fscrypt: Drop d_revalidate for valid dentries during lookup

Unencrypted and encrypted-dentries where the key is available don't need
to be revalidated by fscrypt, since they don't go stale from under VFS
and the key cannot be removed for the encrypted case without evicting
the dentry.  Disable their d_revalidate hook on the first lookup, to
avoid repeated revalidation later. This is done in preparation to always
configuring d_op through sb->s_d_op.

The only part detail is that, since the filesystem might have other
features that require revalidation, we only apply this optimization if
the d_revalidate handler is fscrypt_d_revalidate itself.

Finally, we need to clean the dentry->flags even for unencrypted
dentries, so the ->d_lock might be acquired even for them.  In order to
avoid doing it for filesystems that don't care about fscrypt at all, we
peek ->d_flags without the lock at first, and only acquire it if we
actually need to write the flag.

Reviewed-by: Eric Biggers <ebiggers@google.com>
Link: https://lore.kernel.org/r/20240221171412.10710-4-krisman@suse.de
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>

diff --git a/include/linux/fscrypt.h b/include/linux/fscrypt.h
index c76f859cf019372cdd675390404f80aff35496d5..78af02b35bd9634d6447f010bab7b4e03fc776fb 100644 (file)
--- a/include/linux/fscrypt.h
+++ b/include/linux/fscrypt.h
@@ -264,10 +264,29 @@ static inline bool fscrypt_is_nokey_name(const struct dentry *dentry)
 static inline void fscrypt_prepare_dentry(struct dentry *dentry,
                                          bool is_nokey_name)
 {
+       /*
+        * This code tries to only take ->d_lock when necessary to write
+        * to ->d_flags.  We shouldn't be peeking on d_flags for
+        * DCACHE_OP_REVALIDATE unlocked, but in the unlikely case
+        * there is a race, the worst it can happen is that we fail to
+        * unset DCACHE_OP_REVALIDATE and pay the cost of an extra
+        * d_revalidate.
+        */
        if (is_nokey_name) {
                spin_lock(&dentry->d_lock);
                dentry->d_flags |= DCACHE_NOKEY_NAME;
                spin_unlock(&dentry->d_lock);
+       } else if (dentry->d_flags & DCACHE_OP_REVALIDATE &&
+                  dentry->d_op->d_revalidate == fscrypt_d_revalidate) {
+               /*
+                * Unencrypted dentries and encrypted dentries where the
+                * key is available are always valid from fscrypt
+                * perspective. Avoid the cost of calling
+                * fscrypt_d_revalidate unnecessarily.
+                */
+               spin_lock(&dentry->d_lock);
+               dentry->d_flags &= ~DCACHE_OP_REVALIDATE;
+               spin_unlock(&dentry->d_lock);
        }
 }
 
@@ -997,6 +1016,9 @@ static inline int fscrypt_prepare_lookup(struct inode *dir,
        fname->usr_fname = &dentry->d_name;
        fname->disk_name.name = (unsigned char *)dentry->d_name.name;
        fname->disk_name.len = dentry->d_name.len;
+
+       fscrypt_prepare_dentry(dentry, false);
+
        return 0;
 }