3 files changed, 88 insertions, 60 deletions

diff --git a/fs/mount.h b/fs/mount.h
index ede5a1d5cf99..de45d9e76748 100644
--- a/fs/mount.h
+++ b/fs/mount.h
@@ -58,7 +58,7 @@ struct mount {
         struct mnt_namespace *mnt_ns;   /* containing namespace */
         struct mountpoint *mnt_mp;      /* where is it mounted */
         struct hlist_node mnt_mp_list;  /* list mounts with the same mountpoint */
-        struct list_head mnt_reparent;  /* reparent list entry */
+        struct list_head mnt_umounting; /* list entry for umount propagation */
 #ifdef CONFIG_FSNOTIFY
         struct fsnotify_mark_connector __rcu *mnt_fsnotify_marks;
         __u32 mnt_fsnotify_mask;
diff --git a/fs/namespace.c b/fs/namespace.c
index 51e49866e1fe..5e3dcbeb1de5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -236,7 +236,7 @@ static struct mount *alloc_vfsmnt(const char *name)
                 INIT_LIST_HEAD(&mnt->mnt_slave_list);
                 INIT_LIST_HEAD(&mnt->mnt_slave);
                 INIT_HLIST_NODE(&mnt->mnt_mp_list);
-                INIT_LIST_HEAD(&mnt->mnt_reparent);
+                INIT_LIST_HEAD(&mnt->mnt_umounting);
                 init_fs_pin(&mnt->mnt_umount, drop_mountpoint);
         }
         return mnt;
diff --git a/fs/pnode.c b/fs/pnode.c
index 52aca0a118ff..fbaca7df2eb0 100644
--- a/fs/pnode.c
+++ b/fs/pnode.c
@@ -413,86 +413,95 @@ void propagate_mount_unlock(struct mount *mnt)
         }
 }
 
-/*
- * Mark all mounts that the MNT_LOCKED logic will allow to be unmounted.
- */
-static void mark_umount_candidates(struct mount *mnt)
+static void umount_one(struct mount *mnt, struct list_head *to_umount)
 {
-        struct mount *parent = mnt->mnt_parent;
-        struct mount *m;
-
-        BUG_ON(parent == mnt);
-
-        for (m = propagation_next(parent, parent); m;
-                        m = propagation_next(m, parent)) {
-                struct mount *child = __lookup_mnt(&m->mnt,
-                                                mnt->mnt_mountpoint);
-                if (!child || (child->mnt.mnt_flags & MNT_UMOUNT))
-                        continue;
-                if (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m)) {
-                        SET_MNT_MARK(child);
-                }
-        }
+        CLEAR_MNT_MARK(mnt);
+        mnt->mnt.mnt_flags |= MNT_UMOUNT;
+        list_del_init(&mnt->mnt_child);
+        list_del_init(&mnt->mnt_umounting);
+        list_move_tail(&mnt->mnt_list, to_umount);
 }
 
 /*
  * NOTE: unmounting 'mnt' naturally propagates to all other mounts its
  * parent propagates to.
  */
-static void __propagate_umount(struct mount *mnt, struct list_head *to_reparent)
+static bool __propagate_umount(struct mount *mnt,
+                               struct list_head *to_umount,
+                               struct list_head *to_restore)
 {
-        struct mount *parent = mnt->mnt_parent;
-        struct mount *m;
+        bool progress = false;
+        struct mount *child;
 
-        BUG_ON(parent == mnt);
+        /*
+         * The state of the parent won't change if this mount is
+         * already unmounted or marked as without children.
+         */
+        if (mnt->mnt.mnt_flags & (MNT_UMOUNT | MNT_MARKED))
+                goto out;
 
-        for (m = propagation_next(parent, parent); m;
-                        m = propagation_next(m, parent)) {
-                struct mount *topper;
-                struct mount *child = __lookup_mnt(&m->mnt,
-                                                mnt->mnt_mountpoint);
-                /*
-                 * umount the child only if the child has no children
-                 * and the child is marked safe to unmount.
-                 */
-                if (!child || !IS_MNT_MARKED(child))
+        /* Verify topper is the only grandchild that has not been
+         * speculatively unmounted.
+         */
+        list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) {
+                if (child->mnt_mountpoint == mnt->mnt.mnt_root)
                         continue;
-                CLEAR_MNT_MARK(child);
+                if (!list_empty(&child->mnt_umounting) && IS_MNT_MARKED(child))
+                        continue;
+                /* Found a mounted child */
+                goto children;
+        }
 
-                /* If there is exactly one mount covering all of child
-                 * replace child with that mount.
-                 */
-                topper = find_topper(child);
-                if (topper)
-                        list_add_tail(&topper->mnt_reparent, to_reparent);
+        /* Mark mounts that can be unmounted if not locked */
+        SET_MNT_MARK(mnt);
+        progress = true;
 
-                if (topper || list_empty(&child->mnt_mounts)) {
-                        list_del_init(&child->mnt_child);
-                        list_del_init(&child->mnt_reparent);
-                        child->mnt.mnt_flags |= MNT_UMOUNT;
-                        list_move_tail(&child->mnt_list, &mnt->mnt_list);
+        /* If a mount is without children and not locked umount it. */
+        if (!IS_MNT_LOCKED(mnt)) {
+                umount_one(mnt, to_umount);
+        } else {
+children:
+                list_move_tail(&mnt->mnt_umounting, to_restore);
+        }
+out:
+        return progress;
+}
+
+static void umount_list(struct list_head *to_umount,
+                        struct list_head *to_restore)
+{
+        struct mount *mnt, *child, *tmp;
+        list_for_each_entry(mnt, to_umount, mnt_list) {
+                list_for_each_entry_safe(child, tmp, &mnt->mnt_mounts, mnt_child) {
+                        /* topper? */
+                        if (child->mnt_mountpoint == mnt->mnt.mnt_root)
+                                list_move_tail(&child->mnt_umounting, to_restore);
+                        else
+                                umount_one(child, to_umount);
                 }
         }
 }
 
-static void reparent_mounts(struct list_head *to_reparent)
+static void restore_mounts(struct list_head *to_restore)
 {
-        while (!list_empty(to_reparent)) {
+        /* Restore mounts to a clean working state */
+        while (!list_empty(to_restore)) {
                 struct mount *mnt, *parent;
                 struct mountpoint *mp;
 
-                mnt = list_first_entry(to_reparent, struct mount, mnt_reparent);
-                list_del_init(&mnt->mnt_reparent);
+                mnt = list_first_entry(to_restore, struct mount, mnt_umounting);
+                CLEAR_MNT_MARK(mnt);
+                list_del_init(&mnt->mnt_umounting);
 
-                /* Where should this mount be reparented to? */
+                /* Should this mount be reparented? */
                 mp = mnt->mnt_mp;
                 parent = mnt->mnt_parent;
                 while (parent->mnt.mnt_flags & MNT_UMOUNT) {
                         mp = parent->mnt_mp;
                         parent = parent->mnt_parent;
                 }
-
-                mnt_change_mountpoint(parent, mp, mnt);
+                if (parent != mnt->mnt_parent)
+                        mnt_change_mountpoint(parent, mp, mnt);
         }
 }
 
@@ -506,15 +515,34 @@ static void reparent_mounts(struct list_head *to_reparent)
 int propagate_umount(struct list_head *list)
 {
         struct mount *mnt;
-        LIST_HEAD(to_reparent);
+        LIST_HEAD(to_restore);
+        LIST_HEAD(to_umount);
 
-        list_for_each_entry_reverse(mnt, list, mnt_list)
-                mark_umount_candidates(mnt);
+        list_for_each_entry(mnt, list, mnt_list) {
+                struct mount *parent = mnt->mnt_parent;
+                struct mount *m;
 
-        list_for_each_entry(mnt, list, mnt_list)
-                __propagate_umount(mnt, &to_reparent);
+                for (m = propagation_next(parent, parent); m;
+                     m = propagation_next(m, parent)) {
+                        struct mount *child = __lookup_mnt(&m->mnt,
+                                                           mnt->mnt_mountpoint);
+                        if (!child)
+                                continue;
+
+                        /* Check the child and parents while progress is made */
+                        while (__propagate_umount(child,
+                                                  &to_umount, &to_restore)) {
+                                /* Is the parent a umount candidate? */
+                                child = child->mnt_parent;
+                                if (list_empty(&child->mnt_umounting))
+                                        break;
+                        }
+                }
+        }
 
-        reparent_mounts(&to_reparent);
+        umount_list(&to_umount, &to_restore);
+        restore_mounts(&to_restore);
+        list_splice_tail(&to_umount, list);
 
         return 0;
 }