1 files changed, 11 insertions, 8 deletions

diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
index 910553f37aca..2a7ef4f8e2a6 100644
--- a/fs/overlayfs/readdir.c
+++ b/fs/overlayfs/readdir.c
@@ -21,9 +21,10 @@ struct ovl_cache_entry {
         unsigned int len;
         unsigned int type;
         u64 ino;
-        bool is_whiteout;
         struct list_head l_node;
         struct rb_node node;
+        bool is_whiteout;
+        bool is_cursor;
         char name[];
 };
 
@@ -92,6 +93,7 @@ static struct ovl_cache_entry *ovl_cache_entry_new(const char *name, int len,
                 p->type = d_type;
                 p->ino = ino;
                 p->is_whiteout = false;
+                p->is_cursor = false;
         }
 
         return p;
@@ -166,7 +168,7 @@ static void ovl_cache_put(struct ovl_dir_file *od, struct dentry *dentry)
 {
         struct ovl_dir_cache *cache = od->cache;
 
-        list_del(&od->cursor.l_node);
+        list_del_init(&od->cursor.l_node);
         WARN_ON(cache->refcount <= 0);
         cache->refcount--;
         if (!cache->refcount) {
@@ -251,7 +253,7 @@ static int ovl_dir_mark_whiteouts(struct dentry *dir,
 
         mutex_lock(&dir->d_inode->i_mutex);
         list_for_each_entry(p, rdd->list, l_node) {
-                if (!p->name)
+                if (p->is_cursor)
                         continue;
 
                 if (p->type != DT_CHR)
@@ -307,7 +309,6 @@ static inline int ovl_dir_read_merged(struct path *upperpath,
         }
 out:
         return err;
-
 }
 
 static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
@@ -316,7 +317,7 @@ static void ovl_seek_cursor(struct ovl_dir_file *od, loff_t pos)
         loff_t off = 0;
 
         list_for_each_entry(p, &od->cache->entries, l_node) {
-                if (!p->name)
+                if (p->is_cursor)
                         continue;
                 if (off >= pos)
                         break;
@@ -389,7 +390,7 @@ static int ovl_iterate(struct file *file, struct dir_context *ctx)
 
                 p = list_entry(od->cursor.l_node.next, struct ovl_cache_entry, l_node);
                 /* Skip cursors */
-                if (p->name) {
+                if (!p->is_cursor) {
                         if (!p->is_whiteout) {
                                 if (!dir_emit(ctx, p->name, p->len, p->ino, p->type))
                                         break;
@@ -454,12 +455,13 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end,
         if (!od->is_upper && ovl_path_type(dentry) == OVL_PATH_MERGE) {
                 struct inode *inode = file_inode(file);
 
-                realfile = od->upperfile;
+                realfile =lockless_dereference(od->upperfile);
                 if (!realfile) {
                         struct path upperpath;
 
                         ovl_path_upper(dentry, &upperpath);
                         realfile = ovl_path_open(&upperpath, O_RDONLY);
+                        smp_mb__before_spinlock();
                         mutex_lock(&inode->i_mutex);
                         if (!od->upperfile) {
                                 if (IS_ERR(realfile)) {
@@ -518,6 +520,7 @@ static int ovl_dir_open(struct inode *inode, struct file *file)
         od->realfile = realfile;
         od->is_real = (type != OVL_PATH_MERGE);
         od->is_upper = (type != OVL_PATH_LOWER);
+        od->cursor.is_cursor = true;
         file->private_data = od;
 
         return 0;
@@ -569,7 +572,7 @@ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list)
 {
         struct ovl_cache_entry *p;
 
-        mutex_lock_nested(&upper->d_inode->i_mutex, I_MUTEX_PARENT);
+        mutex_lock_nested(&upper->d_inode->i_mutex, I_MUTEX_CHILD);
         list_for_each_entry(p, list, l_node) {
                 struct dentry *dentry;