5 files changed, 92 insertions, 68 deletions

diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
index 54f923792728..475f9c597cb7 100644
--- a/fs/autofs4/autofs_i.h
+++ b/fs/autofs4/autofs_i.h
@@ -61,8 +61,6 @@ do {							\
                 current->pid, __func__, ##args);        \
 } while (0)
 
-extern spinlock_t autofs4_lock;
-
 /* Unified info structure.  This is pointed to by both the dentry and
    inode structures.  Each file in the filesystem has an instance of this
    structure.  It holds a reference to the dentry, so dentries are never
diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c
index 1442da4860e5..509fe1eb66ae 100644
--- a/fs/autofs4/dev-ioctl.c
+++ b/fs/autofs4/dev-ioctl.c
@@ -372,6 +372,10 @@ static int autofs_dev_ioctl_setpipefd(struct file *fp,
                 return -EBUSY;
         } else {
                 struct file *pipe = fget(pipefd);
+                if (!pipe) {
+                        err = -EBADF;
+                        goto out;
+                }
                 if (!pipe->f_op || !pipe->f_op->write) {
                         err = -EPIPE;
                         fput(pipe);
diff --git a/fs/autofs4/expire.c b/fs/autofs4/expire.c
index f43100b9662b..450f529a4eae 100644
--- a/fs/autofs4/expire.c
+++ b/fs/autofs4/expire.c
@@ -87,18 +87,70 @@ done:
 }
 
 /*
+ * Calculate and dget next entry in the subdirs list under root.
+ */
+static struct dentry *get_next_positive_subdir(struct dentry *prev,
+                                                struct dentry *root)
+{
+        struct autofs_sb_info *sbi = autofs4_sbi(root->d_sb);
+        struct list_head *next;
+        struct dentry *p, *q;
+
+        spin_lock(&sbi->lookup_lock);
+
+        if (prev == NULL) {
+                spin_lock(&root->d_lock);
+                prev = dget_dlock(root);
+                next = prev->d_subdirs.next;
+                p = prev;
+                goto start;
+        }
+
+        p = prev;
+        spin_lock(&p->d_lock);
+again:
+        next = p->d_u.d_child.next;
+start:
+        if (next == &root->d_subdirs) {
+                spin_unlock(&p->d_lock);
+                spin_unlock(&sbi->lookup_lock);
+                dput(prev);
+                return NULL;
+        }
+
+        q = list_entry(next, struct dentry, d_u.d_child);
+
+        spin_lock_nested(&q->d_lock, DENTRY_D_LOCK_NESTED);
+        /* Negative dentry - try next */
+        if (!simple_positive(q)) {
+                spin_unlock(&p->d_lock);
+                p = q;
+                goto again;
+        }
+        dget_dlock(q);
+        spin_unlock(&q->d_lock);
+        spin_unlock(&p->d_lock);
+        spin_unlock(&sbi->lookup_lock);
+
+        dput(prev);
+
+        return q;
+}
+
+/*
  * Calculate and dget next entry in top down tree traversal.
  */
 static struct dentry *get_next_positive_dentry(struct dentry *prev,
                                                 struct dentry *root)
 {
+        struct autofs_sb_info *sbi = autofs4_sbi(root->d_sb);
         struct list_head *next;
         struct dentry *p, *ret;
 
         if (prev == NULL)
                 return dget(root);
 
-        spin_lock(&autofs4_lock);
+        spin_lock(&sbi->lookup_lock);
 relock:
         p = prev;
         spin_lock(&p->d_lock);
@@ -110,7 +162,7 @@ again:
 
                         if (p == root) {
                                 spin_unlock(&p->d_lock);
-                                spin_unlock(&autofs4_lock);
+                                spin_unlock(&sbi->lookup_lock);
                                 dput(prev);
                                 return NULL;
                         }
@@ -140,7 +192,7 @@ again:
         dget_dlock(ret);
         spin_unlock(&ret->d_lock);
         spin_unlock(&p->d_lock);
-        spin_unlock(&autofs4_lock);
+        spin_unlock(&sbi->lookup_lock);
 
         dput(prev);
 
@@ -290,11 +342,8 @@ struct dentry *autofs4_expire_direct(struct super_block *sb,
         spin_lock(&sbi->fs_lock);
         ino = autofs4_dentry_ino(root);
         /* No point expiring a pending mount */
-        if (ino->flags & AUTOFS_INF_PENDING) {
-                spin_unlock(&sbi->fs_lock);
-                return NULL;
-        }
-        managed_dentry_set_transit(root);
+        if (ino->flags & AUTOFS_INF_PENDING)
+                goto out;
         if (!autofs4_direct_busy(mnt, root, timeout, do_now)) {
                 struct autofs_info *ino = autofs4_dentry_ino(root);
                 ino->flags |= AUTOFS_INF_EXPIRING;
@@ -302,7 +351,7 @@ struct dentry *autofs4_expire_direct(struct super_block *sb,
                 spin_unlock(&sbi->fs_lock);
                 return root;
         }
-        managed_dentry_clear_transit(root);
+out:
         spin_unlock(&sbi->fs_lock);
         dput(root);
 
@@ -336,13 +385,12 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
         timeout = sbi->exp_timeout;
 
         dentry = NULL;
-        while ((dentry = get_next_positive_dentry(dentry, root))) {
+        while ((dentry = get_next_positive_subdir(dentry, root))) {
                 spin_lock(&sbi->fs_lock);
                 ino = autofs4_dentry_ino(dentry);
                 /* No point expiring a pending mount */
                 if (ino->flags & AUTOFS_INF_PENDING)
-                        goto cont;
-                managed_dentry_set_transit(dentry);
+                        goto next;
 
                 /*
                  * Case 1: (i) indirect mount or top level pseudo direct mount
@@ -402,8 +450,6 @@ struct dentry *autofs4_expire_indirect(struct super_block *sb,
                         }
                 }
 next:
-                managed_dentry_clear_transit(dentry);
-cont:
                 spin_unlock(&sbi->fs_lock);
         }
         return NULL;
@@ -415,13 +461,13 @@ found:
         ino->flags |= AUTOFS_INF_EXPIRING;
         init_completion(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
-        spin_lock(&autofs4_lock);
+        spin_lock(&sbi->lookup_lock);
         spin_lock(&expired->d_parent->d_lock);
         spin_lock_nested(&expired->d_lock, DENTRY_D_LOCK_NESTED);
         list_move(&expired->d_parent->d_subdirs, &expired->d_u.d_child);
         spin_unlock(&expired->d_lock);
         spin_unlock(&expired->d_parent->d_lock);
-        spin_unlock(&autofs4_lock);
+        spin_unlock(&sbi->lookup_lock);
         return expired;
 }
 
@@ -484,8 +530,6 @@ int autofs4_expire_run(struct super_block *sb,
         spin_lock(&sbi->fs_lock);
         ino = autofs4_dentry_ino(dentry);
         ino->flags &= ~AUTOFS_INF_EXPIRING;
-        if (!d_unhashed(dentry))
-                managed_dentry_clear_transit(dentry);
         complete_all(&ino->expire_complete);
         spin_unlock(&sbi->fs_lock);
 
@@ -513,9 +557,7 @@ int autofs4_do_expire_multi(struct super_block *sb, struct vfsmount *mnt,
                 spin_lock(&sbi->fs_lock);
                 ino->flags &= ~AUTOFS_INF_EXPIRING;
                 spin_lock(&dentry->d_lock);
-                if (ret)
-                        __managed_dentry_clear_transit(dentry);
-                else {
+                if (!ret) {
                         if ((IS_ROOT(dentry) ||
                             (autofs_type_indirect(sbi->type) &&
                              IS_ROOT(dentry->d_parent))) &&
diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c
index e6f84d26f4cf..f55ae23b137e 100644
--- a/fs/autofs4/root.c
+++ b/fs/autofs4/root.c
@@ -23,8 +23,6 @@
 
 #include "autofs_i.h"
 
-DEFINE_SPINLOCK(autofs4_lock);
-
 static int autofs4_dir_symlink(struct inode *,struct dentry *,const char *);
 static int autofs4_dir_unlink(struct inode *,struct dentry *);
 static int autofs4_dir_rmdir(struct inode *,struct dentry *);
@@ -125,15 +123,15 @@ static int autofs4_dir_open(struct inode *inode, struct file *file)
          * autofs file system so just let the libfs routines handle
          * it.
          */
-        spin_lock(&autofs4_lock);
+        spin_lock(&sbi->lookup_lock);
         spin_lock(&dentry->d_lock);
         if (!d_mountpoint(dentry) && list_empty(&dentry->d_subdirs)) {
                 spin_unlock(&dentry->d_lock);
-                spin_unlock(&autofs4_lock);
+                spin_unlock(&sbi->lookup_lock);
                 return -ENOENT;
         }
         spin_unlock(&dentry->d_lock);
-        spin_unlock(&autofs4_lock);
+        spin_unlock(&sbi->lookup_lock);
 
 out:
         return dcache_dir_open(inode, file);
@@ -171,7 +169,6 @@ static struct dentry *autofs4_lookup_active(struct dentry *dentry)
         const unsigned char *str = name->name;
         struct list_head *p, *head;
 
-        spin_lock(&autofs4_lock);
         spin_lock(&sbi->lookup_lock);
         head = &sbi->active_list;
         list_for_each(p, head) {
@@ -204,14 +201,12 @@ static struct dentry *autofs4_lookup_active(struct dentry *dentry)
                         dget_dlock(active);
                         spin_unlock(&active->d_lock);
                         spin_unlock(&sbi->lookup_lock);
-                        spin_unlock(&autofs4_lock);
                         return active;
                 }
 next:
                 spin_unlock(&active->d_lock);
         }
         spin_unlock(&sbi->lookup_lock);
-        spin_unlock(&autofs4_lock);
 
         return NULL;
 }
@@ -226,7 +221,6 @@ static struct dentry *autofs4_lookup_expiring(struct dentry *dentry)
         const unsigned char *str = name->name;
         struct list_head *p, *head;
 
-        spin_lock(&autofs4_lock);
         spin_lock(&sbi->lookup_lock);
         head = &sbi->expiring_list;
         list_for_each(p, head) {
@@ -259,14 +253,12 @@ static struct dentry *autofs4_lookup_expiring(struct dentry *dentry)
                         dget_dlock(expiring);
                         spin_unlock(&expiring->d_lock);
                         spin_unlock(&sbi->lookup_lock);
-                        spin_unlock(&autofs4_lock);
                         return expiring;
                 }
 next:
                 spin_unlock(&expiring->d_lock);
         }
         spin_unlock(&sbi->lookup_lock);
-        spin_unlock(&autofs4_lock);
 
         return NULL;
 }
@@ -275,17 +267,16 @@ static int autofs4_mount_wait(struct dentry *dentry)
 {
         struct autofs_sb_info *sbi = autofs4_sbi(dentry->d_sb);
         struct autofs_info *ino = autofs4_dentry_ino(dentry);
-        int status;
+        int status = 0;
 
         if (ino->flags & AUTOFS_INF_PENDING) {
                 DPRINTK("waiting for mount name=%.*s",
                         dentry->d_name.len, dentry->d_name.name);
                 status = autofs4_wait(sbi, dentry, NFY_MOUNT);
                 DPRINTK("mount wait done status=%d", status);
-                ino->last_used = jiffies;
-                return status;
         }
-        return 0;
+        ino->last_used = jiffies;
+        return status;
 }
 
 static int do_expire_wait(struct dentry *dentry)
@@ -319,9 +310,12 @@ static struct dentry *autofs4_mountpoint_changed(struct path *path)
          */
         if (autofs_type_indirect(sbi->type) && d_unhashed(dentry)) {
                 struct dentry *parent = dentry->d_parent;
+                struct autofs_info *ino;
                 struct dentry *new = d_lookup(parent, &dentry->d_name);
                 if (!new)
                         return NULL;
+                ino = autofs4_dentry_ino(new);
+                ino->last_used = jiffies;
                 dput(path->dentry);
                 path->dentry = new;
         }
@@ -338,18 +332,6 @@ static struct vfsmount *autofs4_d_automount(struct path *path)
         DPRINTK("dentry=%p %.*s",
                 dentry, dentry->d_name.len, dentry->d_name.name);
 
-        /*
-         * Someone may have manually umounted this or it was a submount
-         * that has gone away.
-         */
-        spin_lock(&dentry->d_lock);
-        if (!d_mountpoint(dentry) && list_empty(&dentry->d_subdirs)) {
-                if (!(dentry->d_flags & DCACHE_MANAGE_TRANSIT) &&
-                     (dentry->d_flags & DCACHE_NEED_AUTOMOUNT))
-                        __managed_dentry_set_transit(path->dentry);
-        }
-        spin_unlock(&dentry->d_lock);
-
         /* The daemon never triggers a mount. */
         if (autofs4_oz_mode(sbi))
                 return NULL;
@@ -418,18 +400,17 @@ static struct vfsmount *autofs4_d_automount(struct path *path)
 done:
         if (!(ino->flags & AUTOFS_INF_EXPIRING)) {
                 /*
-                 * Any needed mounting has been completed and the path updated
-                 * so turn this into a normal dentry so we don't continually
-                 * call ->d_automount() and ->d_manage().
-                 */
-                spin_lock(&dentry->d_lock);
-                __managed_dentry_clear_transit(dentry);
-                /*
+                 * Any needed mounting has been completed and the path
+                 * updated so clear DCACHE_NEED_AUTOMOUNT so we don't
+                 * call ->d_automount() on rootless multi-mounts since
+                 * it can lead to an incorrect ELOOP error return.
+                 *
                  * Only clear DMANAGED_AUTOMOUNT for rootless multi-mounts and
                  * symlinks as in all other cases the dentry will be covered by
                  * an actual mount so ->d_automount() won't be called during
                  * the follow.
                  */
+                spin_lock(&dentry->d_lock);
                 if ((!d_mountpoint(dentry) &&
                     !list_empty(&dentry->d_subdirs)) ||
                     (dentry->d_inode && S_ISLNK(dentry->d_inode->i_mode)))
@@ -455,6 +436,8 @@ int autofs4_d_manage(struct dentry *dentry, bool rcu_walk)
 
         /* The daemon never waits. */
         if (autofs4_oz_mode(sbi)) {
+                if (rcu_walk)
+                        return 0;
                 if (!d_mountpoint(dentry))
                         return -EISDIR;
                 return 0;
@@ -612,12 +595,12 @@ static int autofs4_dir_unlink(struct inode *dir, struct dentry *dentry)
 
         dir->i_mtime = CURRENT_TIME;
 
-        spin_lock(&autofs4_lock);
-        autofs4_add_expiring(dentry);
+        spin_lock(&sbi->lookup_lock);
+        __autofs4_add_expiring(dentry);
         spin_lock(&dentry->d_lock);
         __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
-        spin_unlock(&autofs4_lock);
+        spin_unlock(&sbi->lookup_lock);
 
         return 0;
 }
@@ -629,7 +612,7 @@ static int autofs4_dir_unlink(struct inode *dir, struct dentry *dentry)
  * set the DMANAGED_AUTOMOUNT and DMANAGED_TRANSIT flags on the leaves
  * of the directory tree. There is no need to clear the automount flag
  * following a mount or restore it after an expire because these mounts
- * are always covered. However, it is neccessary to ensure that these
+ * are always covered. However, it is necessary to ensure that these
  * flags are clear on non-empty directories to avoid unnecessary calls
  * during path walks.
  */
@@ -686,20 +669,17 @@ static int autofs4_dir_rmdir(struct inode *dir, struct dentry *dentry)
         if (!autofs4_oz_mode(sbi))
                 return -EACCES;
 
-        spin_lock(&autofs4_lock);
         spin_lock(&sbi->lookup_lock);
         spin_lock(&dentry->d_lock);
         if (!list_empty(&dentry->d_subdirs)) {
                 spin_unlock(&dentry->d_lock);
                 spin_unlock(&sbi->lookup_lock);
-                spin_unlock(&autofs4_lock);
                 return -ENOTEMPTY;
         }
         __autofs4_add_expiring(dentry);
-        spin_unlock(&sbi->lookup_lock);
         __d_drop(dentry);
         spin_unlock(&dentry->d_lock);
-        spin_unlock(&autofs4_lock);
+        spin_unlock(&sbi->lookup_lock);
 
         if (sbi->version < 5)
                 autofs_clear_leaf_automount_flags(dentry);
diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c
index 56010056b2e6..25435987d6ae 100644
--- a/fs/autofs4/waitq.c
+++ b/fs/autofs4/waitq.c
@@ -197,12 +197,12 @@ rename_retry:
 
         seq = read_seqbegin(&rename_lock);
         rcu_read_lock();
-        spin_lock(&autofs4_lock);
+        spin_lock(&sbi->fs_lock);
         for (tmp = dentry ; tmp != root ; tmp = tmp->d_parent)
                 len += tmp->d_name.len + 1;
 
         if (!len || --len > NAME_MAX) {
-                spin_unlock(&autofs4_lock);
+                spin_unlock(&sbi->fs_lock);
                 rcu_read_unlock();
                 if (read_seqretry(&rename_lock, seq))
                         goto rename_retry;
@@ -218,7 +218,7 @@ rename_retry:
                 p -= tmp->d_name.len;
                 strncpy(p, tmp->d_name.name, tmp->d_name.len);
         }
-        spin_unlock(&autofs4_lock);
+        spin_unlock(&sbi->fs_lock);
         rcu_read_unlock();
         if (read_seqretry(&rename_lock, seq))
                 goto rename_retry;