Merge tag 'pull-inode' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull vfs inode update from Al Viro:
 "Saner inode_init_always(), also fixing a nilfs problem"

* tag 'pull-inode' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fs: fix UAF/GPF bug in nilfs_mdt_destroy

diff --combined fs/inode.c
index ba1de23c13c1ed35f87d896fd7d58f2446fa2c20,5559a2983341c3aa466288cc4bbea64b548bec69..b608528efd3a463d885a7c1205575cf4409ce497
--- 1/fs/inode.c
--- 2/fs/inode.c
+++ b/fs/inode.c
@@@ -192,8 -192,6 +192,6 @@@ int inode_init_always(struct super_bloc
        inode->i_wb_frn_history = 0;
  #endif
  
-       if (security_inode_alloc(inode))
-               goto out;
        spin_lock_init(&inode->i_lock);
        lockdep_set_class(&inode->i_lock, &sb->s_type->i_lock_key);
  
@@@ -228,11 -226,12 +226,12 @@@
        inode->i_fsnotify_mask = 0;
  #endif
        inode->i_flctx = NULL;
+ 
+       if (unlikely(security_inode_alloc(inode)))
+               return -ENOMEM;
        this_cpu_inc(nr_inodes);
  
        return 0;
- out:
-       return -ENOMEM;
  }
  EXPORT_SYMBOL(inode_init_always);
  
@@@ -2018,25 -2017,23 +2017,25 @@@ static int __file_remove_privs(struct f
  {
        struct dentry *dentry = file_dentry(file);
        struct inode *inode = file_inode(file);
 -      int error;
 +      int error = 0;
        int kill;
  
        if (IS_NOSEC(inode) || !S_ISREG(inode->i_mode))
                return 0;
  
        kill = dentry_needs_remove_privs(dentry);
 -      if (kill <= 0)
 +      if (kill < 0)
                return kill;
  
 -      if (flags & IOCB_NOWAIT)
 -              return -EAGAIN;
 +      if (kill) {
 +              if (flags & IOCB_NOWAIT)
 +                      return -EAGAIN;
 +
 +              error = __remove_privs(file_mnt_user_ns(file), dentry, kill);
 +      }
  
 -      error = __remove_privs(file_mnt_user_ns(file), dentry, kill);
        if (!error)
                inode_has_no_xattr(inode);
 -
        return error;
  }