10 files changed, 38 insertions, 34 deletions

diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
index 3344bdd5506e..08b886f119ce 100644
--- a/fs/notify/dnotify/dnotify.c
+++ b/fs/notify/dnotify/dnotify.c
@@ -201,7 +201,7 @@ void dnotify_flush(struct file *filp, fl_owner_t id)
 
         /* nothing else could have found us thanks to the dnotify_mark_mutex */
         if (dn_mark->dn == NULL)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, dnotify_group);
 
         mutex_unlock(&dnotify_mark_mutex);
 
@@ -385,7 +385,7 @@ out:
         spin_unlock(&fsn_mark->lock);
 
         if (destroy)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, dnotify_group);
 
         mutex_unlock(&dnotify_mark_mutex);
         fsnotify_put_mark(fsn_mark);
diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
index 599a01952c74..1218d10424d0 100644
--- a/fs/notify/fanotify/fanotify_user.c
+++ b/fs/notify/fanotify/fanotify_user.c
@@ -546,7 +546,7 @@ static int fanotify_remove_vfsmount_mark(struct fsnotify_group *group,
         removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags,
                                                  &destroy_mark);
         if (destroy_mark)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, group);
 
         fsnotify_put_mark(fsn_mark);
         if (removed & real_mount(mnt)->mnt_fsnotify_mask)
@@ -570,7 +570,7 @@ static int fanotify_remove_inode_mark(struct fsnotify_group *group,
         removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags,
                                                  &destroy_mark);
         if (destroy_mark)
-                fsnotify_destroy_mark(fsn_mark);
+                fsnotify_destroy_mark(fsn_mark, group);
         /* matches the fsnotify_find_inode_mark() */
         fsnotify_put_mark(fsn_mark);
         if (removed & inode->i_fsnotify_mask)
diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
index 4e9071e37d5d..21230209c957 100644
--- a/fs/notify/inode_mark.c
+++ b/fs/notify/inode_mark.c
@@ -99,8 +99,16 @@ void fsnotify_clear_marks_by_inode(struct inode *inode)
         spin_unlock(&inode->i_lock);
 
         list_for_each_entry_safe(mark, lmark, &free_list, i.free_i_list) {
-                fsnotify_destroy_mark(mark);
+                struct fsnotify_group *group;
+
+                spin_lock(&mark->lock);
+                fsnotify_get_group(mark->group);
+                group = mark->group;
+                spin_unlock(&mark->lock);
+
+                fsnotify_destroy_mark(mark, group);
                 fsnotify_put_mark(mark);
+                fsnotify_put_group(group);
         }
 }
 
diff --git a/fs/notify/inotify/inotify_fsnotify.c b/fs/notify/inotify/inotify_fsnotify.c
index 74977fbf5aae..871569c7d609 100644
--- a/fs/notify/inotify/inotify_fsnotify.c
+++ b/fs/notify/inotify/inotify_fsnotify.c
@@ -132,7 +132,7 @@ static int inotify_handle_event(struct fsnotify_group *group,
         }
 
         if (inode_mark->mask & IN_ONESHOT)
-                fsnotify_destroy_mark(inode_mark);
+                fsnotify_destroy_mark(inode_mark, group);
 
         return ret;
 }
diff --git a/fs/notify/inotify/inotify_user.c b/fs/notify/inotify/inotify_user.c
index 246250f1db7a..00ff82ff7c9f 100644
--- a/fs/notify/inotify/inotify_user.c
+++ b/fs/notify/inotify/inotify_user.c
@@ -816,7 +816,7 @@ SYSCALL_DEFINE2(inotify_rm_watch, int, fd, __s32, wd)
 
         ret = 0;
 
-        fsnotify_destroy_mark(&i_mark->fsn_mark);
+        fsnotify_destroy_mark(&i_mark->fsn_mark, group);
 
         /* match ref taken by inotify_idr_find */
         fsnotify_put_mark(&i_mark->fsn_mark);
diff --git a/fs/notify/mark.c b/fs/notify/mark.c
index ab25b810b146..b77c833c8d0a 100644
--- a/fs/notify/mark.c
+++ b/fs/notify/mark.c
@@ -121,21 +121,11 @@ void fsnotify_put_mark(struct fsnotify_mark *mark)
  * The caller had better be holding a reference to this mark so we don't actually
  * do the final put under the mark->lock
  */
-void fsnotify_destroy_mark(struct fsnotify_mark *mark)
+void fsnotify_destroy_mark(struct fsnotify_mark *mark,
+                           struct fsnotify_group *group)
 {
-        struct fsnotify_group *group;
         struct inode *inode = NULL;
 
-        spin_lock(&mark->lock);
-        /* dont get the group from a mark that is not alive yet */
-        if (!(mark->flags & FSNOTIFY_MARK_FLAG_ALIVE)) {
-                spin_unlock(&mark->lock);
-                return;
-        }
-        fsnotify_get_group(mark->group);
-        group = mark->group;
-        spin_unlock(&mark->lock);
-
         mutex_lock(&group->mark_mutex);
         spin_lock(&mark->lock);
 
@@ -143,7 +133,7 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
         if (!(mark->flags & FSNOTIFY_MARK_FLAG_ALIVE)) {
                 spin_unlock(&mark->lock);
                 mutex_unlock(&group->mark_mutex);
-                goto put_group;
+                return;
         }
 
         mark->flags &= ~FSNOTIFY_MARK_FLAG_ALIVE;
@@ -194,9 +184,6 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark)
          */
 
         atomic_dec(&group->num_marks);
-
-put_group:
-        fsnotify_put_group(group);
 }
 
 void fsnotify_set_mark_mask_locked(struct fsnotify_mark *mark, __u32 mask)
@@ -307,7 +294,7 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group,
         mutex_unlock(&group->mark_mutex);
 
         list_for_each_entry_safe(mark, lmark, &free_list, free_g_list) {
-                fsnotify_destroy_mark(mark);
+                fsnotify_destroy_mark(mark, group);
                 fsnotify_put_mark(mark);
         }
 }
diff --git a/fs/notify/vfsmount_mark.c b/fs/notify/vfsmount_mark.c
index f26a348827f8..4df58b8ea64a 100644
--- a/fs/notify/vfsmount_mark.c
+++ b/fs/notify/vfsmount_mark.c
@@ -46,8 +46,16 @@ void fsnotify_clear_marks_by_mount(struct vfsmount *mnt)
         spin_unlock(&mnt->mnt_root->d_lock);
 
         list_for_each_entry_safe(mark, lmark, &free_list, m.free_m_list) {
-                fsnotify_destroy_mark(mark);
+                struct fsnotify_group *group;
+
+                spin_lock(&mark->lock);
+                fsnotify_get_group(mark->group);
+                group = mark->group;
+                spin_unlock(&mark->lock);
+
+                fsnotify_destroy_mark(mark, group);
                 fsnotify_put_mark(mark);
+                fsnotify_put_group(group);
         }
 }
 
diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
index c5848346840d..140b4b8a100b 100644
--- a/include/linux/fsnotify_backend.h
+++ b/include/linux/fsnotify_backend.h
@@ -408,8 +408,9 @@ extern void fsnotify_set_mark_mask_locked(struct fsnotify_mark *mark, __u32 mask
 /* attach the mark to both the group and the inode */
 extern int fsnotify_add_mark(struct fsnotify_mark *mark, struct fsnotify_group *group,
                              struct inode *inode, struct vfsmount *mnt, int allow_dups);
-/* given a mark, flag it to be freed when all references are dropped */
-extern void fsnotify_destroy_mark(struct fsnotify_mark *mark);
+/* given a group and a mark, flag mark to be freed when all references are dropped */
+extern void fsnotify_destroy_mark(struct fsnotify_mark *mark,
+                                  struct fsnotify_group *group);
 /* run all the marks in a group, and clear all of the vfsmount marks */
 extern void fsnotify_clear_vfsmount_marks_by_group(struct fsnotify_group *group);
 /* run all the marks in a group, and clear all of the inode marks */
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index ed206fd88cca..e81175ef25f8 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -249,7 +249,7 @@ static void untag_chunk(struct node *p)
                 list_del_rcu(&chunk->hash);
                 spin_unlock(&hash_lock);
                 spin_unlock(&entry->lock);
-                fsnotify_destroy_mark(entry);
+                fsnotify_destroy_mark(entry, audit_tree_group);
                 goto out;
         }
 
@@ -291,7 +291,7 @@ static void untag_chunk(struct node *p)
                 owner->root = new;
         spin_unlock(&hash_lock);
         spin_unlock(&entry->lock);
-        fsnotify_destroy_mark(entry);
+        fsnotify_destroy_mark(entry, audit_tree_group);
         fsnotify_put_mark(&new->mark);  /* drop initial reference */
         goto out;
 
@@ -331,7 +331,7 @@ static int create_chunk(struct inode *inode, struct audit_tree *tree)
                 spin_unlock(&hash_lock);
                 chunk->dead = 1;
                 spin_unlock(&entry->lock);
-                fsnotify_destroy_mark(entry);
+                fsnotify_destroy_mark(entry, audit_tree_group);
                 fsnotify_put_mark(entry);
                 return 0;
         }
@@ -412,7 +412,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
                 spin_unlock(&chunk_entry->lock);
                 spin_unlock(&old_entry->lock);
 
-                fsnotify_destroy_mark(chunk_entry);
+                fsnotify_destroy_mark(chunk_entry, audit_tree_group);
 
                 fsnotify_put_mark(chunk_entry);
                 fsnotify_put_mark(old_entry);
@@ -443,7 +443,7 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
         spin_unlock(&hash_lock);
         spin_unlock(&chunk_entry->lock);
         spin_unlock(&old_entry->lock);
-        fsnotify_destroy_mark(old_entry);
+        fsnotify_destroy_mark(old_entry, audit_tree_group);
         fsnotify_put_mark(chunk_entry); /* drop initial reference */
         fsnotify_put_mark(old_entry); /* pair to fsnotify_find mark_entry */
         return 0;
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 3823281401b5..a66affc1c12c 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -349,7 +349,7 @@ static void audit_remove_parent_watches(struct audit_parent *parent)
         }
         mutex_unlock(&audit_filter_mutex);
 
-        fsnotify_destroy_mark(&parent->mark);
+        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
 }
 
 /* Get path information necessary for adding watches. */
@@ -456,7 +456,7 @@ void audit_remove_watch_rule(struct audit_krule *krule)
 
                 if (list_empty(&parent->watches)) {
                         audit_get_parent(parent);
-                        fsnotify_destroy_mark(&parent->mark);
+                        fsnotify_destroy_mark(&parent->mark, audit_watch_group);
                         audit_put_parent(parent);
                 }
         }