1 files changed, 17 insertions, 16 deletions

diff --git a/fs/file_table.c b/fs/file_table.c
index 485dc0eddd67..b44e4c559786 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -227,7 +227,7 @@ static void __fput(struct file *file)
 {
         struct dentry *dentry = file->f_path.dentry;
         struct vfsmount *mnt = file->f_path.mnt;
-        struct inode *inode = dentry->d_inode;
+        struct inode *inode = file->f_inode;
 
         might_sleep();
 
@@ -265,18 +265,15 @@ static void __fput(struct file *file)
         mntput(mnt);
 }
 
-static DEFINE_SPINLOCK(delayed_fput_lock);
-static LIST_HEAD(delayed_fput_list);
+static LLIST_HEAD(delayed_fput_list);
 static void delayed_fput(struct work_struct *unused)
 {
-        LIST_HEAD(head);
-        spin_lock_irq(&delayed_fput_lock);
-        list_splice_init(&delayed_fput_list, &head);
-        spin_unlock_irq(&delayed_fput_lock);
-        while (!list_empty(&head)) {
-                struct file *f = list_first_entry(&head, struct file, f_u.fu_list);
-                list_del_init(&f->f_u.fu_list);
-                __fput(f);
+        struct llist_node *node = llist_del_all(&delayed_fput_list);
+        struct llist_node *next;
+
+        for (; node; node = next) {
+                next = llist_next(node);
+                __fput(llist_entry(node, struct file, f_u.fu_llist));
         }
 }
 
@@ -306,18 +303,22 @@ void fput(struct file *file)
 {
         if (atomic_long_dec_and_test(&file->f_count)) {
                 struct task_struct *task = current;
-                unsigned long flags;
 
                 file_sb_list_del(file);
                 if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) {
                         init_task_work(&file->f_u.fu_rcuhead, ____fput);
                         if (!task_work_add(task, &file->f_u.fu_rcuhead, true))
                                 return;
+                        /*
+                         * After this task has run exit_task_work(),
+                         * task_work_add() will fail.  free_ipc_ns()->
+                         * shm_destroy() can do this.  Fall through to delayed
+                         * fput to avoid leaking *file.
+                         */
                 }
-                spin_lock_irqsave(&delayed_fput_lock, flags);
-                list_add(&file->f_u.fu_list, &delayed_fput_list);
-                schedule_work(&delayed_fput_work);
-                spin_unlock_irqrestore(&delayed_fput_lock, flags);
+
+                if (llist_add(&file->f_u.fu_llist, &delayed_fput_list))
+                        schedule_work(&delayed_fput_work);
         }
 }