3 files changed, 58 insertions, 59 deletions

diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 84becd3e4772..d3c032f5fa0a 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -76,7 +76,7 @@
 #include <linux/buffer_head.h>
 #include <linux/capability.h>
 #include <linux/quotaops.h>
-#include <linux/writeback.h> /* for inode_lock, oddly enough.. */
+#include "../internal.h" /* ugh */
 
 #include <asm/uaccess.h>
 
@@ -442,7 +442,7 @@ EXPORT_SYMBOL(dquot_acquire);
  */
 int dquot_commit(struct dquot *dquot)
 {
-        int ret = 0, ret2 = 0;
+        int ret = 0;
         struct quota_info *dqopt = sb_dqopt(dquot->dq_sb);
 
         mutex_lock(&dqopt->dqio_mutex);
@@ -454,15 +454,10 @@ int dquot_commit(struct dquot *dquot)
         spin_unlock(&dq_list_lock);
         /* Inactive dquot can be only if there was error during read/init
          * => we have better not writing it */
-        if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+        if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
                 ret = dqopt->ops[dquot->dq_type]->commit_dqblk(dquot);
-                if (info_dirty(&dqopt->info[dquot->dq_type])) {
-                        ret2 = dqopt->ops[dquot->dq_type]->write_file_info(
-                                                dquot->dq_sb, dquot->dq_type);
-                }
-                if (ret >= 0)
-                        ret = ret2;
-        }
+        else
+                ret = -EIO;
 out_sem:
         mutex_unlock(&dqopt->dqio_mutex);
         return ret;
@@ -900,33 +895,38 @@ static void add_dquot_ref(struct super_block *sb, int type)
         int reserved = 0;
 #endif
 
-        spin_lock(&inode_lock);
+        spin_lock(&inode_sb_list_lock);
         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
-                if (inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW))
+                spin_lock(&inode->i_lock);
+                if ((inode->i_state & (I_FREEING|I_WILL_FREE|I_NEW)) ||
+                    !atomic_read(&inode->i_writecount) ||
+                    !dqinit_needed(inode, type)) {
+                        spin_unlock(&inode->i_lock);
                         continue;
+                }
 #ifdef CONFIG_QUOTA_DEBUG
                 if (unlikely(inode_get_rsv_space(inode) > 0))
                         reserved = 1;
 #endif
-                if (!atomic_read(&inode->i_writecount))
-                        continue;
-                if (!dqinit_needed(inode, type))
-                        continue;
-
                 __iget(inode);
-                spin_unlock(&inode_lock);
+                spin_unlock(&inode->i_lock);
+                spin_unlock(&inode_sb_list_lock);
 
                 iput(old_inode);
                 __dquot_initialize(inode, type);
-                /* We hold a reference to 'inode' so it couldn't have been
-                 * removed from s_inodes list while we dropped the inode_lock.
-                 * We cannot iput the inode now as we can be holding the last
-                 * reference and we cannot iput it under inode_lock. So we
-                 * keep the reference and iput it later. */
+
+                /*
+                 * We hold a reference to 'inode' so it couldn't have been
+                 * removed from s_inodes list while we dropped the
+                 * inode_sb_list_lock We cannot iput the inode now as we can be
+                 * holding the last reference and we cannot iput it under
+                 * inode_sb_list_lock. So we keep the reference and iput it
+                 * later.
+                 */
                 old_inode = inode;
-                spin_lock(&inode_lock);
+                spin_lock(&inode_sb_list_lock);
         }
-        spin_unlock(&inode_lock);
+        spin_unlock(&inode_sb_list_lock);
         iput(old_inode);
 
 #ifdef CONFIG_QUOTA_DEBUG
@@ -951,7 +951,7 @@ static inline int dqput_blocks(struct dquot *dquot)
 
 /*
  * Remove references to dquots from inode and add dquot to list for freeing
- * if we have the last referece to dquot
+ * if we have the last reference to dquot
  * We can't race with anybody because we hold dqptr_sem for writing...
  */
 static int remove_inode_dquot_ref(struct inode *inode, int type,
@@ -1007,7 +1007,7 @@ static void remove_dquot_ref(struct super_block *sb, int type,
         struct inode *inode;
         int reserved = 0;
 
-        spin_lock(&inode_lock);
+        spin_lock(&inode_sb_list_lock);
         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                 /*
                  *  We have to scan also I_NEW inodes because they can already
@@ -1021,7 +1021,7 @@ static void remove_dquot_ref(struct super_block *sb, int type,
                         remove_inode_dquot_ref(inode, type, tofree_head);
                 }
         }
-        spin_unlock(&inode_lock);
+        spin_unlock(&inode_sb_list_lock);
 #ifdef CONFIG_QUOTA_DEBUG
         if (reserved) {
                 printk(KERN_WARNING "VFS (%s): Writes happened after quota"
@@ -2189,8 +2189,8 @@ int dquot_resume(struct super_block *sb, int type)
 }
 EXPORT_SYMBOL(dquot_resume);
 
-int dquot_quota_on_path(struct super_block *sb, int type, int format_id,
-                      struct path *path)
+int dquot_quota_on(struct super_block *sb, int type, int format_id,
+                   struct path *path)
 {
         int error = security_quota_on(path->dentry);
         if (error)
@@ -2204,20 +2204,6 @@ int dquot_quota_on_path(struct super_block *sb, int type, int format_id,
                                              DQUOT_LIMITS_ENABLED);
         return error;
 }
-EXPORT_SYMBOL(dquot_quota_on_path);
-
-int dquot_quota_on(struct super_block *sb, int type, int format_id, char *name)
-{
-        struct path path;
-        int error;
-
-        error = kern_path(name, LOOKUP_FOLLOW, &path);
-        if (!error) {
-                error = dquot_quota_on_path(sb, type, format_id, &path);
-                path_put(&path);
-        }
-        return error;
-}
 EXPORT_SYMBOL(dquot_quota_on);
 
 /*
diff --git a/fs/quota/quota.c b/fs/quota/quota.c
index b299961e1edb..b34bdb25490c 100644
--- a/fs/quota/quota.c
+++ b/fs/quota/quota.c
@@ -64,18 +64,15 @@ static int quota_sync_all(int type)
 }
 
 static int quota_quotaon(struct super_block *sb, int type, int cmd, qid_t id,
-                         void __user *addr)
+                         struct path *path)
 {
-        char *pathname;
-        int ret = -ENOSYS;
-
-        pathname = getname(addr);
-        if (IS_ERR(pathname))
-                return PTR_ERR(pathname);
-        if (sb->s_qcop->quota_on)
-                ret = sb->s_qcop->quota_on(sb, type, id, pathname);
-        putname(pathname);
-        return ret;
+        if (!sb->s_qcop->quota_on && !sb->s_qcop->quota_on_meta)
+                return -ENOSYS;
+        if (sb->s_qcop->quota_on_meta)
+                return sb->s_qcop->quota_on_meta(sb, type, id);
+        if (IS_ERR(path))
+                return PTR_ERR(path);
+        return sb->s_qcop->quota_on(sb, type, id, path);
 }
 
 static int quota_getfmt(struct super_block *sb, int type, void __user *addr)
@@ -241,7 +238,7 @@ static int quota_getxquota(struct super_block *sb, int type, qid_t id,
 
 /* Copy parameters and call proper function */
 static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
-                       void __user *addr)
+                       void __user *addr, struct path *path)
 {
         int ret;
 
@@ -256,7 +253,7 @@ static int do_quotactl(struct super_block *sb, int type, int cmd, qid_t id,
 
         switch (cmd) {
         case Q_QUOTAON:
-                return quota_quotaon(sb, type, cmd, id, addr);
+                return quota_quotaon(sb, type, cmd, id, path);
         case Q_QUOTAOFF:
                 if (!sb->s_qcop->quota_off)
                         return -ENOSYS;
@@ -335,6 +332,7 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
 {
         uint cmds, type;
         struct super_block *sb = NULL;
+        struct path path, *pathp = NULL;
         int ret;
 
         cmds = cmd >> SUBCMDSHIFT;
@@ -351,12 +349,27 @@ SYSCALL_DEFINE4(quotactl, unsigned int, cmd, const char __user *, special,
                 return -ENODEV;
         }
 
+        /*
+         * Path for quotaon has to be resolved before grabbing superblock
+         * because that gets s_umount sem which is also possibly needed by path
+         * resolution (think about autofs) and thus deadlocks could arise.
+         */
+        if (cmds == Q_QUOTAON) {
+                ret = user_path_at(AT_FDCWD, addr, LOOKUP_FOLLOW, &path);
+                if (ret)
+                        pathp = ERR_PTR(ret);
+                else
+                        pathp = &path;
+        }
+
         sb = quotactl_block(special);
         if (IS_ERR(sb))
                 return PTR_ERR(sb);
 
-        ret = do_quotactl(sb, type, cmds, id, addr);
+        ret = do_quotactl(sb, type, cmds, id, addr, pathp);
 
         drop_super(sb);
+        if (pathp && !IS_ERR(pathp))
+                path_put(pathp);
         return ret;
 }
diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
index 65444d29406b..f1ab3604db5a 100644
--- a/fs/quota/quota_v2.c
+++ b/fs/quota/quota_v2.c
@@ -112,7 +112,7 @@ static int v2_read_file_info(struct super_block *sb, int type)
         if (!info->dqi_priv) {
                 printk(KERN_WARNING
                        "Not enough memory for quota information structure.\n");
-                return -1;
+                return -ENOMEM;
         }
         qinfo = info->dqi_priv;
         if (version == 0) {