,						!(exp->ex_flags & NFSEXP_NOSUBTREECHECK));		}		if (IS_ERR(dentry)) {			if (PTR_ERR(dentry) != -EINVAL)				error = nfserrno(PTR_ERR(dentry));			goto out;		}#ifdef NFSD_PARANOIA		if (S_ISDIR(dentry->d_inode->i_mode) &&		    (dentry->d_flags & DCACHE_NFSD_DISCONNECTED)) {			printk("nfsd: find_fh_dentry returned a DISCONNECTED directory: %s/%s\n",			       dentry->d_parent->d_name.name, dentry->d_name.name);		}#endif		fhp->fh_dentry = dentry;		fhp->fh_export = exp;		nfsd_nr_verified++;	} else {		/* just rechecking permissions		 * (e.g. nfsproc_create calls fh_verify, then nfsd_create does as well)		 */		dprintk("nfsd: fh_verify - just checking\n");		dentry = fhp->fh_dentry;		exp = fhp->fh_export;	}	inode = dentry->d_inode;	/* Type check. The correct error return for type mismatches	 * does not seem to be generally agreed upon. SunOS seems to	 * use EISDIR if file isn't S_IFREG; a comment in the NFSv3	 * spec says this is incorrect (implementation notes for the	 * write call).	 */	/* When is type ever negative? */	if (type > 0 && (inode->i_mode & S_IFMT) != type) {		error = (type == S_IFDIR)? nfserr_notdir : nfserr_isdir;		goto out;	}	if (type < 0 && (inode->i_mode & S_IFMT) == -type) {		error = (type == -S_IFDIR)? nfserr_notdir : nfserr_isdir;		goto out;	}	/*	 * Security: Check that the export is valid for dentry <gam3@acm.org>	 */	error = 0;	if (!(exp->ex_flags & NFSEXP_NOSUBTREECHECK)) {		if (exp->ex_dentry != dentry) {			struct dentry *tdentry = dentry;			do {				tdentry = tdentry->d_parent;				if (exp->ex_dentry == tdentry)					break;				/* executable only by root and we can't be root */				if (current->fsuid				    && (exp->ex_flags & NFSEXP_ROOTSQUASH)				    && !(tdentry->d_inode->i_uid					 && (tdentry->d_inode->i_mode & S_IXUSR))				    && !(tdentry->d_inode->i_gid					 && (tdentry->d_inode->i_mode & S_IXGRP))				    && !(tdentry->d_inode->i_mode & S_IXOTH)					) {					error = nfserr_stale;					nfsdstats.fh_stale++;					dprintk("fh_verify: no root_squashed access.\n");				}			} while ((tdentry != tdentry->d_parent));			if (exp->ex_dentry != tdentry) {				error = nfserr_stale;				nfsdstats.fh_stale++;				printk("nfsd Security: %s/%s bad export.\n",				       dentry->d_parent->d_name.name,				       dentry->d_name.name);				goto out;			}		}	}	/* Finally, check access permissions. */	if (!error) {		error = nfsd_permission(exp, dentry, access);	}#ifdef NFSD_PARANOIA_EXTREME	if (error) {		printk("fh_verify: %s/%s permission failure, acc=%x, error=%d\n",		       dentry->d_parent->d_name.name, dentry->d_name.name, access, (error >> 24));	}#endifout:	return error;}/* * Compose a file handle for an NFS reply. * * Note that when first composed, the dentry may not yet have * an inode.  In this case a call to fh_update should be made * before the fh goes out on the wire ... */inline int _fh_update(struct dentry *dentry, struct svc_export *exp,		      __u32 *datap, int *maxsize){	struct super_block *sb = dentry->d_inode->i_sb;		if (dentry == exp->ex_dentry) {		*maxsize = 0;		return 0;	}	if (sb->s_op->dentry_to_fh) {		int need_parent = !S_ISDIR(dentry->d_inode->i_mode) &&			!(exp->ex_flags & NFSEXP_NOSUBTREECHECK);				int type = sb->s_op->dentry_to_fh(dentry, datap, maxsize, need_parent);		return type;	}	if (*maxsize < 2)		return 255;	*datap++ = ino_t_to_u32(dentry->d_inode->i_ino);	*datap++ = dentry->d_inode->i_generation;	if (*maxsize ==2 ||	    S_ISDIR(dentry->d_inode->i_mode) ||	    (exp->ex_flags & NFSEXP_NOSUBTREECHECK)) {		*maxsize = 2;		return 1;	}	*datap++ = ino_t_to_u32(dentry->d_parent->d_inode->i_ino);	*maxsize = 3;	return 2;}/* * for composing old style file handles */inline void _fh_update_old(struct dentry *dentry, struct svc_export *exp,			   struct knfsd_fh *fh){	fh->ofh_ino = ino_t_to_u32(dentry->d_inode->i_ino);	fh->ofh_generation = dentry->d_inode->i_generation;	if (S_ISDIR(dentry->d_inode->i_mode) ||	    (exp->ex_flags & NFSEXP_NOSUBTREECHECK))		fh->ofh_dirino = 0;}intfh_compose(struct svc_fh *fhp, struct svc_export *exp, struct dentry *dentry, struct svc_fh *ref_fh){	/* ref_fh is a reference file handle.	 * if it is non-null, then we should compose a filehandle which is	 * of the same version, where possible.	 * Currently, that means that if ref_fh->fh_handle.fh_version == 0xca	 * Then create a 32byte filehandle using nfs_fhbase_old	 * But only do this if dentry_to_fh is not available	 *	 */		struct inode * inode = dentry->d_inode;	struct dentry *parent = dentry->d_parent;	__u32 *datap;	dprintk("nfsd: fh_compose(exp %x/%ld %s/%s, ino=%ld)\n",		exp->ex_dev, (long) exp->ex_ino,		parent->d_name.name, dentry->d_name.name,		(inode ? inode->i_ino : 0));	if (fhp->fh_locked || fhp->fh_dentry) {		printk(KERN_ERR "fh_compose: fh %s/%s not initialized!\n",			parent->d_name.name, dentry->d_name.name);	}	if (fhp->fh_maxsize < NFS_FHSIZE)		printk(KERN_ERR "fh_compose: called with maxsize %d! %s/%s\n",		       fhp->fh_maxsize, parent->d_name.name, dentry->d_name.name);	fhp->fh_dentry = dentry; /* our internal copy */	fhp->fh_export = exp;	if (ref_fh &&	    ref_fh->fh_handle.fh_version == 0xca &&	    parent->d_inode->i_sb->s_op->dentry_to_fh == NULL) {		/* old style filehandle please */		memset(&fhp->fh_handle.fh_base, 0, NFS_FHSIZE);		fhp->fh_handle.fh_size = NFS_FHSIZE;		fhp->fh_handle.ofh_dcookie = 0xfeebbaca;		fhp->fh_handle.ofh_dev =  htonl((MAJOR(exp->ex_dev)<<16)| MINOR(exp->ex_dev));		fhp->fh_handle.ofh_xdev = fhp->fh_handle.ofh_dev;		fhp->fh_handle.ofh_xino = ino_t_to_u32(exp->ex_ino);		fhp->fh_handle.ofh_dirino = ino_t_to_u32(dentry->d_parent->d_inode->i_ino);		if (inode)			_fh_update_old(dentry, exp, &fhp->fh_handle);	} else {		fhp->fh_handle.fh_version = 1;		fhp->fh_handle.fh_auth_type = 0;		fhp->fh_handle.fh_fsid_type = 0;		datap = fhp->fh_handle.fh_auth+0;		/* fsid_type 0 == 2byte major, 2byte minor, 4byte inode */		*datap++ = htonl((MAJOR(exp->ex_dev)<<16)| MINOR(exp->ex_dev));		*datap++ = ino_t_to_u32(exp->ex_ino);		fhp->fh_handle.fh_size = 3*4;		if (inode) {			int size = fhp->fh_maxsize/4 - 3;			fhp->fh_handle.fh_fileid_type =				_fh_update(dentry, exp, datap, &size);			fhp->fh_handle.fh_size += size*4;		}	}	nfsd_nr_verified++;	if (fhp->fh_handle.fh_fileid_type == 255)		return nfserr_opnotsupp;	return 0;}/* * Update file handle information after changing a dentry. * This is only called by nfsd_create, nfsd_create_v3 and nfsd_proc_create */intfh_update(struct svc_fh *fhp){	struct dentry *dentry;	__u32 *datap;		if (!fhp->fh_dentry)		goto out_bad;	dentry = fhp->fh_dentry;	if (!dentry->d_inode)		goto out_negative;	if (fhp->fh_handle.fh_version != 1) {		_fh_update_old(dentry, fhp->fh_export, &fhp->fh_handle);	} else {		int size;		if (fhp->fh_handle.fh_fileid_type != 0)			goto out_uptodate;		datap = fhp->fh_handle.fh_auth+			fhp->fh_handle.fh_size/4 -1;		size = (fhp->fh_maxsize - fhp->fh_handle.fh_size)/4;		fhp->fh_handle.fh_fileid_type =			_fh_update(dentry, fhp->fh_export, datap, &size);		fhp->fh_handle.fh_size += size*4;	}out:	return 0;out_bad:	printk(KERN_ERR "fh_update: fh not verified!\n");	goto out;out_negative:	printk(KERN_ERR "fh_update: %s/%s still negative!\n",		dentry->d_parent->d_name.name, dentry->d_name.name);	goto out;out_uptodate:	printk(KERN_ERR "fh_update: %s/%s already up-to-date!\n",		dentry->d_parent->d_name.name, dentry->d_name.name);	goto out;}/* * Release a file handle. */voidfh_put(struct svc_fh *fhp){	struct dentry * dentry = fhp->fh_dentry;	if (dentry) {		fh_unlock(fhp);		fhp->fh_dentry = NULL;		dput(dentry);		nfsd_nr_put++;	}	return;}