10 files changed, 38 insertions, 34 deletions

diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 3344bdd5506e..08b886f119ce 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -201,7 +201,7 @@ void dnotify_flush(struct file *filp, fl_owner_t id)
 
         /* nothing else could have found us thanks to the dnotify_mark_mutex */
         if (dn_mark->dn == NULL)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, dnotify_group);
 
         mutex_unlock(&dnotify_mark_mutex);
 
@@ -385,7 +385,7 @@ out:
         spin_unlock(&fsn_mark->lock);
 
         if (destroy)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, dnotify_group);
 
         mutex_unlock(&dnotify_mark_mutex);
         fsnotify_put_mark(fsn_mark);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 599a01952c74..1218d10424d0 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -546,7 +546,7 @@ static int fanotify_remove_vfsmount_mark(struct fsnotify_group *group,
         removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags,
                                                  &destroy_mark);
         if (destroy_mark)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, group);
 
         fsnotify_put_mark(fsn_mark);
         if (removed & real_mount(mnt)->mnt_fsnotify_mask)
@@ -570,7 +570,7 @@ static int fanotify_remove_inode_mark(struct fsnotify_group *group,
         removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags,
                                                  &destroy_mark);
         if (destroy_mark)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, group);
         /* matches the fsnotify_find_inode_mark() */
         fsnotify_put_mark(fsn_mark);
         if (removed & inode->i_fsnotify_mask)
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 4e9071e37d5d..21230209c957 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -99,8 +99,16 @@ void fsnotify_clear_marks_by_inode(struct inode *inode)
         spin_unlock(&inode->i_lock);
 
         list_for_each_entry_safe(mark, lmark, &free_list, i.free_i_list) {
-                fsnotify_destroy_mark(mark);
+                struct fsnotify_group *group;
+
+                spin_lock(&mark->lock);
+                fsnotify_get_group(mark->group);
+                group = mark->group;
+                spin_unlock(&mark->lock);
+
+                fsnotify_destroy_mark(mark, group);
                 fsnotify_put_mark(mark);
+                fsnotify_put_group(group);
         }
 }
 
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 74977fbf5aae..871569c7d609 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -132,7 +132,7 @@ static int inotify_handle_event(struct fsnotify_group *group,
         }
 
         if (inode_mark->mask & IN_ONESHOT)
-                fsnotify_destroy_mark(inode_mark);
+                fsnotify_destroy_mark(inode_mark, group);
 
         return ret;
 }
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 246250f1db7a..00ff82ff7c9f 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -816,7 +816,7 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd)
 
         ret = 0;
 
-        fsnotify_destroy_mark(&i_mark->fsn_mark);
+        fsnotify_destroy_mark(&i_mark->fsn_mark, group);
 
         /* match ref taken by inotify_idr_find */
         fsnotify_put_mark(&i_mark->fsn_mark);
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index ab25b810b146..b77c833c8d0a 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -121,21 +121,11 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
  * The caller had better be holding a reference to this mark so we don't actually
  * do the final put under the mark->lock
  */
-void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+void fsnotify_destroy_mark(struct fsnotify_mark *mark,
+                           struct fsnotify_group *group)
 {
-        struct fsnotify_group *group;
         struct inode *inode = NULL;
 
-        spin_lock(&mark->lock);
-        /* dont get the group from a mark that is not alive yet */
-        if (!(mark->flags & FSNOTIFY_MARK_FLAG_ALIVE)) {
-                spin_unlock(&mark->lock);
-                return;
-        }
-        fsnotify_get_group(mark->group);
-        group = mark->group;
-        spin_unlock(&mark->lock);
-
         mutex_lock(&group->mark_mutex);
         spin_lock(&mark->lock);
 
@@ -143,7 +133,7 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
         if (!(mark->flags & FSNOTIFY_MARK_FLAG_ALIVE)) {
                 spin_unlock(&mark->lock);
                 mutex_unlock(&group->mark_mutex);
-                goto put_group;
+                return;
         }
 
         mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
@@ -194,9 +184,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
          */
 
         atomic_dec(&group->num_marks);
-
-put_group:
-        fsnotify_put_group(group);
 }
 
 void fsnotify_set_mark_mask_locked(struct fsnotify_mark *mark, __u32 mask)
@@ -307,7 +294,7 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
         mutex_unlock(&group->mark_mutex);
 
         list_for_each_entry_safe(mark, lmark, &free_list, free_g_list) {
-                fsnotify_destroy_mark(mark);
+                fsnotify_destroy_mark(mark, group);
                 fsnotify_put_mark(mark);
         }
 }
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index f26a348827f8..4df58b8ea64a 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -46,8 +46,16 @@ void fsnotify_clear_marks_by_mount(struct vfsmount *mnt)
         spin_unlock(&mnt->mnt_root->d_lock);
 
         list_for_each_entry_safe(mark, lmark, &free_list, m.free_m_list) {
-                fsnotify_destroy_mark(mark);
+                struct fsnotify_group *group;
+
+                spin_lock(&mark->lock);
+                fsnotify_get_group(mark->group);
+                group = mark->group;
+                spin_unlock(&mark->lock);
+
+                fsnotify_destroy_mark(mark, group);
                 fsnotify_put_mark(mark);
+                fsnotify_put_group(group);
         }
 }