Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs pile 1 from Al Viro:
 "This is _not_ all; in particular, Miklos' and Jan's stuff is not there
  yet."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (64 commits)
  ext4: initialization of ext4_li_mtx needs to be done earlier
  debugfs-related mode_t whack-a-mole
  hfsplus: add an ioctl to bless files
  hfsplus: change finder_info to u32
  hfsplus: initialise userflags
  qnx4: new helper - try_extent()
  qnx4: get rid of qnx4_bread/qnx4_getblk
  take removal of PF_FORKNOEXEC to flush_old_exec()
  trim includes in inode.c
  um: uml_dup_mmap() relies on ->mmap_sem being held, but activate_mm() doesn't hold it
  um: embed ->stub_pages[] into mmu_context
  gadgetfs: list_for_each_safe() misuse
  ocfs2: fix leaks on failure exits in module_init
  ecryptfs: make register_filesystem() the last potential failure exit
  ntfs: forgets to unregister sysctls on register_filesystem() failure
  logfs: missing cleanup on register_filesystem() failure
  jfs: mising cleanup on register_filesystem() failure
  make configfs_pin_fs() return root dentry on success
  configfs: configfs_create_dir() has parent dentry in dentry->d_parent
  configfs: sanitize configfs_create()
  ...

1 files changed, 22 insertions, 43 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 5b600cb8779e..c7acaf3167aa 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -199,16 +199,7 @@ static int aio_setup_ring(struct kioctx *ctx)
 static void ctx_rcu_free(struct rcu_head *head)
 {
         struct kioctx *ctx = container_of(head, struct kioctx, rcu_head);
-        unsigned nr_events = ctx->max_reqs;
-
         kmem_cache_free(kioctx_cachep, ctx);
-
-        if (nr_events) {
-                spin_lock(&aio_nr_lock);
-                BUG_ON(aio_nr - nr_events > aio_nr);
-                aio_nr -= nr_events;
-                spin_unlock(&aio_nr_lock);
-        }
 }
 
 /* __put_ioctx
@@ -217,13 +208,19 @@ static void ctx_rcu_free(struct rcu_head *head)
  */
 static void __put_ioctx(struct kioctx *ctx)
 {
+        unsigned nr_events = ctx->max_reqs;
         BUG_ON(ctx->reqs_active);
 
-        cancel_delayed_work(&ctx->wq);
-        cancel_work_sync(&ctx->wq.work);
+        cancel_delayed_work_sync(&ctx->wq);
         aio_free_ring(ctx);
         mmdrop(ctx->mm);
         ctx->mm = NULL;
+        if (nr_events) {
+                spin_lock(&aio_nr_lock);
+                BUG_ON(aio_nr - nr_events > aio_nr);
+                aio_nr -= nr_events;
+                spin_unlock(&aio_nr_lock);
+        }
         pr_debug("__put_ioctx: freeing %p\n", ctx);
         call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
@@ -247,7 +244,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 {
         struct mm_struct *mm;
         struct kioctx *ctx;
-        int did_sync = 0;
+        int err = -ENOMEM;
 
         /* Prevent overflows */
         if ((nr_events > (0x10000000U / sizeof(struct io_event))) ||
@@ -256,7 +253,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
                 return ERR_PTR(-EINVAL);
         }
 
-        if ((unsigned long)nr_events > aio_max_nr)
+        if (!nr_events || (unsigned long)nr_events > aio_max_nr)
                 return ERR_PTR(-EAGAIN);
 
         ctx = kmem_cache_zalloc(kioctx_cachep, GFP_KERNEL);
@@ -280,25 +277,14 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
                 goto out_freectx;
 
         /* limit the number of system wide aios */
-        do {
-                spin_lock_bh(&aio_nr_lock);
-                if (aio_nr + nr_events > aio_max_nr ||
-                    aio_nr + nr_events < aio_nr)
-                        ctx->max_reqs = 0;
-                else
-                        aio_nr += ctx->max_reqs;
-                spin_unlock_bh(&aio_nr_lock);
-                if (ctx->max_reqs || did_sync)
-                        break;
-
-                /* wait for rcu callbacks to have completed before giving up */
-                synchronize_rcu();
-                did_sync = 1;
-                ctx->max_reqs = nr_events;
-        } while (1);
-
-        if (ctx->max_reqs == 0)
+        spin_lock(&aio_nr_lock);
+        if (aio_nr + nr_events > aio_max_nr ||
+            aio_nr + nr_events < aio_nr) {
+                spin_unlock(&aio_nr_lock);
                 goto out_cleanup;
+        }
+        aio_nr += ctx->max_reqs;
+        spin_unlock(&aio_nr_lock);
 
         /* now link into global list. */
         spin_lock(&mm->ioctx_lock);
@@ -310,16 +296,13 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
         return ctx;
 
 out_cleanup:
-        __put_ioctx(ctx);
-        return ERR_PTR(-EAGAIN);
-
+        err = -EAGAIN;
+        aio_free_ring(ctx);
 out_freectx:
         mmdrop(mm);
         kmem_cache_free(kioctx_cachep, ctx);
-        ctx = ERR_PTR(-ENOMEM);
-
-        dprintk("aio: error allocating ioctx %p\n", ctx);
-        return ctx;
+        dprintk("aio: error allocating ioctx %d\n", err);
+        return ERR_PTR(err);
 }
 
 /* aio_cancel_all
@@ -407,10 +390,6 @@ void exit_aio(struct mm_struct *mm)
                 aio_cancel_all(ctx);
 
                 wait_for_all_aios(ctx);
-                /*
-                 * Ensure we don't leave the ctx on the aio_wq
-                 */
-                cancel_work_sync(&ctx->wq.work);
 
                 if (1 != atomic_read(&ctx->users))
                         printk(KERN_DEBUG
@@ -920,7 +899,7 @@ static void aio_kick_handler(struct work_struct *work)
         unuse_mm(mm);
         set_fs(oldfs);
         /*
-         * we're in a worker thread already, don't use queue_delayed_work,
+         * we're in a worker thread already; no point using non-zero delay
          */
         if (requeue)
                 queue_delayed_work(aio_wq, &ctx->wq, 0);