1 files changed, 74 insertions, 68 deletions

diff --git a/fs/namespace.c b/fs/namespace.c
index 208c079e9fdb..2fa9fdf7d6f5 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -40,7 +40,7 @@ static inline int sysfs_init(void)
  __cacheline_aligned_in_smp DEFINE_SPINLOCK(vfsmount_lock);
 
 static struct list_head *mount_hashtable;
-static int hash_mask, hash_bits;
+static int hash_mask __read_mostly, hash_bits __read_mostly;
 static kmem_cache_t *mnt_cache; 
 
 static inline unsigned long hash(struct vfsmount *mnt, struct dentry *dentry)
@@ -61,7 +61,7 @@ struct vfsmount *alloc_vfsmnt(const char *name)
                 INIT_LIST_HEAD(&mnt->mnt_child);
                 INIT_LIST_HEAD(&mnt->mnt_mounts);
                 INIT_LIST_HEAD(&mnt->mnt_list);
-                INIT_LIST_HEAD(&mnt->mnt_fslink);
+                INIT_LIST_HEAD(&mnt->mnt_expire);
                 if (name) {
                         int size = strlen(name)+1;
                         char *newname = kmalloc(size, GFP_KERNEL);
@@ -160,13 +160,13 @@ clone_mnt(struct vfsmount *old, struct dentry *root)
                 mnt->mnt_root = dget(root);
                 mnt->mnt_mountpoint = mnt->mnt_root;
                 mnt->mnt_parent = mnt;
-                mnt->mnt_namespace = old->mnt_namespace;
+                mnt->mnt_namespace = current->namespace;
 
                 /* stick the duplicate mount on the same expiry list
                  * as the original if that was on one */
                 spin_lock(&vfsmount_lock);
-                if (!list_empty(&old->mnt_fslink))
-                        list_add(&mnt->mnt_fslink, &old->mnt_fslink);
+                if (!list_empty(&old->mnt_expire))
+                        list_add(&mnt->mnt_expire, &old->mnt_expire);
                 spin_unlock(&vfsmount_lock);
         }
         return mnt;
@@ -345,12 +345,13 @@ static void umount_tree(struct vfsmount *mnt)
         for (p = mnt; p; p = next_mnt(p, mnt)) {
                 list_del(&p->mnt_list);
                 list_add(&p->mnt_list, &kill);
+                p->mnt_namespace = NULL;
         }
 
         while (!list_empty(&kill)) {
                 mnt = list_entry(kill.next, struct vfsmount, mnt_list);
                 list_del_init(&mnt->mnt_list);
-                list_del_init(&mnt->mnt_fslink);
+                list_del_init(&mnt->mnt_expire);
                 if (mnt->mnt_parent == mnt) {
                         spin_unlock(&vfsmount_lock);
                 } else {
@@ -536,7 +537,6 @@ lives_below_in_same_fs(struct dentry *d, struct dentry *dentry)
 static struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry)
 {
         struct vfsmount *res, *p, *q, *r, *s;
-        struct list_head *h;
         struct nameidata nd;
 
         res = q = clone_mnt(mnt, dentry);
@@ -545,8 +545,7 @@ static struct vfsmount *copy_tree(struct vfsmount *mnt, struct dentry *dentry)
         q->mnt_mountpoint = mnt->mnt_mountpoint;
 
         p = mnt;
-        for (h = mnt->mnt_mounts.next; h != &mnt->mnt_mounts; h = h->next) {
-                r = list_entry(h, struct vfsmount, mnt_child);
+        list_for_each_entry(r, &mnt->mnt_mounts, mnt_child) {
                 if (!lives_below_in_same_fs(r->mnt_mountpoint, dentry))
                         continue;
 
@@ -644,7 +643,7 @@ static int do_loopback(struct nameidata *nd, char *old_name, int recurse)
         if (mnt) {
                 /* stop bind mounts from expiring */
                 spin_lock(&vfsmount_lock);
-                list_del_init(&mnt->mnt_fslink);
+                list_del_init(&mnt->mnt_expire);
                 spin_unlock(&vfsmount_lock);
 
                 err = graft_tree(mnt, nd);
@@ -743,7 +742,7 @@ static int do_move_mount(struct nameidata *nd, char *old_name)
 
         /* if the mount is moved, it should no longer be expire
          * automatically */
-        list_del_init(&old_nd.mnt->mnt_fslink);
+        list_del_init(&old_nd.mnt->mnt_expire);
 out2:
         spin_unlock(&vfsmount_lock);
 out1:
@@ -807,12 +806,13 @@ int do_add_mount(struct vfsmount *newmnt, struct nameidata *nd,
                 goto unlock;
 
         newmnt->mnt_flags = mnt_flags;
+        newmnt->mnt_namespace = current->namespace;
         err = graft_tree(newmnt, nd);
 
         if (err == 0 && fslist) {
                 /* add to the specified expiration list */
                 spin_lock(&vfsmount_lock);
-                list_add_tail(&newmnt->mnt_fslink, fslist);
+                list_add_tail(&newmnt->mnt_expire, fslist);
                 spin_unlock(&vfsmount_lock);
         }
 
@@ -824,6 +824,54 @@ unlock:
 
 EXPORT_SYMBOL_GPL(do_add_mount);
 
+static void expire_mount(struct vfsmount *mnt, struct list_head *mounts)
+{
+        spin_lock(&vfsmount_lock);
+
+        /*
+         * Check if mount is still attached, if not, let whoever holds it deal
+         * with the sucker
+         */
+        if (mnt->mnt_parent == mnt) {
+                spin_unlock(&vfsmount_lock);
+                return;
+        }
+
+        /*
+         * Check that it is still dead: the count should now be 2 - as
+         * contributed by the vfsmount parent and the mntget above
+         */
+        if (atomic_read(&mnt->mnt_count) == 2) {
+                struct nameidata old_nd;
+
+                /* delete from the namespace */
+                list_del_init(&mnt->mnt_list);
+                mnt->mnt_namespace = NULL;
+                detach_mnt(mnt, &old_nd);
+                spin_unlock(&vfsmount_lock);
+                path_release(&old_nd);
+
+                /*
+                 * Now lay it to rest if this was the last ref on the superblock
+                 */
+                if (atomic_read(&mnt->mnt_sb->s_active) == 1) {
+                        /* last instance - try to be smart */
+                        lock_kernel();
+                        DQUOT_OFF(mnt->mnt_sb);
+                        acct_auto_close(mnt->mnt_sb);
+                        unlock_kernel();
+                }
+                mntput(mnt);
+        } else {
+                /*
+                 * Someone brought it back to life whilst we didn't have any
+                 * locks held so return it to the expiration list
+                 */
+                list_add_tail(&mnt->mnt_expire, mounts);
+                spin_unlock(&vfsmount_lock);
+        }
+}
+
 /*
  * process a list of expirable mountpoints with the intent of discarding any
  * mountpoints that aren't in use and haven't been touched since last we came
@@ -846,13 +894,13 @@ void mark_mounts_for_expiry(struct list_head *mounts)
          * - still marked for expiry (marked on the last call here; marks are
          *   cleared by mntput())
          */
-        list_for_each_entry_safe(mnt, next, mounts, mnt_fslink) {
+        list_for_each_entry_safe(mnt, next, mounts, mnt_expire) {
                 if (!xchg(&mnt->mnt_expiry_mark, 1) ||
                     atomic_read(&mnt->mnt_count) != 1)
                         continue;
 
                 mntget(mnt);
-                list_move(&mnt->mnt_fslink, &graveyard);
+                list_move(&mnt->mnt_expire, &graveyard);
         }
 
         /*
@@ -862,61 +910,19 @@ void mark_mounts_for_expiry(struct list_head *mounts)
          * - dispose of the corpse
          */
         while (!list_empty(&graveyard)) {
-                mnt = list_entry(graveyard.next, struct vfsmount, mnt_fslink);
-                list_del_init(&mnt->mnt_fslink);
+                mnt = list_entry(graveyard.next, struct vfsmount, mnt_expire);
+                list_del_init(&mnt->mnt_expire);
 
                 /* don't do anything if the namespace is dead - all the
                  * vfsmounts from it are going away anyway */
                 namespace = mnt->mnt_namespace;
-                if (!namespace || atomic_read(&namespace->count) <= 0)
+                if (!namespace || !namespace->root)
                         continue;
                 get_namespace(namespace);
 
                 spin_unlock(&vfsmount_lock);
                 down_write(&namespace->sem);
-                spin_lock(&vfsmount_lock);
-
-                /* check that it is still dead: the count should now be 2 - as
-                 * contributed by the vfsmount parent and the mntget above */
-                if (atomic_read(&mnt->mnt_count) == 2) {
-                        struct vfsmount *xdmnt;
-                        struct dentry *xdentry;
-
-                        /* delete from the namespace */
-                        list_del_init(&mnt->mnt_list);
-                        list_del_init(&mnt->mnt_child);
-                        list_del_init(&mnt->mnt_hash);
-                        mnt->mnt_mountpoint->d_mounted--;
-
-                        xdentry = mnt->mnt_mountpoint;
-                        mnt->mnt_mountpoint = mnt->mnt_root;
-                        xdmnt = mnt->mnt_parent;
-                        mnt->mnt_parent = mnt;
-
-                        spin_unlock(&vfsmount_lock);
-
-                        mntput(xdmnt);
-                        dput(xdentry);
-
-                        /* now lay it to rest if this was the last ref on the
-                         * superblock */
-                        if (atomic_read(&mnt->mnt_sb->s_active) == 1) {
-                                /* last instance - try to be smart */
-                                lock_kernel();
-                                DQUOT_OFF(mnt->mnt_sb);
-                                acct_auto_close(mnt->mnt_sb);
-                                unlock_kernel();
-                        }
-
-                        mntput(mnt);
-                } else {
-                        /* someone brought it back to life whilst we didn't
-                         * have any locks held so return it to the expiration
-                         * list */
-                        list_add_tail(&mnt->mnt_fslink, mounts);
-                        spin_unlock(&vfsmount_lock);
-                }
-
+                expire_mount(mnt, mounts);
                 up_write(&namespace->sem);
 
                 mntput(mnt);
@@ -1326,8 +1332,12 @@ asmlinkage long sys_pivot_root(const char __user *new_root, const char __user *p
         error = -EINVAL;
         if (user_nd.mnt->mnt_root != user_nd.dentry)
                 goto out2; /* not a mountpoint */
+        if (user_nd.mnt->mnt_parent == user_nd.mnt)
+                goto out2; /* not attached */
         if (new_nd.mnt->mnt_root != new_nd.dentry)
                 goto out2; /* not a mountpoint */
+        if (new_nd.mnt->mnt_parent == new_nd.mnt)
+                goto out2; /* not attached */
         tmp = old_nd.mnt; /* make sure we can reach put_old from new_root */
         spin_lock(&vfsmount_lock);
         if (tmp != new_nd.mnt) {
@@ -1449,16 +1459,12 @@ void __init mnt_init(unsigned long mempages)
 
 void __put_namespace(struct namespace *namespace)
 {
-        struct vfsmount *mnt;
-
+        struct vfsmount *root = namespace->root;
+        namespace->root = NULL;
+        spin_unlock(&vfsmount_lock);
         down_write(&namespace->sem);
         spin_lock(&vfsmount_lock);
-
-        list_for_each_entry(mnt, &namespace->list, mnt_list) {
-                mnt->mnt_namespace = NULL;
-        }
-
-        umount_tree(namespace->root);
+        umount_tree(root);
         spin_unlock(&vfsmount_lock);
         up_write(&namespace->sem);
         kfree(namespace);