UBUNTU: Start new release

Ignore: yes
Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: dont put marks on temporary list when clearing marks by group"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit 1125b98f1f13850468d993e3ce24058389ca2079.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: introduce locked versions of fsnotify_add_mark() and fsnotify_remove_mark()"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit e96a097710ba56c571bdd0d1ca7c3e48c9cf74bf.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: pass group to fsnotify_destroy_mark()"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit 05e809bc3ee06ed0e7fcec0b6197c180b0a908bb.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: use a mutex instead of a spinlock to protect a groups mark list"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit bab395e43d23827d2ec7d3b446064633a8b61c4d.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fanotify: add an extra flag to mark_remove_from_mask that indicates wheather a mark should be destroyed"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit 40388247171189443dd48e1215946e0731034952.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: take groups mark_lock before mark lock"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit 60268474c2968d01fdbdee9336fc1b509890343c.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: use reference counting for groups"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit 1df3a20eaa41728b9571a6dd9b717be6ac320c27.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Revert "UBUNTU: SAUCE: fsnotify: introduce fsnotify_get_group()"

BugLink: http://bugs.launchpad.net/bugs/1096137

This reverts commit 702caaab2e93c472ffdd6d1293e8e79d4610884d.

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: introduce fsnotify_get_group()

BugLink: http://bugs.launchpad.net/bugs/1096137

Introduce fsnotify_get_group() which increments the reference counter of a group.

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 986129520479d689962a42c31acdeaf854ac91f5)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: use reference counting for groups

BugLink: http://bugs.launchpad.net/bugs/1096137

Get a group ref for each mark that is added to the groups list and release that
ref when the mark is freed in fsnotify_put_mark().
We also use get a group reference for duplicated marks and for private event
data.
Now we dont free a group any more when the number of marks becomes 0 but when
the groups ref count does. Since this will only happen when all marks are removed
from a groups mark list, we dont have to set the groups number of marks to 1 at
group creation.

Beside clearing all marks in fsnotify_destroy_group() we do also flush the
groups event queue. This is since events may hold references to groups (due to
private event data) and we have to put those references first before we get a
chance to put the final ref, which will result in a call to
fsnotify_final_destroy_group().

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 23e964c284ca0a767b80a30482bd53b059d30391)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: take groups mark_lock before mark lock

BugLink: http://bugs.launchpad.net/bugs/1096137

Race-free addition and removal of a mark to a groups mark list would be easier
if we could lock the mark list of group before we lock the specific mark.
This patch changes the order used to add/remove marks to/from mark lists from

1. mark->lock
2. group->mark_lock
3. inode->i_lock

to

1. group->mark_lock
2. mark->lock
3. inode->i_lock

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 104d06f08ea59247cb0e7e548c5a5d22d21dcfd5)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fanotify: add an extra flag to mark_remove_from_mask that indicates wheather a mark should be destroyed

BugLink: http://bugs.launchpad.net/bugs/1096137

This patch adds an extra flag to mark_remove_from_mask() to inform the caller if
the mark should be destroyed.
With this we dont destroy the mark implicitly in the function itself any more
but let the caller handle it.

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 6dfbd149946c22c2e2886d6b560def78630c8387)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: use a mutex instead of a spinlock to protect a groups mark list

BugLink: http://bugs.launchpad.net/bugs/1096137

Replaces the groups mark_lock spinlock with a mutex. Using a mutex instead
of a spinlock results in more flexibility (i.e it allows to sleep while the
lock is held).

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 986ab09807ca9454c3f54aae4db7e1bb00daeed3)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: pass group to fsnotify_destroy_mark()

BugLink: http://bugs.launchpad.net/bugs/1096137

In fsnotify_destroy_mark() dont get the group from the passed mark anymore,
but pass the group itself as an additional parameter to the function.

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(back ported from commit e2a29943e9a2ee2aa737a77f550f46ba72269db4)

Conflicts:

	kernel/audit_tree.c

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: introduce locked versions of fsnotify_add_mark() and fsnotify_remove_mark()

BugLink: http://bugs.launchpad.net/bugs/1096137

This patch introduces fsnotify_add_mark_locked() and fsnotify_remove_mark_locked()
which are essentially the same as fsnotify_add_mark() and fsnotify_remove_mark() but
assume that the caller has already taken the groups mark mutex.

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit d5a335b845792d2a69ed1e244c0b233117b7db3c)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: dont put marks on temporary list when clearing marks by group

BugLink: http://bugs.launchpad.net/bugs/1096137

In clear_marks_by_group_flags() the mark list of a group is iterated and the
marks are put on a temporary list.
Since we introduced fsnotify_destroy_mark_locked() we dont need the temp list
any more and are able to remove the marks while the mark list is iterated and
the mark list mutex is held.

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 64c20d2a20fce295c260ea6cb3b468edfa2fb07b)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
fsnotify: change locking order

BugLink: http://bugs.launchpad.net/bugs/1096137

On Mon, Aug 01, 2011 at 04:38:22PM -0400, Eric Paris wrote:
>
> I finally built and tested a v3.0 kernel with these patches (I know I'm
> SOOOOOO far behind).  Not what I hoped for:
>
> > [  150.937798] VFS: Busy inodes after unmount of tmpfs. Self-destruct in 5 seconds.  Have a nice day...
> > [  150.945290] BUG: unable to handle kernel NULL pointer dereference at 0000000000000070
> > [  150.946012] IP: [<ffffffff810ffd58>] shmem_free_inode+0x18/0x50
> > [  150.946012] PGD 2bf9e067 PUD 2bf9f067 PMD 0
> > [  150.946012] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> > [  150.946012] CPU 0
> > [  150.946012] Modules linked in: nfs lockd fscache auth_rpcgss nfs_acl sunrpc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_filter ip6_tables ext4 jbd2 crc16 joydev ata_piix i2c_piix4 pcspkr uinput ipv6 autofs4 usbhid [last unloaded: scsi_wait_scan]
> > [  150.946012]
> > [  150.946012] Pid: 2764, comm: syscall_thrash Not tainted 3.0.0+ #1 Red Hat KVM
> > [  150.946012] RIP: 0010:[<ffffffff810ffd58>]  [<ffffffff810ffd58>] shmem_free_inode+0x18/0x50
> > [  150.946012] RSP: 0018:ffff88002c2e5df8  EFLAGS: 00010282
> > [  150.946012] RAX: 000000004e370d9f RBX: 0000000000000000 RCX: ffff88003a029438
> > [  150.946012] RDX: 0000000033630a5f RSI: 0000000000000000 RDI: ffff88003491c240
> > [  150.946012] RBP: ffff88002c2e5e08 R08: 0000000000000000 R09: 0000000000000000
> > [  150.946012] R10: 0000000000000000 R11: 0000000000000000 R12: ffff88003a029428
> > [  150.946012] R13: ffff88003a029428 R14: ffff88003a029428 R15: ffff88003499a610
> > [  150.946012] FS:  00007f5a05420700(0000) GS:ffff88003f600000(0000) knlGS:0000000000000000
> > [  150.946012] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> > [  150.946012] CR2: 0000000000000070 CR3: 000000002a662000 CR4: 00000000000006f0
> > [  150.946012] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > [  150.946012] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> > [  150.946012] Process syscall_thrash (pid: 2764, threadinfo ffff88002c2e4000, task ffff88002bfbc760)
> > [  150.946012] Stack:
> > [  150.946012]  ffff88003a029438 ffff88003a029428 ffff88002c2e5e38 ffffffff81102f76
> > [  150.946012]  ffff88003a029438 ffff88003a029598 ffffffff8160f9c0 ffff88002c221250
> > [  150.946012]  ffff88002c2e5e68 ffffffff8115e9be ffff88002c2e5e68 ffff88003a029438
> > [  150.946012] Call Trace:
> > [  150.946012]  [<ffffffff81102f76>] shmem_evict_inode+0x76/0x130
> > [  150.946012]  [<ffffffff8115e9be>] evict+0x7e/0x170
> > [  150.946012]  [<ffffffff8115ee40>] iput_final+0xd0/0x190
> > [  150.946012]  [<ffffffff8115ef33>] iput+0x33/0x40
> > [  150.946012]  [<ffffffff81180205>] fsnotify_destroy_mark_locked+0x145/0x160
> > [  150.946012]  [<ffffffff81180316>] fsnotify_destroy_mark+0x36/0x50
> > [  150.946012]  [<ffffffff81181937>] sys_inotify_rm_watch+0x77/0xd0
> > [  150.946012]  [<ffffffff815aca52>] system_call_fastpath+0x16/0x1b
> > [  150.946012] Code: 67 4a 00 b8 e4 ff ff ff eb aa 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 48 83 ec 10 48 89 1c 24 4c 89 64 24 08 48 8b 9f 40 05 00 00
> > [  150.946012]  83 7b 70 00 74 1c 4c 8d a3 80 00 00 00 4c 89 e7 e8 d2 5d 4a
> > [  150.946012] RIP  [<ffffffff810ffd58>] shmem_free_inode+0x18/0x50
> > [  150.946012]  RSP <ffff88002c2e5df8>
> > [  150.946012] CR2: 0000000000000070
>
> Looks at aweful lot like the problem from:
> http://www.spinics.net/lists/linux-fsdevel/msg46101.html
>

I tried to reproduce this bug with your test program, but without success.
However, if I understand correctly, this occurs since we dont hold any locks when
we call iput() in mark_destroy(), right?
With the patches you tested, iput() is also not called within any lock, since the
groups mark_mutex is released temporarily before iput() is called.  This is, since
the original codes behaviour is similar.
However since we now have a mutex as the biggest lock, we can do what you
suggested (http://www.spinics.net/lists/linux-fsdevel/msg46107.html) and
call iput() with the mutex held to avoid the race.
The patch below implements this. It uses nested locking to avoid deadlock in case
we do the final iput() on an inode which still holds marks and thus would take
the mutex again when calling fsnotify_inode_delete() in destroy_inode().

Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
Signed-off-by: Eric Paris <eparis@redhat.com>
(cherry picked from commit 6960b0d909cde5bdff49e4e5c1250edd10be7ebd)

Signed-off-by: Chris J Arges <chris.j.arges@canonical.com>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
UBUNTU: Ubuntu-3.2.0-36.57

Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
UBUNTU: [Config] add the lowlatency flavours

Signed-off-by: Andy Whitcroft <apw@canonical.com>