Pull configfs updates from Al Viro:
 "A couple of fixes (UAF in configfs_lookup() and really old races
  introduced when lseek() on configfs directories stopped locking those
  directories; impact up to and including UAF).

  Fixes aside, the main result is that configfs is finally switched to
  tree-in-dcache machinery. It's *not* making use of recursive removal
  helpers yet, and it still does the bloody awful "build subtree in full
  sight of userland, with possibility of failure halfway through and
  need to unroll" that forces the locking model from hell; dealing with
  that is a separate patch series, once this one is out of the way.
  However, it is using DCACHE_PERSISTENT properly now. And apparmorfs is
  the sole remaining user of __simple_{unlink,rmdir}() at that point"

* tag 'pull-configfs-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  create_default_group(): pass parent's dentry instead of config_group
  configfs_attach_group(): drop the unused parent_item argument
  configs_attach_item(): drop unused parent_item argument
  configfs_create(): lift parent timestamp updates into callers
  kill configfs_drop_dentry()
  configfs: mark pinned dentries persistent
  configfs: dentry refcount needs to be pinned only once
  switch configfs_detach_{group,item}() to passing dentry
  configfs_remove_dir(), detach_attrs(): switch to passing dentry
  populate_attrs(): move cleanup to the sole caller
  populate_group(): move cleanup on failure to the sole caller
  configfs_detach_rollback(): pass configfs_dirent instead of dentry
  configfs_do_depend_item(): pass configfs_dirent instead of dentry
  configfs_depend_prep(): pass configfs_dirent instead of dentry
  configfs_detach_prep(): pass configfs_dirent instead of dentry
  configfs_mkdir(): use take_dentry_name_snapshot()
  configfs: fix lockless traversals of ->s_children
  configfs_lookup(): don't leave ->s_dentry dangling on failure

Pull dentry d_add() cleanups from Al Viro:
 "This converts a bunch of unidiomatic uses of d_add() in ->lookup()
  instances to equivalent uses of d_splice_alias(), which is the normal
  mechanism for ->lookup()"

* tag 'pull-d_add' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  gfs2: use d_splice_alias() for ->lookup() return value
  ntfs: use d_splice_alias() for ->lookup() return value
  simple_lookup(): use d_splice_alias() for ->lookup() return value
  ecryptfs: use d_splice_alias() for ->lookup() return value
  configfs_lookup(): switch to d_splice_alias()
  tracefs: use d_splice_alias() in ->lookup() instances

the only way parent_group is used there...

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

This one *was* used - for passing it to configfs_attach_item(), which
didn't use the value passed to it.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

That argument has been unused since the initial merge in 2005.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

... and do *not* do it in ->lookup() case.  stat foo/bar
should not update mtime of foo, TYVM...

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Fold into the only remaining user, don't bother with the timestamps
of parent - we are going to rmdir it shortly anyway, which will
override those.

Fix the locking of inode, while we are at it - updating the link
count and timestamps ought to be done with the inode locked.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

on the removal side we can (finally) get rid of __simple_unlink()
and __simple_rmdir() kludges now that dentries in question are
properly marked persistent - simple_unlink() and simple_rmdir()
will do the right thing for those.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

currently we have a weird situation where
	* symlinks and roots of subtrees created by mkdir are pinned once
	* subdirectories of subtrees created by mkdir are pinned twice
	* roots of subtrees created by register_{group,subsystem} are pinned
twice.

It makes things harder to follow for no good reason.  The goal is to
encapsulate the unbalanced dget/dput into d_{make,discard}_persisitent()
and, preferably, allow a use of simple_recursive_removal() or analogue
thereof.  So let's regularize that and pin things only once.

create_default_group() and configfs_register_subsystem() don't need to
keep their reference around on success - configfs_create_dir() has pinned
the sucker already.  So we can drop the reference passed to
configfs_create_dir() (via configfs_attach_group(), etc.) both on success
and on failure.  On the removal side we no longer have the double references,
so we need an explicit dget() to compensate.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

... and there's no need to grab/drop it, or check for NULL - none
of the callers would even get there with NULL dentry and all of
them have the sucker pinned

Note that if sd is a directory configfs_dirent, we have sd->s_element
pointing to config_item with item->ci_dentry equal to sd->s_dentry.
Which is the only reason why detach_groups() gets away with using
the latter for locking the inode and the former for removal.

Aren't redundant data structures wonderful, for obfuscation if nothing
else?

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>