7 files changed, 50 insertions, 43 deletions

diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index 385c44b3034f..8fa273e76bb3 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -649,7 +649,11 @@ static int __ptmx_open(struct inode *inode, struct file *filp)
 
         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
         filp->private_data = tty;
-        file_move(filp, &tty->tty_files);
+
+        file_sb_list_del(filp); /* __dentry_open has put it on the sb list */
+        spin_lock(&tty_files_lock);
+        list_add(&filp->f_u.fu_list, &tty->tty_files);
+        spin_unlock(&tty_files_lock);
 
         retval = devpts_pty_new(inode, tty->link);
         if (retval)
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index 76253cf27028..38ddfa404fb1 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -136,6 +136,9 @@ LIST_HEAD(tty_drivers);			/* linked list of tty drivers */
 DEFINE_MUTEX(tty_mutex);
 EXPORT_SYMBOL(tty_mutex);
 
+/* Spinlock to protect the tty->tty_files list */
+DEFINE_SPINLOCK(tty_files_lock);
+
 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 ssize_t redirected_tty_write(struct file *, const char __user *,
@@ -234,11 +237,11 @@ static int check_tty_count(struct tty_struct *tty, const char *routine)
         struct list_head *p;
         int count = 0;
 
-        file_list_lock();
+        spin_lock(&tty_files_lock);
         list_for_each(p, &tty->tty_files) {
                 count++;
         }
-        file_list_unlock();
+        spin_unlock(&tty_files_lock);
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
             tty->driver->subtype == PTY_TYPE_SLAVE &&
             tty->link && tty->link->count)
@@ -516,8 +519,7 @@ static void do_tty_hangup(struct work_struct *work)
         /* inuse_filps is protected by the single kernel lock */
         lock_kernel();
         check_tty_count(tty, "do_tty_hangup");
-
-        file_list_lock();
+        spin_lock(&tty_files_lock);
         /* This breaks for file handles being sent over AF_UNIX sockets ? */
         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
                 if (filp->f_op->write == redirected_tty_write)
@@ -528,7 +530,7 @@ static void do_tty_hangup(struct work_struct *work)
                 tty_fasync(-1, filp, 0);        /* can't block */
                 filp->f_op = &hung_up_tty_fops;
         }
-        file_list_unlock();
+        spin_unlock(&tty_files_lock);
 
         tty_ldisc_hangup(tty);
 
@@ -1419,9 +1421,9 @@ static void release_one_tty(struct work_struct *work)
         tty_driver_kref_put(driver);
         module_put(driver->owner);
 
-        file_list_lock();
+        spin_lock(&tty_files_lock);
         list_del_init(&tty->tty_files);
-        file_list_unlock();
+        spin_unlock(&tty_files_lock);
 
         put_pid(tty->pgrp);
         put_pid(tty->session);
@@ -1666,7 +1668,10 @@ int tty_release(struct inode *inode, struct file *filp)
          *  - do_tty_hangup no longer sees this file descriptor as
          *    something that needs to be handled for hangups.
          */
-        file_kill(filp);
+        spin_lock(&tty_files_lock);
+        BUG_ON(list_empty(&filp->f_u.fu_list));
+        list_del_init(&filp->f_u.fu_list);
+        spin_unlock(&tty_files_lock);
         filp->private_data = NULL;
 
         /*
@@ -1835,7 +1840,11 @@ got_driver:
         }
 
         filp->private_data = tty;
-        file_move(filp, &tty->tty_files);
+        BUG_ON(list_empty(&filp->f_u.fu_list));
+        file_sb_list_del(filp); /* __dentry_open has put it on the sb list */
+        spin_lock(&tty_files_lock);
+        list_add(&filp->f_u.fu_list, &tty->tty_files);
+        spin_unlock(&tty_files_lock);
         check_tty_count(tty, "tty_open");
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
             tty->driver->subtype == PTY_TYPE_MASTER)
diff --git a/fs/file_table.c b/fs/file_table.c
index 32d12b78bac8..ce00b6e03a06 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -32,8 +32,7 @@ struct files_stat_struct files_stat = {
         .max_files = NR_FILE
 };
 
-/* public. Not pretty! */
-__cacheline_aligned_in_smp DEFINE_SPINLOCK(files_lock);
+static __cacheline_aligned_in_smp DEFINE_SPINLOCK(files_lock);
 
 /* SLAB cache for file structures */
 static struct kmem_cache *filp_cachep __read_mostly;
@@ -258,7 +257,7 @@ void __fput(struct file *file)
                 cdev_put(inode->i_cdev);
         fops_put(file->f_op);
         put_pid(file->f_owner.pid);
-        file_kill(file);
+        file_sb_list_del(file);
         if (file->f_mode & FMODE_WRITE)
                 drop_file_write_access(file);
         file->f_path.dentry = NULL;
@@ -320,31 +319,29 @@ struct file *fget_light(unsigned int fd, int *fput_needed)
         return file;
 }
 
-
 void put_filp(struct file *file)
 {
         if (atomic_long_dec_and_test(&file->f_count)) {
                 security_file_free(file);
-                file_kill(file);
+                file_sb_list_del(file);
                 file_free(file);
         }
 }
 
-void file_move(struct file *file, struct list_head *list)
+void file_sb_list_add(struct file *file, struct super_block *sb)
 {
-        if (!list)
-                return;
-        file_list_lock();
-        list_move(&file->f_u.fu_list, list);
-        file_list_unlock();
+        spin_lock(&files_lock);
+        BUG_ON(!list_empty(&file->f_u.fu_list));
+        list_add(&file->f_u.fu_list, &sb->s_files);
+        spin_unlock(&files_lock);
 }
 
-void file_kill(struct file *file)
+void file_sb_list_del(struct file *file)
 {
         if (!list_empty(&file->f_u.fu_list)) {
-                file_list_lock();
+                spin_lock(&files_lock);
                 list_del_init(&file->f_u.fu_list);
-                file_list_unlock();
+                spin_unlock(&files_lock);
         }
 }
 
@@ -353,7 +350,7 @@ int fs_may_remount_ro(struct super_block *sb)
         struct file *file;
 
         /* Check that no files are currently opened for writing. */
-        file_list_lock();
+        spin_lock(&files_lock);
         list_for_each_entry(file, &sb->s_files, f_u.fu_list) {
                 struct inode *inode = file->f_path.dentry->d_inode;
 
@@ -365,10 +362,10 @@ int fs_may_remount_ro(struct super_block *sb)
                 if (S_ISREG(inode->i_mode) && (file->f_mode & FMODE_WRITE))
                         goto too_bad;
         }
-        file_list_unlock();
+        spin_unlock(&files_lock);
         return 1; /* Tis' cool bro. */
 too_bad:
-        file_list_unlock();
+        spin_unlock(&files_lock);
         return 0;
 }
 
@@ -384,7 +381,7 @@ void mark_files_ro(struct super_block *sb)
         struct file *f;
 
 retry:
-        file_list_lock();
+        spin_lock(&files_lock);
         list_for_each_entry(f, &sb->s_files, f_u.fu_list) {
                 struct vfsmount *mnt;
                 if (!S_ISREG(f->f_path.dentry->d_inode->i_mode))
@@ -400,16 +397,13 @@ retry:
                         continue;
                 file_release_write(f);
                 mnt = mntget(f->f_path.mnt);
-                file_list_unlock();
-                /*
-                 * This can sleep, so we can't hold
-                 * the file_list_lock() spinlock.
-                 */
+                /* This can sleep, so we can't hold the spinlock. */
+                spin_unlock(&files_lock);
                 mnt_drop_write(mnt);
                 mntput(mnt);
                 goto retry;
         }
-        file_list_unlock();
+        spin_unlock(&files_lock);
 }
 
 void __init files_init(unsigned long mempages)
diff --git a/fs/open.c b/fs/open.c
index 040cef72bc00..9f57c39c921e 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -844,7 +844,7 @@ static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
         f->f_path.mnt = mnt;
         f->f_pos = 0;
         f->f_op = fops_get(inode->i_fop);
-        file_move(f, &inode->i_sb->s_files);
+        file_sb_list_add(f, inode->i_sb);
 
         error = security_dentry_open(f, cred);
         if (error)
@@ -890,7 +890,7 @@ cleanup_all:
                         mnt_drop_write(mnt);
                 }
         }
-        file_kill(f);
+        file_sb_list_del(f);
         f->f_path.dentry = NULL;
         f->f_path.mnt = NULL;
 cleanup_file:
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 5191f49c2fec..fc515b423fae 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -948,9 +948,6 @@ struct file {
         unsigned long f_mnt_write_state;
 #endif
 };
-extern spinlock_t files_lock;
-#define file_list_lock() spin_lock(&files_lock);
-#define file_list_unlock() spin_unlock(&files_lock);
 
 #define get_file(x)     atomic_long_inc(&(x)->f_count)
 #define file_count(x)   atomic_long_read(&(x)->f_count)
@@ -2037,6 +2034,7 @@ extern const struct file_operations read_pipefifo_fops;
 extern const struct file_operations write_pipefifo_fops;
 extern const struct file_operations rdwr_pipefifo_fops;
 
+extern void mark_files_ro(struct super_block *sb);
 extern int fs_may_remount_ro(struct super_block *);
 
 #ifdef CONFIG_BLOCK
@@ -2183,8 +2181,9 @@ static inline void insert_inode_hash(struct inode *inode) {
         __insert_inode_hash(inode, inode->i_ino);
 }
 
-extern void file_move(struct file *f, struct list_head *list);
-extern void file_kill(struct file *f);
+extern struct file * get_empty_filp(void);
+extern void file_sb_list_add(struct file *f, struct super_block *sb);
+extern void file_sb_list_del(struct file *f);
 #ifdef CONFIG_BLOCK
 struct bio;
 extern void submit_bio(int, struct bio *);
diff --git a/include/linux/tty.h b/include/linux/tty.h
index 42f207676016..e5c5ba2327f1 100644
--- a/include/linux/tty.h
+++ b/include/linux/tty.h
@@ -465,6 +465,7 @@ extern struct tty_struct *tty_pair_get_tty(struct tty_struct *tty);
 extern struct tty_struct *tty_pair_get_pty(struct tty_struct *tty);
 
 extern struct mutex tty_mutex;
+extern spinlock_t tty_files_lock;
 
 extern void tty_write_unlock(struct tty_struct *tty);
 extern int tty_write_lock(struct tty_struct *tty, int ndelay);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9a2ee845e9d4..f013de205ea8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2246,7 +2246,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
 
         tty = get_current_tty();
         if (tty) {
-                file_list_lock();
+                spin_lock(&tty_files_lock);
                 if (!list_empty(&tty->tty_files)) {
                         struct inode *inode;
 
@@ -2262,7 +2262,7 @@ static inline void flush_unauthorized_files(const struct cred *cred,
                                 drop_tty = 1;
                         }
                 }
-                file_list_unlock();
+                spin_unlock(&tty_files_lock);
                 tty_kref_put(tty);
         }
         /* Reset controlling tty. */