Merge remote-tracking branch 'common/android-3.0' into android-samsung-30-wip-mergedown

* common/android-3.0: (1178 commits)
  cpufreq: interactive: remove unused target_validate_time_in_idle
  cpufreq: interactive: Boost frequency on touchscreen input
  cpufreq: Separate speed target revalidate time and initial set time
  cpufreq: interactive: based hispeed bump on target freq, not actual
  cpufreq: interactive: adjust code and documentation to match
  cpufreq: interactive: configurable delay before raising above hispeed
  sync: add poll support
  sw_sync: add fill_driver_data support
  sync: add ioctl to get fence data
  sw_sync: add debug support
  sync: add debugfs support
  sync: add timestamps to sync_pts
  sw_sync: add cpu based sync driver
  sync: Add synchronization framework
  Linux 3.0.28
  Bluetooth: Fix l2cap conn failures for ssp devices
  TOMOYO: Fix mount flags checking order.
  iommu/amd: Make sure IOMMU interrupts are re-enabled on resume
  cred: copy_process() should clear child->replacement_session_keyring
  ASoC: ak4642: fixup: mute needs +1 step
  ...

Conflicts:
	mm/compaction.c

Change-Id: I3dc59225d2435eddbed0c639155179e580891ac8
Signed-off-by: JP Abgrall <jpa@google.com>

1 files changed, 10 insertions, 12 deletions

diff --git a/fs/aio.c b/fs/aio.c
index e29ec48..b4a88cc 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -228,12 +228,6 @@ static void __put_ioctx(struct kioctx *ctx)
 	call_rcu(&ctx->rcu_head, ctx_rcu_free);
 }
 
-static inline void get_ioctx(struct kioctx *kioctx)
-{
-	BUG_ON(atomic_read(&kioctx->users) <= 0);
-	atomic_inc(&kioctx->users);
-}
-
 static inline int try_get_ioctx(struct kioctx *kioctx)
 {
 	return atomic_inc_not_zero(&kioctx->users);
@@ -273,7 +267,7 @@ static struct kioctx *ioctx_alloc(unsigned nr_events)
 	mm = ctx->mm = current->mm;
 	atomic_inc(&mm->mm_count);
 
-	atomic_set(&ctx->users, 1);
+	atomic_set(&ctx->users, 2);
 	spin_lock_init(&ctx->ctx_lock);
 	spin_lock_init(&ctx->ring_info.ring_lock);
 	init_waitqueue_head(&ctx->wait);
@@ -527,11 +521,16 @@ static void aio_fput_routine(struct work_struct *data)
 			fput(req->ki_filp);
 
 		/* Link the iocb into the context's free list */
+		rcu_read_lock();
 		spin_lock_irq(&ctx->ctx_lock);
 		really_put_req(ctx, req);
+		/*
+		 * at that point ctx might've been killed, but actual
+		 * freeing is RCU'd
+		 */
 		spin_unlock_irq(&ctx->ctx_lock);
+		rcu_read_unlock();
 
-		put_ioctx(ctx);
 		spin_lock_irq(&fput_lock);
 	}
 	spin_unlock_irq(&fput_lock);
@@ -562,7 +561,6 @@ static int __aio_put_req(struct kioctx *ctx, struct kiocb *req)
 	 * this function will be executed w/out any aio kthread wakeup.
 	 */
 	if (unlikely(!fput_atomic(req->ki_filp))) {
-		get_ioctx(ctx);
 		spin_lock(&fput_lock);
 		list_add(&req->ki_list, &fput_head);
 		spin_unlock(&fput_lock);
@@ -1256,10 +1254,10 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
 	ret = PTR_ERR(ioctx);
 	if (!IS_ERR(ioctx)) {
 		ret = put_user(ioctx->user_id, ctxp);
-		if (!ret)
+		if (!ret) {
+			put_ioctx(ioctx);
 			return 0;
-
-		get_ioctx(ioctx); /* io_destroy() expects us to hold a ref */
+		}
 		io_destroy(ioctx);
 	}