Merge branch 'master' into for-next

Fast-forwarded to current state of Linus' tree as there are patches to be
applied for files that didn't exist on the old branch.

6 files changed, 42 insertions, 48 deletions

diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 6b1305dc26c0..9fde1c00a296 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -164,7 +164,7 @@ static int process_access_response(struct fsnotify_group *group,
                  fd, response);
         /*
          * make sure the response is valid, if invalid we do nothing and either
-         * userspace can send a valid responce or we will clean it up after the
+         * userspace can send a valid response or we will clean it up after the
          * timeout
          */
         switch (response) {
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 4c29fcf557d1..07ea8d3e6ea2 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -22,13 +22,14 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
-#include <linux/writeback.h> /* for inode_lock */
 
 #include <asm/atomic.h>
 
 #include <linux/fsnotify_backend.h>
 #include "fsnotify.h"
 
+#include "../internal.h"
+
 /*
  * Recalculate the mask of events relevant to a given inode locked.
  */
@@ -237,15 +238,14 @@ out:
  * fsnotify_unmount_inodes - an sb is unmounting.  handle any watched inodes.
  * @list: list of inodes being unmounted (sb->s_inodes)
  *
- * Called with inode_lock held, protecting the unmounting super block's list
- * of inodes, and with iprune_mutex held, keeping shrink_icache_memory() at bay.
- * We temporarily drop inode_lock, however, and CAN block.
+ * Called during unmount with no locks held, so needs to be safe against
+ * concurrent modifiers. We temporarily drop inode_sb_list_lock and CAN block.
  */
 void fsnotify_unmount_inodes(struct list_head *list)
 {
         struct inode *inode, *next_i, *need_iput = NULL;
 
-        spin_lock(&inode_lock);
+        spin_lock(&inode_sb_list_lock);
         list_for_each_entry_safe(inode, next_i, list, i_sb_list) {
                 struct inode *need_iput_tmp;
 
@@ -254,8 +254,11 @@ void fsnotify_unmount_inodes(struct list_head *list)
                  * I_WILL_FREE, or I_NEW which is fine because by that point
                  * the inode cannot have any associated watches.
                  */
-                if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
+                spin_lock(&inode->i_lock);
+                if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) {
+                        spin_unlock(&inode->i_lock);
                         continue;
+                }
 
                 /*
                  * If i_count is zero, the inode cannot have any watches and
@@ -263,8 +266,10 @@ void fsnotify_unmount_inodes(struct list_head *list)
                  * evict all inodes with zero i_count from icache which is
                  * unnecessarily violent and may in fact be illegal to do.
                  */
-                if (!atomic_read(&inode->i_count))
+                if (!atomic_read(&inode->i_count)) {
+                        spin_unlock(&inode->i_lock);
                         continue;
+                }
 
                 need_iput_tmp = need_iput;
                 need_iput = NULL;
@@ -274,22 +279,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
                         __iget(inode);
                 else
                         need_iput_tmp = NULL;
+                spin_unlock(&inode->i_lock);
 
                 /* In case the dropping of a reference would nuke next_i. */
                 if ((&next_i->i_sb_list != list) &&
-                    atomic_read(&next_i->i_count) &&
-                    !(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
-                        __iget(next_i);
-                        need_iput = next_i;
+                    atomic_read(&next_i->i_count)) {
+                        spin_lock(&next_i->i_lock);
+                        if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
+                                __iget(next_i);
+                                need_iput = next_i;
+                        }
+                        spin_unlock(&next_i->i_lock);
                 }
 
                 /*
-                 * We can safely drop inode_lock here because we hold
+                 * We can safely drop inode_sb_list_lock here because we hold
                  * references on both inode and next_i.  Also no new inodes
-                 * will be added since the umount has begun.  Finally,
-                 * iprune_mutex keeps shrink_icache_memory() away.
+                 * will be added since the umount has begun.
                  */
-                spin_unlock(&inode_lock);
+                spin_unlock(&inode_sb_list_lock);
 
                 if (need_iput_tmp)
                         iput(need_iput_tmp);
@@ -301,7 +309,7 @@ void fsnotify_unmount_inodes(struct list_head *list)
 
                 iput(inode);
 
-                spin_lock(&inode_lock);
+                spin_lock(&inode_sb_list_lock);
         }
-        spin_unlock(&inode_lock);
+        spin_unlock(&inode_sb_list_lock);
 }
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index a91b69a6a291..e3cbd746f64a 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -194,10 +194,11 @@ static int idr_callback(int id, void *p, void *data)
 
 static void inotify_free_group_priv(struct fsnotify_group *group)
 {
-        /* ideally the idr is empty and we won't hit the BUG in teh callback */
+        /* ideally the idr is empty and we won't hit the BUG in the callback */
         idr_for_each(&group->inotify_data.idr, idr_callback, group);
         idr_remove_all(&group->inotify_data.idr);
         idr_destroy(&group->inotify_data.idr);
+        atomic_dec(&group->inotify_data.user->inotify_devs);
         free_uid(group->inotify_data.user);
 }
 
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index bd46e7c8a0ef..8445fbc8985c 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -290,7 +290,6 @@ static int inotify_fasync(int fd, struct file *file, int on)
 static int inotify_release(struct inode *ignored, struct file *file)
 {
         struct fsnotify_group *group = file->private_data;
-        struct user_struct *user = group->inotify_data.user;
 
         pr_debug("%s: group=%p\n", __func__, group);
 
@@ -299,8 +298,6 @@ static int inotify_release(struct inode *ignored, struct file *file)
         /* free this group, matching get was inotify_init->fsnotify_obtain_group */
         fsnotify_put_group(group);
 
-        atomic_dec(&user->inotify_devs);
-
         return 0;
 }
 
@@ -697,7 +694,7 @@ retry:
         return ret;
 }
 
-static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsigned int max_events)
+static struct fsnotify_group *inotify_new_group(unsigned int max_events)
 {
         struct fsnotify_group *group;
 
@@ -710,8 +707,14 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
         spin_lock_init(&group->inotify_data.idr_lock);
         idr_init(&group->inotify_data.idr);
         group->inotify_data.last_wd = 0;
-        group->inotify_data.user = user;
         group->inotify_data.fa = NULL;
+        group->inotify_data.user = get_current_user();
+
+        if (atomic_inc_return(&group->inotify_data.user->inotify_devs) >
+            inotify_max_user_instances) {
+                fsnotify_put_group(group);
+                return ERR_PTR(-EMFILE);
+        }
 
         return group;
 }
@@ -721,7 +724,6 @@ static struct fsnotify_group *inotify_new_group(struct user_struct *user, unsign
 SYSCALL_DEFINE1(inotify_init1, int, flags)
 {
         struct fsnotify_group *group;
-        struct user_struct *user;
         int ret;
 
         /* Check the IN_* constants for consistency.  */
@@ -731,31 +733,16 @@ SYSCALL_DEFINE1(inotify_init1, int, flags)
         if (flags & ~(IN_CLOEXEC | IN_NONBLOCK))
                 return -EINVAL;
 
-        user = get_current_user();
-        if (unlikely(atomic_read(&user->inotify_devs) >=
-                        inotify_max_user_instances)) {
-                ret = -EMFILE;
-                goto out_free_uid;
-        }
-
         /* fsnotify_obtain_group took a reference to group, we put this when we kill the file in the end */
-        group = inotify_new_group(user, inotify_max_queued_events);
-        if (IS_ERR(group)) {
-                ret = PTR_ERR(group);
-                goto out_free_uid;
-        }
-
-        atomic_inc(&user->inotify_devs);
+        group = inotify_new_group(inotify_max_queued_events);
+        if (IS_ERR(group))
+                return PTR_ERR(group);
 
         ret = anon_inode_getfd("inotify", &inotify_fops, group,
                                   O_RDONLY | flags);
-        if (ret >= 0)
-                return ret;
+        if (ret < 0)
+                fsnotify_put_group(group);
 
-        fsnotify_put_group(group);
-        atomic_dec(&user->inotify_devs);
-out_free_uid:
-        free_uid(user);
         return ret;
 }
 
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index 325185e514bb..252ab1f6452b 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -24,7 +24,7 @@
  * referencing this object.  The object typically will live inside the kernel
  * with a refcnt of 2, one for each list it is on (i_list, g_list).  Any task
  * which can find this object holding the appropriete locks, can take a reference
- * and the object itself is guarenteed to survive until the reference is dropped.
+ * and the object itself is guaranteed to survive until the reference is dropped.
  *
  * LOCKING:
  * There are 3 spinlocks involved with fsnotify inode marks and they MUST
@@ -91,7 +91,6 @@
 #include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/srcu.h>
-#include <linux/writeback.h> /* for inode_lock */
 
 #include <asm/atomic.h>
 
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index 85eebff6d0d7..e86577d6c5c3 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -23,7 +23,6 @@
 #include <linux/mount.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
-#include <linux/writeback.h> /* for inode_lock */
 
 #include <asm/atomic.h>