Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull VFS fixes from Al Viro:
 "Fixes for this cycle regression in overlayfs and a couple of
  long-standing (== all the way back to 2.6.12, at least) bugs"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  freeing unlinked file indefinitely delayed
  fix a braino in ovl_d_select_inode()
  9p: don't leave a half-initialized inode sitting around

4 files changed, 10 insertions, 6 deletions

diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index 510040b04c96..b1dc51888048 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c
@@ -540,8 +540,7 @@ static struct inode *v9fs_qid_iget(struct super_block *sb,
         unlock_new_inode(inode);
         return inode;
 error:
-        unlock_new_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         return ERR_PTR(retval);
 
 }
diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c
index 09e4433717b8..e8aa57dc8d6d 100644
--- a/fs/9p/vfs_inode_dotl.c
+++ b/fs/9p/vfs_inode_dotl.c
@@ -149,8 +149,7 @@ static struct inode *v9fs_qid_iget_dotl(struct super_block *sb,
         unlock_new_inode(inode);
         return inode;
 error:
-        unlock_new_inode(inode);
-        iput(inode);
+        iget_failed(inode);
         return ERR_PTR(retval);
 
 }
diff --git a/fs/dcache.c b/fs/dcache.c
index 7a3f3e5f9cea..5c8ea15e73a5 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -642,7 +642,7 @@ static inline bool fast_dput(struct dentry *dentry)
 
         /*
          * If we have a d_op->d_delete() operation, we sould not
-         * let the dentry count go to zero, so use "put__or_lock".
+         * let the dentry count go to zero, so use "put_or_lock".
          */
         if (unlikely(dentry->d_flags & DCACHE_OP_DELETE))
                 return lockref_put_or_lock(&dentry->d_lockref);
@@ -697,7 +697,7 @@ static inline bool fast_dput(struct dentry *dentry)
          */
         smp_rmb();
         d_flags = ACCESS_ONCE(dentry->d_flags);
-        d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST;
+        d_flags &= DCACHE_REFERENCED | DCACHE_LRU_LIST | DCACHE_DISCONNECTED;
 
         /* Nothing to do? Dropping the reference was all we needed? */
         if (d_flags == (DCACHE_REFERENCED | DCACHE_LRU_LIST) && !d_unhashed(dentry))
@@ -776,6 +776,9 @@ repeat:
         if (unlikely(d_unhashed(dentry)))
                 goto kill_it;
 
+        if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+                goto kill_it;
+
         if (unlikely(dentry->d_flags & DCACHE_OP_DELETE)) {
                 if (dentry->d_op->d_delete(dentry))
                         goto kill_it;
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index f140e3dbfb7b..d9da5a4e9382 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -343,6 +343,9 @@ struct inode *ovl_d_select_inode(struct dentry *dentry, unsigned file_flags)
         struct path realpath;
         enum ovl_path_type type;
 
+        if (d_is_dir(dentry))
+                return d_backing_inode(dentry);
+
         type = ovl_path_real(dentry, &realpath);
         if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
                 err = ovl_want_write(dentry);