diff options
-rw-r--r-- | fs/file_table.c | 9 | ||||
-rw-r--r-- | fs/notify/notification.c | 13 |
2 files changed, 22 insertions, 0 deletions
diff --git a/fs/file_table.c b/fs/file_table.c index 5c7d10ead4ad..b8a0bb63cbd7 100644 --- a/fs/file_table.c +++ b/fs/file_table.c | |||
@@ -230,6 +230,15 @@ static void __fput(struct file *file) | |||
230 | might_sleep(); | 230 | might_sleep(); |
231 | 231 | ||
232 | fsnotify_close(file); | 232 | fsnotify_close(file); |
233 | |||
234 | /* | ||
235 | * fsnotify_create_event may have taken one or more references on this | ||
236 | * file. If it did so it left one reference for us to drop to make sure | ||
237 | * its calls to fput could not prematurely destroy the file. | ||
238 | */ | ||
239 | if (atomic_long_read(&file->f_count)) | ||
240 | return fput(file); | ||
241 | |||
233 | /* | 242 | /* |
234 | * The function eventpoll_release() should be the first called | 243 | * The function eventpoll_release() should be the first called |
235 | * in the file cleanup chain. | 244 | * in the file cleanup chain. |
diff --git a/fs/notify/notification.c b/fs/notify/notification.c index c106cdd7ff5e..d6c435adc7a2 100644 --- a/fs/notify/notification.c +++ b/fs/notify/notification.c | |||
@@ -426,6 +426,19 @@ struct fsnotify_event *fsnotify_create_event(struct inode *to_tell, __u32 mask, | |||
426 | switch (data_type) { | 426 | switch (data_type) { |
427 | case FSNOTIFY_EVENT_FILE: { | 427 | case FSNOTIFY_EVENT_FILE: { |
428 | event->file = data; | 428 | event->file = data; |
429 | /* | ||
430 | * if this file is about to disappear hold an extra reference | ||
431 | * until we return to __fput so we don't have to worry about | ||
432 | * future get/put destroying the file under us or generating | ||
433 | * additional events. Notice that we change f_mode without | ||
434 | * holding f_lock. This is safe since this is the only possible | ||
435 | * reference to this object in the kernel (it was about to be | ||
436 | * freed, remember?) | ||
437 | */ | ||
438 | if (!atomic_long_read(&event->file->f_count)) { | ||
439 | event->file->f_mode |= FMODE_NONOTIFY; | ||
440 | get_file(event->file); | ||
441 | } | ||
429 | get_file(event->file); | 442 | get_file(event->file); |
430 | break; | 443 | break; |
431 | } | 444 | } |