7 files changed, 48 insertions, 42 deletions

diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index ad46eae1f9bb..2c64faa8efa4 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -676,7 +676,11 @@ static int ptmx_open(struct inode *inode, struct file *filp)
 
         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
         filp->private_data = tty;
-        file_move(filp, &tty->tty_files);
+
+        file_sb_list_del(filp); /* __dentry_open has put it on the sb list */
+        spin_lock(&tty_files_lock);
+        list_add(&filp->f_u.fu_list, &tty->tty_files);
+        spin_unlock(&tty_files_lock);
 
         retval = devpts_pty_new(inode, tty->link);
         if (retval)
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 0350c42375a2..cd5b829634ea 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -136,6 +136,9 @@ LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
 DEFINE_MUTEX(tty_mutex);
 EXPORT_SYMBOL(tty_mutex);
 
+/* Spinlock to protect the tty->tty_files list */
+DEFINE_SPINLOCK(tty_files_lock);
+
 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -235,11 +238,11 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
         struct list_head *p;
         int count = 0;
 
-        file_list_lock();
+        spin_lock(&tty_files_lock);
         list_for_each(p, &tty->tty_files) {
                 count++;
         }
-        file_list_unlock();
+        spin_unlock(&tty_files_lock);
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
             tty->driver->subtype == PTY_TYPE_SLAVE &&
             tty->link && tty->link->count)
@@ -519,7 +522,7 @@ void __tty_hangup(struct tty_struct *tty)
            workqueue with the lock held */
         check_tty_count(tty, "tty_hangup");
 
-        file_list_lock();
+        spin_lock(&tty_files_lock);
         /* This breaks for file handles being sent over AF_UNIX sockets ? */
         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
                 if (filp->f_op->write == redirected_tty_write)
@@ -530,7 +533,7 @@ void __tty_hangup(struct tty_struct *tty)
                 __tty_fasync(-1, filp, 0);      /* can't block */
                 filp->f_op = &hung_up_tty_fops;
         }
-        file_list_unlock();
+        spin_unlock(&tty_files_lock);
 
         tty_ldisc_hangup(tty);
 
@@ -1424,9 +1427,9 @@ static void release_one_tty(struct work_struct *work)
         tty_driver_kref_put(driver);
         module_put(driver->owner);
 
-        file_list_lock();
+        spin_lock(&tty_files_lock);
         list_del_init(&tty->tty_files);
-        file_list_unlock();
+        spin_unlock(&tty_files_lock);
 
         put_pid(tty->pgrp);
         put_pid(tty->session);
@@ -1671,7 +1674,10 @@ int tty_release(struct inode *inode, struct file *filp)
          *  - do_tty_hangup no longer sees this file descriptor as
          *    something that needs to be handled for hangups.
          */
-        file_kill(filp);
+        spin_lock(&tty_files_lock);
+        BUG_ON(list_empty(&filp->f_u.fu_list));
+        list_del_init(&filp->f_u.fu_list);
+        spin_unlock(&tty_files_lock);
         filp->private_data = NULL;
 
         /*
@@ -1840,7 +1846,11 @@ got_driver:
         }
 
         filp->private_data = tty;
-        file_move(filp, &tty->tty_files);
+        BUG_ON(list_empty(&filp->f_u.fu_list));
+        file_sb_list_del(filp); /* __dentry_open has put it on the sb list */
+        spin_lock(&tty_files_lock);
+        list_add(&filp->f_u.fu_list, &tty->tty_files);
+        spin_unlock(&tty_files_lock);
         check_tty_count(tty, "tty_open");
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
             tty->driver->subtype == PTY_TYPE_MASTER)
diff --git a/fs/file_table.c b/fs/file_table.c
index edecd36fed9b..6f0e62ecfddd 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -32,8 +32,7 @@ struct files_stat_struct files_stat = {
         .max_files = NR_FILE
 };
 
-/* public. Not pretty! */
-__cacheline_aligned_in_smp DEFINE_SPINLOCK(files_lock);
+static __cacheline_aligned_in_smp DEFINE_SPINLOCK(files_lock);
 
 /* SLAB cache for file structures */
 static struct kmem_cache *filp_cachep __read_mostly;
@@ -249,7 +248,7 @@ static void __fput(struct file *file)
                 cdev_put(inode->i_cdev);
         fops_put(file->f_op);
         put_pid(file->f_owner.pid);
-        file_kill(file);
+        file_sb_list_del(file);
         if (file->f_mode & FMODE_WRITE)
                 drop_file_write_access(file);
         file->f_path.dentry = NULL;
@@ -328,31 +327,29 @@ struct file *fget_light(unsigned int fd, int *fput_needed)
         return file;
 }
 
-
 void put_filp(struct file *file)
 {
         if (atomic_long_dec_and_test(&file->f_count)) {
                 security_file_free(file);
-                file_kill(file);
+                file_sb_list_del(file);
                 file_free(file);
         }
 }
 
-void file_move(struct file *file, struct list_head *list)
+void file_sb_list_add(struct file *file, struct super_block *sb)
 {
-        if (!list)
-                return;
-        file_list_lock();
-        list_move(&file->f_u.fu_list, list);
-        file_list_unlock();
+        spin_lock(&files_lock);
+        BUG_ON(!list_empty(&file->f_u.fu_list));
+        list_add(&file->f_u.fu_list, &sb->s_files);
+        spin_unlock(&files_lock);
 }
 
-void file_kill(struct file *file)
+void file_sb_list_del(struct file *file)
 {
         if (!list_empty(&file->f_u.fu_list)) {
-                file_list_lock();
+                spin_lock(&files_lock);
                 list_del_init(&file->f_u.fu_list);
-                file_list_unlock();
+                spin_unlock(&files_lock);
         }
 }
 
@@ -361,7 +358,7 @@ int fs_may_remount_ro(struct super_block *sb)
         struct file *file;
 
         /* Check that no files are currently opened for writing. */
-        file_list_lock();
+        spin_lock(&files_lock);
         list_for_each_entry(file, &sb->s_files, f_u.fu_list) {
                 struct inode *inode = file->f_path.dentry->d_inode;
 
@@ -373,10 +370,10 @@ int fs_may_remount_ro(struct super_block *sb)
                 if (S_ISREG(inode->i_mode) && (file->f_mode & FMODE_WRITE))
                         goto too_bad;
         }
-        file_list_unlock();
+        spin_unlock(&files_lock);
         return 1; /* Tis' cool bro. */
 too_bad:
-        file_list_unlock();
+        spin_unlock(&files_lock);
         return 0;
 }
 
@@ -392,7 +389,7 @@ void mark_files_ro(struct super_block *sb)
         struct file *f;
 
 retry:
-        file_list_lock();
+        spin_lock(&files_lock);
         list_for_each_entry(f, &sb->s_files, f_u.fu_list) {
                 struct vfsmount *mnt;
                 if (!S_ISREG(f->f_path.dentry->d_inode->i_mode))
@@ -408,16 +405,13 @@ retry:
                         continue;
                 file_release_write(f);
                 mnt = mntget(f->f_path.mnt);
-                file_list_unlock();
-                /*
-                 * This can sleep, so we can't hold
-                 * the file_list_lock() spinlock.
-                 */
+                /* This can sleep, so we can't hold the spinlock. */
+                spin_unlock(&files_lock);
                 mnt_drop_write(mnt);
                 mntput(mnt);
                 goto retry;
         }
-        file_list_unlock();
+        spin_unlock(&files_lock);
 }
 
 void __init files_init(unsigned long mempages)
diff --git a/fs/open.c b/fs/open.c
index 630715f9f73d..d74e1983e8dc 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -675,7 +675,7 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
         f->f_path.mnt = mnt;
         f->f_pos = 0;
         f->f_op = fops_get(inode->i_fop);
-        file_move(f, &inode->i_sb->s_files);
+        file_sb_list_add(f, inode->i_sb);
 
         error = security_dentry_open(f, cred);
         if (error)
@@ -721,7 +721,7 @@ cleanup_all:
                         mnt_drop_write(mnt);
                 }
         }
-        file_kill(f);
+        file_sb_list_del(f);
         f->f_path.dentry = NULL;
         f->f_path.mnt = NULL;
 cleanup_file:
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 29f7c975304c..5a9a9e5a3705 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -944,9 +944,6 @@ struct file {
         unsigned long f_mnt_write_state;
 #endif
 };
-extern spinlock_t files_lock;
-#define file_list_lock() spin_lock(&files_lock);
-#define file_list_unlock() spin_unlock(&files_lock);
 
 #define get_file(x)     atomic_long_inc(&(x)->f_count)
 #define fput_atomic(x)  atomic_long_add_unless(&(x)->f_count, -1, 1)
@@ -2188,8 +2185,8 @@ static inline void insert_inode_hash(struct inode *inode) {
         __insert_inode_hash(inode, inode->i_ino);
 }
 
-extern void file_move(struct file *f, struct list_head *list);
-extern void file_kill(struct file *f);
+extern void file_sb_list_add(struct file *f, struct super_block *sb);
+extern void file_sb_list_del(struct file *f);
 #ifdef CONFIG_BLOCK
 extern void submit_bio(int, struct bio *);
 extern int bdev_read_only(struct block_device *);
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 1437da3ddc62..f6b371a2514e 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -470,6 +470,7 @@ extern struct tty_struct *tty_pair_get_tty(struct tty_struct *tty);
 extern struct tty_struct *tty_pair_get_pty(struct tty_struct *tty);
 
 extern struct mutex tty_mutex;
+extern spinlock_t tty_files_lock;
 
 extern void tty_write_unlock(struct tty_struct *tty);
 extern int tty_write_lock(struct tty_struct *tty, int ndelay);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 42043f96e54f..bd7da0f0ccf3 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2170,7 +2170,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
 
         tty = get_current_tty();
         if (tty) {
-                file_list_lock();
+                spin_lock(&tty_files_lock);
                 if (!list_empty(&tty->tty_files)) {
                         struct inode *inode;
 
@@ -2186,7 +2186,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                                 drop_tty = 1;
                         }
                 }
-                file_list_unlock();
+                spin_unlock(&tty_files_lock);
                 tty_kref_put(tty);
         }
         /* Reset controlling tty. */