1 files changed, 104 insertions, 60 deletions

diff --git a/fs/locks.c b/fs/locks.c
index 89d898bce166..ce302d43822b 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -153,27 +153,37 @@ int lease_break_time = 45;
 #define for_each_lock(inode, lockp) \
         for (lockp = &inode->i_flock; *lockp != NULL; lockp = &(*lockp)->fl_next)
 
-/* The global file_lock_list is only used for displaying /proc/locks. */
+/*
+ * The global file_lock_list is only used for displaying /proc/locks. Protected
+ * by the file_lock_lock.
+ */
 static LIST_HEAD(file_lock_list);
 
-/* The blocked_list is used to find POSIX lock loops for deadlock detection. */
+/*
+ * The blocked_list is used to find POSIX lock loops for deadlock detection.
+ * Protected by file_lock_lock.
+ */
 static LIST_HEAD(blocked_list);
 
-/* Protects the two list heads above, plus the inode->i_flock list */
+/*
+ * This lock protects the blocked_list, and the file_lock_list. Generally, if
+ * you're accessing one of those lists, you want to be holding this lock.
+ *
+ * In addition, it also protects the fl->fl_block list, and the fl->fl_next
+ * pointer for file_lock structures that are acting as lock requests (in
+ * contrast to those that are acting as records of acquired locks).
+ *
+ * Note that when we acquire this lock in order to change the above fields,
+ * we often hold the i_lock as well. In certain cases, when reading the fields
+ * protected by this lock, we can skip acquiring it iff we already hold the
+ * i_lock.
+ *
+ * In particular, adding an entry to the fl_block list requires that you hold
+ * both the i_lock and the blocked_lock_lock (acquired in that order). Deleting
+ * an entry from the list however only requires the file_lock_lock.
+ */
 static DEFINE_SPINLOCK(file_lock_lock);
 
-void lock_flocks(void)
-{
-        spin_lock(&file_lock_lock);
-}
-EXPORT_SYMBOL_GPL(lock_flocks);
-
-void unlock_flocks(void)
-{
-        spin_unlock(&file_lock_lock);
-}
-EXPORT_SYMBOL_GPL(unlock_flocks);
-
 static struct kmem_cache *filelock_cache __read_mostly;
 
 static void locks_init_lock_heads(struct file_lock *fl)
@@ -489,13 +499,17 @@ static int posix_same_owner(struct file_lock *fl1, struct file_lock *fl2)
 static inline void
 locks_insert_global_locks(struct file_lock *fl)
 {
+        spin_lock(&file_lock_lock);
         list_add_tail(&fl->fl_link, &file_lock_list);
+        spin_unlock(&file_lock_lock);
 }
 
 static inline void
 locks_delete_global_locks(struct file_lock *fl)
 {
+        spin_lock(&file_lock_lock);
         list_del_init(&fl->fl_link);
+        spin_unlock(&file_lock_lock);
 }
 
 static inline void
@@ -512,6 +526,8 @@ locks_delete_global_blocked(struct file_lock *waiter)
 
 /* Remove waiter from blocker's block list.
  * When blocker ends up pointing to itself then the list is empty.
+ *
+ * Must be called with file_lock_lock held.
  */
 static void __locks_delete_block(struct file_lock *waiter)
 {
@@ -520,37 +536,47 @@ static void __locks_delete_block(struct file_lock *waiter)
         waiter->fl_next = NULL;
 }
 
-/*
- */
 static void locks_delete_block(struct file_lock *waiter)
 {
-        lock_flocks();
+        spin_lock(&file_lock_lock);
         __locks_delete_block(waiter);
-        unlock_flocks();
+        spin_unlock(&file_lock_lock);
 }
 
 /* Insert waiter into blocker's block list.
  * We use a circular list so that processes can be easily woken up in
  * the order they blocked. The documentation doesn't require this but
  * it seems like the reasonable thing to do.
+ *
+ * Must be called with file_lock_lock held!
  */
-static void locks_insert_block(struct file_lock *blocker, 
-                               struct file_lock *waiter)
+static void __locks_insert_block(struct file_lock *blocker,
+                                        struct file_lock *waiter)
 {
         BUG_ON(!list_empty(&waiter->fl_block));
         waiter->fl_next = blocker;
         list_add_tail(&waiter->fl_block, &blocker->fl_block);
         if (IS_POSIX(blocker))
-                locks_insert_global_blocked(request);
+                locks_insert_global_blocked(waiter);
+}
+
+/* Must be called with i_lock held. */
+static void locks_insert_block(struct file_lock *blocker,
+                                        struct file_lock *waiter)
+{
+        spin_lock(&file_lock_lock);
+        __locks_insert_block(blocker, waiter);
+        spin_unlock(&file_lock_lock);
 }
 
 /*
  * Wake up processes blocked waiting for blocker.
  *
- * Must be called with the file_lock_lock held!
+ * Must be called with the inode->i_lock held!
  */
 static void locks_wake_up_blocks(struct file_lock *blocker)
 {
+        spin_lock(&file_lock_lock);
         while (!list_empty(&blocker->fl_block)) {
                 struct file_lock *waiter;
 
@@ -562,10 +588,13 @@ static void locks_wake_up_blocks(struct file_lock *blocker)
                 else
                         wake_up(&waiter->fl_wait);
         }
+        spin_unlock(&file_lock_lock);
 }
 
 /* Insert file lock fl into an inode's lock list at the position indicated
  * by pos. At the same time add the lock to the global file lock list.
+ *
+ * Must be called with the i_lock held!
  */
 static void locks_insert_lock(struct file_lock **pos, struct file_lock *fl)
 {
@@ -583,6 +612,8 @@ static void locks_insert_lock(struct file_lock **pos, struct file_lock *fl)
  * Wake up processes that are blocked waiting for this lock,
  * notify the FS that the lock has been cleared and
  * finally free the lock.
+ *
+ * Must be called with the i_lock held!
  */
 static void locks_delete_lock(struct file_lock **thisfl_p)
 {
@@ -652,8 +683,9 @@ void
 posix_test_lock(struct file *filp, struct file_lock *fl)
 {
         struct file_lock *cfl;
+        struct inode *inode = file_inode(filp);
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         for (cfl = file_inode(filp)->i_flock; cfl; cfl = cfl->fl_next) {
                 if (!IS_POSIX(cfl))
                         continue;
@@ -666,7 +698,7 @@ posix_test_lock(struct file *filp, struct file_lock *fl)
                         fl->fl_pid = pid_vnr(cfl->fl_nspid);
         } else
                 fl->fl_type = F_UNLCK;
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         return;
 }
 EXPORT_SYMBOL(posix_test_lock);
@@ -710,6 +742,7 @@ static struct file_lock *what_owner_is_waiting_for(struct file_lock *block_fl)
         return NULL;
 }
 
+/* Must be called with the file_lock_lock held! */
 static int posix_locks_deadlock(struct file_lock *caller_fl,
                                 struct file_lock *block_fl)
 {
@@ -745,7 +778,7 @@ static int flock_lock_file(struct file *filp, struct file_lock *request)
                         return -ENOMEM;
         }
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         if (request->fl_flags & FL_ACCESS)
                 goto find_conflict;
 
@@ -775,9 +808,9 @@ static int flock_lock_file(struct file *filp, struct file_lock *request)
          * give it the opportunity to lock the file.
          */
         if (found) {
-                unlock_flocks();
+                spin_unlock(&inode->i_lock);
                 cond_resched();
-                lock_flocks();
+                spin_lock(&inode->i_lock);
         }
 
 find_conflict:
@@ -804,7 +837,7 @@ find_conflict:
         error = 0;
 
 out:
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         if (new_fl)
                 locks_free_lock(new_fl);
         return error;
@@ -834,7 +867,7 @@ static int __posix_lock_file(struct inode *inode, struct file_lock *request, str
                 new_fl2 = locks_alloc_lock();
         }
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         /*
          * New lock request. Walk all POSIX locks and look for conflicts. If
          * there are any, either return error or put the request on the
@@ -852,11 +885,17 @@ static int __posix_lock_file(struct inode *inode, struct file_lock *request, str
                         error = -EAGAIN;
                         if (!(request->fl_flags & FL_SLEEP))
                                 goto out;
+                        /*
+                         * Deadlock detection and insertion into the blocked
+                         * locks list must be done while holding the same lock!
+                         */
                         error = -EDEADLK;
-                        if (posix_locks_deadlock(request, fl))
-                                goto out;
-                        error = FILE_LOCK_DEFERRED;
-                        locks_insert_block(fl, request);
+                        spin_lock(&file_lock_lock);
+                        if (likely(!posix_locks_deadlock(request, fl))) {
+                                error = FILE_LOCK_DEFERRED;
+                                __locks_insert_block(fl, request);
+                        }
+                        spin_unlock(&file_lock_lock);
                         goto out;
                 }
         }
@@ -1006,7 +1045,7 @@ static int __posix_lock_file(struct inode *inode, struct file_lock *request, str
                 locks_wake_up_blocks(left);
         }
  out:
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         /*
          * Free any unused locks.
          */
@@ -1081,14 +1120,14 @@ int locks_mandatory_locked(struct inode *inode)
         /*
          * Search the lock list for this inode for any POSIX locks.
          */
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         for (fl = inode->i_flock; fl != NULL; fl = fl->fl_next) {
                 if (!IS_POSIX(fl))
                         continue;
                 if (fl->fl_owner != owner)
                         break;
         }
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         return fl ? -EAGAIN : 0;
 }
 
@@ -1231,7 +1270,7 @@ int __break_lease(struct inode *inode, unsigned int mode)
         if (IS_ERR(new_fl))
                 return PTR_ERR(new_fl);
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
 
         time_out_leases(inode);
 
@@ -1281,11 +1320,11 @@ restart:
                         break_time++;
         }
         locks_insert_block(flock, new_fl);
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         error = wait_event_interruptible_timeout(new_fl->fl_wait,
                                                 !new_fl->fl_next, break_time);
-        lock_flocks();
-        __locks_delete_block(new_fl);
+        spin_lock(&inode->i_lock);
+        locks_delete_block(new_fl);
         if (error >= 0) {
                 if (error == 0)
                         time_out_leases(inode);
@@ -1302,7 +1341,7 @@ restart:
         }
 
 out:
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         locks_free_lock(new_fl);
         return error;
 }
@@ -1355,9 +1394,10 @@ EXPORT_SYMBOL(lease_get_mtime);
 int fcntl_getlease(struct file *filp)
 {
         struct file_lock *fl;
+        struct inode *inode = file_inode(filp);
         int type = F_UNLCK;
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         time_out_leases(file_inode(filp));
         for (fl = file_inode(filp)->i_flock; fl && IS_LEASE(fl);
                         fl = fl->fl_next) {
@@ -1366,7 +1406,7 @@ int fcntl_getlease(struct file *filp)
                         break;
                 }
         }
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         return type;
 }
 
@@ -1460,7 +1500,7 @@ static int generic_delete_lease(struct file *filp, struct file_lock **flp)
  *      The (input) flp->fl_lmops->lm_break function is required
  *      by break_lease().
  *
- *      Called with file_lock_lock held.
+ *      Called with inode->i_lock held.
  */
 int generic_setlease(struct file *filp, long arg, struct file_lock **flp)
 {
@@ -1529,11 +1569,12 @@ static int __vfs_setlease(struct file *filp, long arg, struct file_lock **lease)
 
 int vfs_setlease(struct file *filp, long arg, struct file_lock **lease)
 {
+        struct inode *inode = file_inode(filp);
         int error;
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         error = __vfs_setlease(filp, arg, lease);
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
 
         return error;
 }
@@ -1551,6 +1592,7 @@ static int do_fcntl_delete_lease(struct file *filp)
 static int do_fcntl_add_lease(unsigned int fd, struct file *filp, long arg)
 {
         struct file_lock *fl, *ret;
+        struct inode *inode = file_inode(filp);
         struct fasync_struct *new;
         int error;
 
@@ -1564,10 +1606,10 @@ static int do_fcntl_add_lease(unsigned int fd, struct file *filp, long arg)
                 return -ENOMEM;
         }
         ret = fl;
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         error = __vfs_setlease(filp, arg, &ret);
         if (error) {
-                unlock_flocks();
+                spin_unlock(&inode->i_lock);
                 locks_free_lock(fl);
                 goto out_free_fasync;
         }
@@ -1584,7 +1626,7 @@ static int do_fcntl_add_lease(unsigned int fd, struct file *filp, long arg)
                 new = NULL;
 
         error = __f_setown(filp, task_pid(current), PIDTYPE_PID, 0);
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
 
 out_free_fasync:
         if (new)
@@ -2108,7 +2150,7 @@ void locks_remove_flock(struct file *filp)
                         fl.fl_ops->fl_release_private(&fl);
         }
 
-        lock_flocks();
+        spin_lock(&inode->i_lock);
         before = &inode->i_flock;
 
         while ((fl = *before) != NULL) {
@@ -2126,7 +2168,7 @@ void locks_remove_flock(struct file *filp)
                 }
                 before = &fl->fl_next;
         }
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
 }
 
 /**
@@ -2140,12 +2182,12 @@ posix_unblock_lock(struct file_lock *waiter)
 {
         int status = 0;
 
-        lock_flocks();
+        spin_lock(&file_lock_lock);
         if (waiter->fl_next)
                 __locks_delete_block(waiter);
         else
                 status = -ENOENT;
-        unlock_flocks();
+        spin_unlock(&file_lock_lock);
         return status;
 }
 EXPORT_SYMBOL(posix_unblock_lock);
@@ -2259,7 +2301,7 @@ static void *locks_start(struct seq_file *f, loff_t *pos)
 {
         loff_t *p = f->private;
 
-        lock_flocks();
+        spin_lock(&file_lock_lock);
         *p = (*pos + 1);
         return seq_list_start(&file_lock_list, *pos);
 }
@@ -2273,7 +2315,7 @@ static void *locks_next(struct seq_file *f, void *v, loff_t *pos)
 
 static void locks_stop(struct seq_file *f, void *v)
 {
-        unlock_flocks();
+        spin_unlock(&file_lock_lock);
 }
 
 static const struct seq_operations locks_seq_operations = {
@@ -2320,7 +2362,8 @@ int lock_may_read(struct inode *inode, loff_t start, unsigned long len)
 {
         struct file_lock *fl;
         int result = 1;
-        lock_flocks();
+
+        spin_lock(&inode->i_lock);
         for (fl = inode->i_flock; fl != NULL; fl = fl->fl_next) {
                 if (IS_POSIX(fl)) {
                         if (fl->fl_type == F_RDLCK)
@@ -2337,7 +2380,7 @@ int lock_may_read(struct inode *inode, loff_t start, unsigned long len)
                 result = 0;
                 break;
         }
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         return result;
 }
 
@@ -2360,7 +2403,8 @@ int lock_may_write(struct inode *inode, loff_t start, unsigned long len)
 {
         struct file_lock *fl;
         int result = 1;
-        lock_flocks();
+
+        spin_lock(&inode->i_lock);
         for (fl = inode->i_flock; fl != NULL; fl = fl->fl_next) {
                 if (IS_POSIX(fl)) {
                         if ((fl->fl_end < start) || (fl->fl_start > (start + len)))
@@ -2375,7 +2419,7 @@ int lock_may_write(struct inode *inode, loff_t start, unsigned long len)
                 result = 0;
                 break;
         }
-        unlock_flocks();
+        spin_unlock(&inode->i_lock);
         return result;
 }