6 files changed, 39 insertions, 46 deletions

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 011b9b8c90c6..c5c424f23fd5 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -417,10 +417,10 @@ static int ep_remove(struct eventpoll *ep, struct epitem *epi)
         ep_unregister_pollwait(ep, epi);
 
         /* Remove the current item from the list of epoll hooks */
-        spin_lock(&file->f_ep_lock);
+        spin_lock(&file->f_lock);
         if (ep_is_linked(&epi->fllink))
                 list_del_init(&epi->fllink);
-        spin_unlock(&file->f_ep_lock);
+        spin_unlock(&file->f_lock);
 
         rb_erase(&epi->rbn, &ep->rbr);
 
@@ -538,7 +538,7 @@ void eventpoll_release_file(struct file *file)
         struct epitem *epi;
 
         /*
-         * We don't want to get "file->f_ep_lock" because it is not
+         * We don't want to get "file->f_lock" because it is not
          * necessary. It is not necessary because we're in the "struct file"
          * cleanup path, and this means that noone is using this file anymore.
          * So, for example, epoll_ctl() cannot hit here sicne if we reach this
@@ -547,6 +547,8 @@ void eventpoll_release_file(struct file *file)
          * will correctly serialize the operation. We do need to acquire
          * "ep->mtx" after "epmutex" because ep_remove() requires it when called
          * from anywhere but ep_free().
+         *
+         * Besides, ep_remove() acquires the lock, so we can't hold it here.
          */
         mutex_lock(&epmutex);
 
@@ -785,9 +787,9 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
                 goto error_unregister;
 
         /* Add the current item to the list of active epoll hook for this file */
-        spin_lock(&tfile->f_ep_lock);
+        spin_lock(&tfile->f_lock);
         list_add_tail(&epi->fllink, &tfile->f_ep_links);
-        spin_unlock(&tfile->f_ep_lock);
+        spin_unlock(&tfile->f_lock);
 
         /*
          * Add the current item to the RB tree. All RB tree operations are
diff --git a/fs/fcntl.c b/fs/fcntl.c
index bd215cc791da..d865ca66ccba 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -141,7 +141,7 @@ SYSCALL_DEFINE1(dup, unsigned int, fildes)
         return ret;
 }
 
-#define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | FASYNC | O_DIRECT | O_NOATIME)
+#define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME)
 
 static int setfl(int fd, struct file * filp, unsigned long arg)
 {
@@ -177,21 +177,21 @@ static int setfl(int fd, struct file * filp, unsigned long arg)
                 return error;
 
         /*
-         * We still need a lock here for now to keep multiple FASYNC calls
-         * from racing with each other.
+         * ->fasync() is responsible for setting the FASYNC bit.
          */
-        lock_kernel();
-        if ((arg ^ filp->f_flags) & FASYNC) {
-                if (filp->f_op && filp->f_op->fasync) {
-                        error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
-                        if (error < 0)
-                                goto out;
-                }
+        if (((arg ^ filp->f_flags) & FASYNC) && filp->f_op &&
+                        filp->f_op->fasync) {
+                error = filp->f_op->fasync(fd, filp, (arg & FASYNC) != 0);
+                if (error < 0)
+                        goto out;
+                if (error > 0)
+                        error = 0;
         }
-
+        spin_lock(&filp->f_lock);
         filp->f_flags = (arg & SETFL_MASK) | (filp->f_flags & ~SETFL_MASK);
+        spin_unlock(&filp->f_lock);
+
  out:
-        unlock_kernel();
         return error;
 }
 
@@ -516,7 +516,7 @@ static DEFINE_RWLOCK(fasync_lock);
 static struct kmem_cache *fasync_cache __read_mostly;
 
 /*
- * fasync_helper() is used by some character device drivers (mainly mice)
+ * fasync_helper() is used by almost all character device drivers
  * to set up the fasync queue. It returns negative on error, 0 if it did
  * no changes and positive if it added/deleted the entry.
  */
@@ -555,6 +555,13 @@ int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fap
                 result = 1;
         }
 out:
+        /* Fix up FASYNC bit while still holding fasync_lock */
+        spin_lock(&filp->f_lock);
+        if (on)
+                filp->f_flags |= FASYNC;
+        else
+                filp->f_flags &= ~FASYNC;
+        spin_unlock(&filp->f_lock);
         write_unlock_irq(&fasync_lock);
         return result;
 }
diff --git a/fs/file_table.c b/fs/file_table.c
index da806aceae3f..b74a8e1da913 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -128,6 +128,7 @@ struct file *get_empty_filp(void)
         atomic_long_set(&f->f_count, 1);
         rwlock_init(&f->f_owner.lock);
         f->f_cred = get_cred(cred);
+        spin_lock_init(&f->f_lock);
         eventpoll_init_file(f);
         /* f->f_version: 0 */
         return f;
diff --git a/fs/ioctl.c b/fs/ioctl.c
index 240ec63984cb..ac2d47e43926 100644
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -404,10 +404,12 @@ static int ioctl_fionbio(struct file *filp, int __user *argp)
         if (O_NONBLOCK != O_NDELAY)
                 flag |= O_NDELAY;
 #endif
+        spin_lock(&filp->f_lock);
         if (on)
                 filp->f_flags |= flag;
         else
                 filp->f_flags &= ~flag;
+        spin_unlock(&filp->f_lock);
         return error;
 }
 
@@ -425,18 +427,12 @@ static int ioctl_fioasync(unsigned int fd, struct file *filp,
         /* Did FASYNC state change ? */
         if ((flag ^ filp->f_flags) & FASYNC) {
                 if (filp->f_op && filp->f_op->fasync)
+                        /* fasync() adjusts filp->f_flags */
                         error = filp->f_op->fasync(fd, filp, on);
                 else
                         error = -ENOTTY;
         }
-        if (error)
-                return error;
-
-        if (on)
-                filp->f_flags |= FASYNC;
-        else
-                filp->f_flags &= ~FASYNC;
-        return error;
+        return error < 0 ? error : 0;
 }
 
 static int ioctl_fsfreeze(struct file *filp)
@@ -499,17 +495,11 @@ int do_vfs_ioctl(struct file *filp, unsigned int fd, unsigned int cmd,
                 break;
 
         case FIONBIO:
-                /* BKL needed to avoid races tweaking f_flags */
-                lock_kernel();
                 error = ioctl_fionbio(filp, argp);
-                unlock_kernel();
                 break;
 
         case FIOASYNC:
-                /* BKL needed to avoid races tweaking f_flags */
-                lock_kernel();
                 error = ioctl_fioasync(fd, filp, argp);
-                unlock_kernel();
                 break;
 
         case FIOQSIZE:
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 6e50aaa56ca2..c165a6403df0 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -998,8 +998,11 @@ nfsd_vfs_write(struct svc_rqst *rqstp, struct svc_fh *fhp, struct file *file,
 
         if (!EX_ISSYNC(exp))
                 stable = 0;
-        if (stable && !EX_WGATHER(exp))
+        if (stable && !EX_WGATHER(exp)) {
+                spin_lock(&file->f_lock);
                 file->f_flags |= O_SYNC;
+                spin_unlock(&file->f_lock);
+        }
 
         /* Write the data. */
         oldfs = get_fs(); set_fs(KERNEL_DS);
diff --git a/fs/pipe.c b/fs/pipe.c
index 14f502b89cf5..94ad15967cf9 100644
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -667,10 +667,7 @@ pipe_read_fasync(int fd, struct file *filp, int on)
         retval = fasync_helper(fd, filp, on, &inode->i_pipe->fasync_readers);
         mutex_unlock(&inode->i_mutex);
 
-        if (retval < 0)
-                return retval;
-
-        return 0;
+        return retval;
 }
 
 
@@ -684,10 +681,7 @@ pipe_write_fasync(int fd, struct file *filp, int on)
         retval = fasync_helper(fd, filp, on, &inode->i_pipe->fasync_writers);
         mutex_unlock(&inode->i_mutex);
 
-        if (retval < 0)
-                return retval;
-
-        return 0;
+        return retval;
 }
 
 
@@ -706,11 +700,7 @@ pipe_rdwr_fasync(int fd, struct file *filp, int on)
                         fasync_helper(-1, filp, 0, &pipe->fasync_readers);
         }
         mutex_unlock(&inode->i_mutex);
-
-        if (retval < 0)
-                return retval;
-
-        return 0;
+        return retval;
 }