fs/super.c: fix race between freeze_super() and thaw_super()

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / fs / super.c

diff --git a/fs/super.c b/fs/super.c
index 7465d4364208a2e751d2d3a7c8a8c1cc10d2d7c3..fd3281d1ec45f749bfbc83ca684e321b2905dd38 100644 (file)
--- a/fs/super.c
+++ b/fs/super.c
@@ -76,6 +76,8 @@ static int prune_super(struct shrinker *shrink, struct shrink_control *sc)
 
        total_objects = sb->s_nr_dentry_unused +
                        sb->s_nr_inodes_unused + fs_objects + 1;
+       if (!total_objects)
+               total_objects = 1;
 
        if (sc->nr_to_scan) {
                int     dentries;
@@ -161,19 +163,6 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags)
                        s = NULL;
                        goto out;
                }
-#ifdef CONFIG_SMP
-               s->s_files = alloc_percpu(struct list_head);
-               if (!s->s_files)
-                       goto err_out;
-               else {
-                       int i;
-
-                       for_each_possible_cpu(i)
-                               INIT_LIST_HEAD(per_cpu_ptr(s->s_files, i));
-               }
-#else
-               INIT_LIST_HEAD(&s->s_files);
-#endif
                if (init_sb_writers(s, type))
                        goto err_out;
                s->s_flags = flags;
@@ -223,10 +212,6 @@ out:
        return s;
 err_out:
        security_sb_free(s);
-#ifdef CONFIG_SMP
-       if (s->s_files)
-               free_percpu(s->s_files);
-#endif
        destroy_sb_writers(s);
        kfree(s);
        s = NULL;
@@ -241,9 +226,6 @@ err_out:
  */
 static inline void destroy_super(struct super_block *s)
 {
-#ifdef CONFIG_SMP
-       free_percpu(s->s_files);
-#endif
        destroy_sb_writers(s);
        security_sb_free(s);
        WARN_ON(!list_empty(&s->s_mounts));
@@ -336,19 +318,19 @@ EXPORT_SYMBOL(deactivate_super);
  *     and want to turn it into a full-blown active reference.  grab_super()
  *     is called with sb_lock held and drops it.  Returns 1 in case of
  *     success, 0 if we had failed (superblock contents was already dead or
- *     dying when grab_super() had been called).
+ *     dying when grab_super() had been called).  Note that this is only
+ *     called for superblocks not in rundown mode (== ones still on ->fs_supers
+ *     of their type), so increment of ->s_count is OK here.
  */
 static int grab_super(struct super_block *s) __releases(sb_lock)
 {
-       if (atomic_inc_not_zero(&s->s_active)) {
-               spin_unlock(&sb_lock);
-               return 1;
-       }
-       /* it's going away */
        s->s_count++;
        spin_unlock(&sb_lock);
-       /* wait for it to die */
        down_write(&s->s_umount);
+       if ((s->s_flags & MS_BORN) && atomic_inc_not_zero(&s->s_active)) {
+               put_super(s);
+               return 1;
+       }
        up_write(&s->s_umount);
        put_super(s);
        return 0;
@@ -463,11 +445,6 @@ retry:
                                destroy_super(s);
                                s = NULL;
                        }
-                       down_write(&old->s_umount);
-                       if (unlikely(!(old->s_flags & MS_BORN))) {
-                               deactivate_locked_super(old);
-                               goto retry;
-                       }
                        return old;
                }
        }
@@ -660,10 +637,10 @@ restart:
                if (hlist_unhashed(&sb->s_instances))
                        continue;
                if (sb->s_bdev == bdev) {
-                       if (grab_super(sb)) /* drops sb_lock */
-                               return sb;
-                       else
+                       if (!grab_super(sb))
                                goto restart;
+                       up_write(&sb->s_umount);
+                       return sb;
                }
        }
        spin_unlock(&sb_lock);
@@ -730,7 +707,8 @@ int do_remount_sb(struct super_block *sb, int flags, void *data, int force)
           make sure there are no rw files opened */
        if (remount_ro) {
                if (force) {
-                       mark_files_ro(sb);
+                       sb->s_readonly_remount = 1;
+                       smp_wmb();
                } else {
                        retval = sb_prepare_remount_readonly(sb);
                        if (retval)
@@ -1349,8 +1327,8 @@ int freeze_super(struct super_block *sb)
                }
        }
        /*
-        * This is just for debugging purposes so that fs can warn if it
-        * sees write activity when frozen is set to SB_FREEZE_COMPLETE.
+        * For debugging purposes so that fs can warn if it sees write activity
+        * when frozen is set to SB_FREEZE_COMPLETE, and for thaw_super().
         */
        sb->s_writers.frozen = SB_FREEZE_COMPLETE;
        up_write(&sb->s_umount);
@@ -1369,7 +1347,7 @@ int thaw_super(struct super_block *sb)
        int error;
 
        down_write(&sb->s_umount);
-       if (sb->s_writers.frozen == SB_UNFROZEN) {
+       if (sb->s_writers.frozen != SB_FREEZE_COMPLETE) {
                up_write(&sb->s_umount);
                return -EINVAL;
        }