configfs_detach_prep(): make sure that wait_mutex won't go away

grab a reference to dentry we'd got the sucker from, and return
that dentry via *wait, rather than just returning the address of
->i_mutex.

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

1 files changed, 9 insertions, 8 deletions

diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index ea59c891fc53..48929c408e04 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -494,7 +494,7 @@ out:
  * If there is an error, the caller will reset the flags via
  * configfs_detach_rollback().
  */
-static int configfs_detach_prep(struct dentry *dentry, struct mutex **wait_mutex)
+static int configfs_detach_prep(struct dentry *dentry, struct dentry **wait)
 {
         struct configfs_dirent *parent_sd = dentry->d_fsdata;
         struct configfs_dirent *sd;
@@ -515,8 +515,8 @@ static int configfs_detach_prep(struct dentry *dentry, struct mutex **wait_mutex
                 if (sd->s_type & CONFIGFS_USET_DEFAULT) {
                         /* Abort if racing with mkdir() */
                         if (sd->s_type & CONFIGFS_USET_IN_MKDIR) {
-                                if (wait_mutex)
-                                        *wait_mutex = &d_inode(sd->s_dentry)->i_mutex;
+                                if (wait)
+                                        *wait= dget(sd->s_dentry);
                                 return -EAGAIN;
                         }
 
@@ -524,7 +524,7 @@ static int configfs_detach_prep(struct dentry *dentry, struct mutex **wait_mutex
                          * Yup, recursive.  If there's a problem, blame
                          * deep nesting of default_groups
                          */
-                        ret = configfs_detach_prep(sd->s_dentry, wait_mutex);
+                        ret = configfs_detach_prep(sd->s_dentry, wait);
                         if (!ret)
                                 continue;
                 } else
@@ -1458,7 +1458,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
          * the new link is temporarily attached
          */
         do {
-                struct mutex *wait_mutex;
+                struct dentry *wait;
 
                 mutex_lock(&configfs_symlink_mutex);
                 spin_lock(&configfs_dirent_lock);
@@ -1469,7 +1469,7 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
                  */
                 ret = sd->s_dependent_count ? -EBUSY : 0;
                 if (!ret) {
-                        ret = configfs_detach_prep(dentry, &wait_mutex);
+                        ret = configfs_detach_prep(dentry, &wait);
                         if (ret)
                                 configfs_detach_rollback(dentry);
                 }
@@ -1483,8 +1483,9 @@ static int configfs_rmdir(struct inode *dir, struct dentry *dentry)
                         }
 
                         /* Wait until the racing operation terminates */
-                        mutex_lock(wait_mutex);
-                        mutex_unlock(wait_mutex);
+                        inode_lock(d_inode(wait));
+                        inode_unlock(d_inode(wait));
+                        dput(wait);
                 }
         } while (ret == -EAGAIN);