don't bother with {get,put}_write_access() on non-regular files

it's pointless and actually leads to wrong behaviour in at least one
moderately convoluted case (pipe(), close one end, try to get to
another via /proc/*/fd and run into ETXTBUSY).

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

2 files changed, 9 insertions, 21 deletions

diff --git a/fs/file_table.c b/fs/file_table.c
index 5b24008ea4f6..79ecae62209a 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -209,10 +209,10 @@ static void drop_file_write_access(struct file *file)
         struct dentry *dentry = file->f_path.dentry;
         struct inode *inode = dentry->d_inode;
 
-        put_write_access(inode);
-
         if (special_file(inode->i_mode))
                 return;
+
+        put_write_access(inode);
         if (file_check_writeable(file) != 0)
                 return;
         __mnt_drop_write(mnt);
diff --git a/fs/open.c b/fs/open.c
index b9ed8b25c108..2ed7325f713e 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -641,23 +641,12 @@ out:
 static inline int __get_file_write_access(struct inode *inode,
                                           struct vfsmount *mnt)
 {
-        int error;
-        error = get_write_access(inode);
+        int error = get_write_access(inode);
         if (error)
                 return error;
-        /*
-         * Do not take mount writer counts on
-         * special files since no writes to
-         * the mount itself will occur.
-         */
-        if (!special_file(inode->i_mode)) {
-                /*
-                 * Balanced in __fput()
-                 */
-                error = __mnt_want_write(mnt);
-                if (error)
-                        put_write_access(inode);
-        }
+        error = __mnt_want_write(mnt);
+        if (error)
+                put_write_access(inode);
         return error;
 }
 
@@ -690,12 +679,11 @@ static int do_dentry_open(struct file *f,
 
         path_get(&f->f_path);
         inode = f->f_inode = f->f_path.dentry->d_inode;
-        if (f->f_mode & FMODE_WRITE) {
+        if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
                 error = __get_file_write_access(inode, f->f_path.mnt);
                 if (error)
                         goto cleanup_file;
-                if (!special_file(inode->i_mode))
-                        file_take_write(f);
+                file_take_write(f);
         }
 
         f->f_mapping = inode->i_mapping;
@@ -742,7 +730,6 @@ static int do_dentry_open(struct file *f,
 cleanup_all:
         fops_put(f->f_op);
         if (f->f_mode & FMODE_WRITE) {
-                put_write_access(inode);
                 if (!special_file(inode->i_mode)) {
                         /*
                          * We don't consider this a real
@@ -750,6 +737,7 @@ cleanup_all:
                          * because it all happenend right
                          * here, so just reset the state.
                          */
+                        put_write_access(inode);
                         file_reset_write(f);
                         __mnt_drop_write(f->f_path.mnt);
                 }