1 files changed, 8 insertions, 5 deletions

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index a73a226f2d33..8fcdc2283af5 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -120,11 +120,11 @@ void unix_inflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
 
+        spin_lock(&unix_gc_lock);
+
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
-                spin_lock(&unix_gc_lock);
-
                 if (atomic_long_inc_return(&u->inflight) == 1) {
                         BUG_ON(!list_empty(&u->link));
                         list_add_tail(&u->link, &gc_inflight_list);
@@ -132,25 +132,28 @@ void unix_inflight(struct file *fp)
                         BUG_ON(list_empty(&u->link));
                 }
                 unix_tot_inflight++;
-                spin_unlock(&unix_gc_lock);
         }
+        fp->f_cred->user->unix_inflight++;
+        spin_unlock(&unix_gc_lock);
 }
 
 void unix_notinflight(struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
 
+        spin_lock(&unix_gc_lock);
+
         if (s) {
                 struct unix_sock *u = unix_sk(s);
 
-                spin_lock(&unix_gc_lock);
                 BUG_ON(list_empty(&u->link));
 
                 if (atomic_long_dec_and_test(&u->inflight))
                         list_del_init(&u->link);
                 unix_tot_inflight--;
-                spin_unlock(&unix_gc_lock);
         }
+        fp->f_cred->user->unix_inflight--;
+        spin_unlock(&unix_gc_lock);
 }
 
 static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),