5 files changed, 20 insertions, 2 deletions

diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c
index 0636116210d2..01fe990d3e54 100644
--- a/arch/alpha/kernel/osf_sys.c
+++ b/arch/alpha/kernel/osf_sys.c
@@ -37,6 +37,7 @@
 #include <linux/namei.h>
 #include <linux/uio.h>
 #include <linux/vfs.h>
+#include <linux/rcupdate.h>
 
 #include <asm/fpu.h>
 #include <asm/io.h>
@@ -975,6 +976,7 @@ osf_select(int n, fd_set __user *inp, fd_set __user *outp, fd_set __user *exp,
         long timeout;
         int ret = -EINVAL;
         struct fdtable *fdt;
+        int max_fdset;
 
         timeout = MAX_SCHEDULE_TIMEOUT;
         if (tvp) {
@@ -996,8 +998,11 @@ osf_select(int n, fd_set __user *inp, fd_set __user *outp, fd_set __user *exp,
                 }
         }
 
+        rcu_read_lock();
         fdt = files_fdtable(current->files);
-        if (n < 0 || n > fdt->max_fdset)
+        max_fdset = fdt->max_fdset;
+        rcu_read_unlock();
+        if (n < 0 || n > max_fdset)
                 goto out_nofds;
 
         /*
diff --git a/arch/ia64/kernel/perfmon.c b/arch/ia64/kernel/perfmon.c
index af42cda6be80..d71731ee5b61 100644
--- a/arch/ia64/kernel/perfmon.c
+++ b/arch/ia64/kernel/perfmon.c
@@ -2218,12 +2218,13 @@ static void
 pfm_free_fd(int fd, struct file *file)
 {
         struct files_struct *files = current->files;
-        struct fdtable *fdt = files_fdtable(files);
+        struct fdtable *fdt;
 
         /* 
          * there ie no fd_uninstall(), so we do it here
          */
         spin_lock(&files->file_lock);
+        fdt = files_fdtable(files);
         rcu_assign_pointer(fdt->fd[fd], NULL);
         spin_unlock(&files->file_lock);
 
diff --git a/fs/locks.c b/fs/locks.c
index c2c09b4798d6..f7daa5f48949 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -124,6 +124,7 @@
 #include <linux/smp_lock.h>
 #include <linux/syscalls.h>
 #include <linux/time.h>
+#include <linux/rcupdate.h>
 
 #include <asm/semaphore.h>
 #include <asm/uaccess.h>
@@ -2205,6 +2206,7 @@ void steal_locks(fl_owner_t from)
 
         lock_kernel();
         j = 0;
+        rcu_read_lock();
         fdt = files_fdtable(files);
         for (;;) {
                 unsigned long set;
@@ -2222,6 +2224,7 @@ void steal_locks(fl_owner_t from)
                         set >>= 1;
                 }
         }
+        rcu_read_unlock();
         unlock_kernel();
 }
 EXPORT_SYMBOL(steal_locks);
diff --git a/fs/proc/array.c b/fs/proc/array.c
index d88d518d30f6..d84eecacbeaf 100644
--- a/fs/proc/array.c
+++ b/fs/proc/array.c
@@ -74,6 +74,7 @@
 #include <linux/file.h>
 #include <linux/times.h>
 #include <linux/cpuset.h>
+#include <linux/rcupdate.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -180,12 +181,14 @@ static inline char * task_state(struct task_struct *p, char *buffer)
                 p->gid, p->egid, p->sgid, p->fsgid);
         read_unlock(&tasklist_lock);
         task_lock(p);
+        rcu_read_lock();
         if (p->files)
                 fdt = files_fdtable(p->files);
         buffer += sprintf(buffer,
                 "FDSize:\t%d\n"
                 "Groups:\t",
                 fdt ? fdt->max_fds : 0);
+        rcu_read_unlock();
 
         group_info = p->group_info;
         get_group_info(group_info);
diff --git a/kernel/exit.c b/kernel/exit.c
index 6d2089a1bce7..ee6d8b8abef5 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -371,6 +371,12 @@ static inline void close_files(struct files_struct * files)
         struct fdtable *fdt;
 
         j = 0;
+
+        /*
+         * It is safe to dereference the fd table without RCU or
+         * ->file_lock because this is the last reference to the
+         * files structure.
+         */
         fdt = files_fdtable(files);
         for (;;) {
                 unsigned long set;