delay capable() check in ext4_has_free_blocks()

As reported by Eric Paris, the capable() check in ext4_has_free_blocks()
sometimes causes SELinux denials.

We can rearrange the logic so that we only try to use the root-reserved
blocks when necessary, and even then we can move the capable() test
to last, to avoid the check most of the time.

Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Mingming Cao <cmm@us.ibm.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>

diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index e28203ec45bdbbb08981080321fb27072e954031..d2003cdc36aa687ab998a8c558144ddcc23ae6bb 100644 (file)
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -599,18 +599,13 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
  */
 int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)
 {
-       s64 free_blocks, dirty_blocks;
-       s64 root_blocks = 0;
+       s64 free_blocks, dirty_blocks, root_blocks;
        struct percpu_counter *fbc = &sbi->s_freeblocks_counter;
        struct percpu_counter *dbc = &sbi->s_dirtyblocks_counter;
 
        free_blocks  = percpu_counter_read_positive(fbc);
        dirty_blocks = percpu_counter_read_positive(dbc);
-
-       if (!capable(CAP_SYS_RESOURCE) &&
-               sbi->s_resuid != current->fsuid &&
-               (sbi->s_resgid == 0 || !in_group_p(sbi->s_resgid)))
-               root_blocks = ext4_r_blocks_count(sbi->s_es);
+       root_blocks = ext4_r_blocks_count(sbi->s_es);
 
        if (free_blocks - (nblocks + root_blocks + dirty_blocks) <
                                                EXT4_FREEBLOCKS_WATERMARK) {
@@ -623,13 +618,20 @@ int ext4_has_free_blocks(struct ext4_sb_info *sbi, s64 nblocks)
                }
        }
        /* Check whether we have space after
-        * accounting for current dirty blocks
+        * accounting for current dirty blocks & root reserved blocks.
         */
-       if (free_blocks < ((root_blocks + nblocks) + dirty_blocks))
-               /* we don't have free space */
-               return 0;
+       if (free_blocks >= ((root_blocks + nblocks) + dirty_blocks))
+               return 1;
 
-       return 1;
+       /* Hm, nope.  Are (enough) root reserved blocks available? */
+       if (sbi->s_resuid == current->fsuid ||
+           ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
+           capable(CAP_SYS_RESOURCE)) {
+               if (free_blocks >= (nblocks + dirty_blocks))
+                       return 1;
+       }
+
+       return 0;
 }
 
 int ext4_claim_free_blocks(struct ext4_sb_info *sbi,