1 files changed, 46 insertions, 2 deletions

diff --git a/fs/file_table.c b/fs/file_table.c
index 6d27befe2d48..7a0a9b872251 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -42,6 +42,7 @@ static inline void file_free_rcu(struct rcu_head *head)
 static inline void file_free(struct file *f)
 {
         percpu_counter_dec(&nr_files);
+        file_check_state(f);
         call_rcu(&f->f_u.fu_rcuhead, file_free_rcu);
 }
 
@@ -83,6 +84,12 @@ int proc_nr_files(ctl_table *table, int write, struct file *filp,
 /* Find an unused file structure and return a pointer to it.
  * Returns NULL, if there are no more free file structures or
  * we run out of memory.
+ *
+ * Be very careful using this.  You are responsible for
+ * getting write access to any mount that you might assign
+ * to this filp, if it is opened for write.  If this is not
+ * done, you will imbalance int the mount's writer count
+ * and a warning at __fput() time.
  */
 struct file *get_empty_filp(void)
 {
@@ -193,6 +200,18 @@ int init_file(struct file *file, struct vfsmount *mnt, struct dentry *dentry,
         file->f_mapping = dentry->d_inode->i_mapping;
         file->f_mode = mode;
         file->f_op = fop;
+
+        /*
+         * These mounts don't really matter in practice
+         * for r/o bind mounts.  They aren't userspace-
+         * visible.  We do this for consistency, and so
+         * that we can do debugging checks at __fput()
+         */
+        if ((mode & FMODE_WRITE) && !special_file(dentry->d_inode->i_mode)) {
+                file_take_write(file);
+                error = mnt_want_write(mnt);
+                WARN_ON(error);
+        }
         return error;
 }
 EXPORT_SYMBOL(init_file);
@@ -205,6 +224,31 @@ void fput(struct file *file)
 
 EXPORT_SYMBOL(fput);
 
+/**
+ * drop_file_write_access - give up ability to write to a file
+ * @file: the file to which we will stop writing
+ *
+ * This is a central place which will give up the ability
+ * to write to @file, along with access to write through
+ * its vfsmount.
+ */
+void drop_file_write_access(struct file *file)
+{
+        struct vfsmount *mnt = file->f_path.mnt;
+        struct dentry *dentry = file->f_path.dentry;
+        struct inode *inode = dentry->d_inode;
+
+        put_write_access(inode);
+
+        if (special_file(inode->i_mode))
+                return;
+        if (file_check_writeable(file) != 0)
+                return;
+        mnt_drop_write(mnt);
+        file_release_write(file);
+}
+EXPORT_SYMBOL_GPL(drop_file_write_access);
+
 /* __fput is called from task context when aio completion releases the last
  * last use of a struct file *.  Do not use otherwise.
  */
@@ -230,10 +274,10 @@ void __fput(struct file *file)
         if (unlikely(S_ISCHR(inode->i_mode) && inode->i_cdev != NULL))
                 cdev_put(inode->i_cdev);
         fops_put(file->f_op);
-        if (file->f_mode & FMODE_WRITE)
-                put_write_access(inode);
         put_pid(file->f_owner.pid);
         file_kill(file);
+        if (file->f_mode & FMODE_WRITE)
+                drop_file_write_access(file);
         file->f_path.dentry = NULL;
         file->f_path.mnt = NULL;
         file_free(file);