nfsd4: fail when delegreturn gets a non-delegation stateid

[safe/jmp/linux-2.6] / kernel / cgroup.c

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 2ae7cb4..9edb5c4 100644 (file)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -1115,13 +1115,15 @@ static void cgroup_kill_sb(struct super_block *sb) {
        }
        write_unlock(&css_set_lock);
 
-       list_del(&root->root_list);
-       root_count--;
+       if (!list_empty(&root->root_list)) {
+               list_del(&root->root_list);
+               root_count--;
+       }
 
        mutex_unlock(&cgroup_mutex);
 
-       kfree(root);
        kill_litter_super(sb);
+       kfree(root);
 }
 
 static struct file_system_type cgroup_fs_type = {
@@ -2349,7 +2351,7 @@ static void cgroup_lock_hierarchy(struct cgroupfs_root *root)
        for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                struct cgroup_subsys *ss = subsys[i];
                if (ss->root == root)
-                       mutex_lock_nested(&ss->hierarchy_mutex, i);
+                       mutex_lock(&ss->hierarchy_mutex);
        }
 }
 
@@ -2509,7 +2511,7 @@ static int cgroup_clear_css_refs(struct cgroup *cgrp)
        for_each_subsys(cgrp->root, ss) {
                struct cgroup_subsys_state *css = cgrp->subsys[ss->subsys_id];
                int refcnt;
-               do {
+               while (1) {
                        /* We can only remove a CSS with a refcnt==1 */
                        refcnt = atomic_read(&css->refcnt);
                        if (refcnt > 1) {
@@ -2523,7 +2525,10 @@ static int cgroup_clear_css_refs(struct cgroup *cgrp)
                         * css_tryget() to spin until we set the
                         * CSS_REMOVED bits or abort
                         */
-               } while (atomic_cmpxchg(&css->refcnt, refcnt, 0) != refcnt);
+                       if (atomic_cmpxchg(&css->refcnt, refcnt, 0) == refcnt)
+                               break;
+                       cpu_relax();
+               }
        }
  done:
        for_each_subsys(cgrp->root, ss) {
@@ -2632,6 +2637,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
        BUG_ON(!list_empty(&init_task.tasks));
 
        mutex_init(&ss->hierarchy_mutex);
+       lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
        ss->active = 1;
 }
 
@@ -2993,20 +2999,21 @@ int cgroup_clone(struct task_struct *tsk, struct cgroup_subsys *subsys,
                mutex_unlock(&cgroup_mutex);
                return 0;
        }
-       task_lock(tsk);
-       cg = tsk->cgroups;
-       parent = task_cgroup(tsk, subsys->subsys_id);
 
        /* Pin the hierarchy */
-       if (!atomic_inc_not_zero(&parent->root->sb->s_active)) {
+       if (!atomic_inc_not_zero(&root->sb->s_active)) {
                /* We race with the final deactivate_super() */
                mutex_unlock(&cgroup_mutex);
                return 0;
        }
 
        /* Keep the cgroup alive */
+       task_lock(tsk);
+       parent = task_cgroup(tsk, subsys->subsys_id);
+       cg = tsk->cgroups;
        get_css_set(cg);
        task_unlock(tsk);
+
        mutex_unlock(&cgroup_mutex);
 
        /* Now do the VFS work to create a cgroup */
@@ -3045,7 +3052,7 @@ int cgroup_clone(struct task_struct *tsk, struct cgroup_subsys *subsys,
                mutex_unlock(&inode->i_mutex);
                put_css_set(cg);
 
-               deactivate_super(parent->root->sb);
+               deactivate_super(root->sb);
                /* The cgroup is still accessible in the VFS, but
                 * we're not going to try to rmdir() it at this
                 * point. */
@@ -3071,7 +3078,7 @@ int cgroup_clone(struct task_struct *tsk, struct cgroup_subsys *subsys,
        mutex_lock(&cgroup_mutex);
        put_css_set(cg);
        mutex_unlock(&cgroup_mutex);
-       deactivate_super(parent->root->sb);
+       deactivate_super(root->sb);
        return ret;
 }