[PATCH] dnotify race fix

	A bunch of places dereferences ->d_parent->d_inode with no
protection whatsoever (e.g. on return from read()).  It's an
SMP race on all boxen and pretty wide UP race if we have dnotify
set on parent (race between read() and rename() and similar beasts).

	Patch below is the first one in a series of ->d_parent-related
fixes.  It adds a helper (dnotify_parent(dentry, event)) and converts
places that did inode_dir_notify(dentry->d_parent->d_inode,...) to it.

	Please, apply.  Notice that problem exists in 2.4 and unlike 2.5
there we can't switch to saner API (basically, reporting file events on
file, not on a parent directory).

Some of the further fixes depend on Pat's and Greg's (driverfs and usbdevfs
resp.) patches, so getting them merged would make life easier.  And yes,
some of further chunks (e.g. smbfs ->revalidate() and friends) will also
have to go into 2.4 - they are independent from any threading projects ;-/

arch/mips64/kernel/linux32.c

@@ -1000,7 +1000,7 @@ asmlinkage ssize_t sys32_pread(unsigned int fd, char * buf,
 		goto out;
 	ret = read(file, buf, count, &pos);
 	if (ret > 0)
-		inode_dir_notify(file->f_dentry->d_parent->d_inode, DN_ACCESS);
+		dnotify_parent(file->f_dentry, DN_ACCESS);
 out:
 	fput(file);
 bad_file:
@@ -1032,7 +1032,7 @@ asmlinkage ssize_t sys32_pwrite(unsigned int fd, const char * buf,
 
 	ret = write(file, buf, count, &pos);
 	if (ret > 0)
-		inode_dir_notify(file->f_dentry->d_parent->d_inode, DN_MODIFY);
+		dnotify_parent(file->f_dentry, DN_MODIFY);
 out:
 	fput(file);
 bad_file:

fs/attr.c

@@ -144,7 +144,7 @@ int notify_change(struct dentry * dentry, struct iattr * attr)
 	if (!error) {
 		unsigned long dn_mask = setattr_mask(ia_valid);
 		if (dn_mask)
-			inode_dir_notify(dentry->d_parent->d_inode, dn_mask);
+			dnotify_parent(dentry, dn_mask);
 	}
 	return error;
 }

fs/read_write.c

@@ -189,8 +189,7 @@ asmlinkage ssize_t sys_read(unsigned int fd, char * buf, size_t count)
 			}
 		}
 		if (ret > 0)
-			inode_dir_notify(file->f_dentry->d_parent->d_inode,
-				DN_ACCESS);
+			dnotify_parent(file->f_dentry, DN_ACCESS);
 		fput(file);
 	}
 	return ret;
@@ -216,8 +215,7 @@ asmlinkage ssize_t sys_write(unsigned int fd, const char * buf, size_t count)
 			}
 		}
 		if (ret > 0)
-			inode_dir_notify(file->f_dentry->d_parent->d_inode,
-				DN_MODIFY);
+			dnotify_parent(file->f_dentry, DN_MODIFY);
 		fput(file);
 	}
 	return ret;
@@ -321,7 +319,7 @@ static ssize_t do_readv_writev(int type, struct file *file,
 out_nofree:
 	/* VERIFY_WRITE actually means a read, as we write to user space */
 	if ((ret + (type == VERIFY_WRITE)) > 0)
-		inode_dir_notify(file->f_dentry->d_parent->d_inode,
+		dnotify_parent(file->f_dentry,
 			(type == VERIFY_WRITE) ? DN_MODIFY : DN_ACCESS);
 	return ret;
 }
@@ -394,7 +392,7 @@ asmlinkage ssize_t sys_pread(unsigned int fd, char * buf,
 		goto out;
 	ret = read(file, buf, count, &pos);
 	if (ret > 0)
-		inode_dir_notify(file->f_dentry->d_parent->d_inode, DN_ACCESS);
+		dnotify_parent(file->f_dentry, DN_ACCESS);
 out:
 	fput(file);
 bad_file:
@@ -426,7 +424,7 @@ asmlinkage ssize_t sys_pwrite(unsigned int fd, const char * buf,
 
 	ret = write(file, buf, count, &pos);
 	if (ret > 0)
-		inode_dir_notify(file->f_dentry->d_parent->d_inode, DN_MODIFY);
+		dnotify_parent(file->f_dentry, DN_MODIFY);
 out:
 	fput(file);
 bad_file:

include/linux/dnotify.h

@@ -25,3 +25,21 @@ static inline void inode_dir_notify(struct inode *inode, unsigned long event)
 	if ((inode)->i_dnotify_mask & (event))
 		__inode_dir_notify(inode, event);
 }
+
+/*
+ * This is hopelessly wrong, but unfixable without API changes.  At
+ * least it doesn't oops the kernel...
+ */
+static inline void dnotify_parent(struct dentry *dentry, unsigned long event)
+{
+	struct dentry *parent;
+	spin_lock(&dcache_lock);
+	parent = dentry->d_parent;
+	if (parent->d_inode->i_dnotify_mask & event) {
+		dget(parent);
+		spin_unlock(&dcache_lock);
+		__inode_dir_notify(parent->d_inode, event);
+		dput(parent);
+	} else
+		spin_unlock(&dcache_lock);
+}