1 files changed, 10 insertions, 13 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index a32d28ce31cd..6aaf657adb87 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1068,7 +1068,6 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
                 mapping_cap_account_dirty(vma->vm_file->f_mapping);
 }
 
-
 unsigned long mmap_region(struct file *file, unsigned long addr,
                           unsigned long len, unsigned long flags,
                           unsigned int vm_flags, unsigned long pgoff,
@@ -1181,22 +1180,20 @@ munmap_back:
         if (vma_wants_writenotify(vma))
                 vma->vm_page_prot = vm_get_page_prot(vm_flags & ~VM_SHARED);
 
-        if (!file || !vma_merge(mm, prev, addr, vma->vm_end,
+        if (file && vma_merge(mm, prev, addr, vma->vm_end,
                         vma->vm_flags, NULL, file, pgoff, vma_policy(vma))) {
-                file = vma->vm_file;
-                vma_link(mm, vma, prev, rb_link, rb_parent);
-                if (correct_wcount)
-                        atomic_inc(&inode->i_writecount);
-        } else {
-                if (file) {
-                        if (correct_wcount)
-                                atomic_inc(&inode->i_writecount);
-                        fput(file);
-                }
                 mpol_free(vma_policy(vma));
                 kmem_cache_free(vm_area_cachep, vma);
+                fput(file);
+        } else {
+                vma_link(mm, vma, prev, rb_link, rb_parent);
+                file = vma->vm_file;
         }
-out:    
+
+        /* Once vma denies write, undo our temporary denial count */
+        if (correct_wcount)
+                atomic_inc(&inode->i_writecount);
+out:
         mm->total_vm += len >> PAGE_SHIFT;
         vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
         if (vm_flags & VM_LOCKED) {