1 files changed, 56 insertions, 37 deletions

diff --git a/fs/locks.c b/fs/locks.c
index a0bc03495bd4..c2c09b4798d6 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1276,7 +1276,7 @@ int fcntl_getlease(struct file *filp)
  */
 static int __setlease(struct file *filp, long arg, struct file_lock **flp)
 {
-        struct file_lock *fl, **before, **my_before = NULL, *lease = *flp;
+        struct file_lock *fl, **before, **my_before = NULL, *lease;
         struct dentry *dentry = filp->f_dentry;
         struct inode *inode = dentry->d_inode;
         int error, rdlease_count = 0, wrlease_count = 0;
@@ -1287,6 +1287,8 @@ static int __setlease(struct file *filp, long arg, struct file_lock **flp)
         if (!flp || !(*flp) || !(*flp)->fl_lmops || !(*flp)->fl_lmops->fl_break)
                 goto out;
 
+        lease = *flp;
+
         error = -EAGAIN;
         if ((arg == F_RDLCK) && (atomic_read(&inode->i_writecount) > 0))
                 goto out;
@@ -1589,7 +1591,8 @@ out:
 /* Apply the lock described by l to an open file descriptor.
  * This implements both the F_SETLK and F_SETLKW commands of fcntl().
  */
-int fcntl_setlk(struct file *filp, unsigned int cmd, struct flock __user *l)
+int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
+                struct flock __user *l)
 {
         struct file_lock *file_lock = locks_alloc_lock();
         struct flock flock;
@@ -1618,6 +1621,7 @@ int fcntl_setlk(struct file *filp, unsigned int cmd, struct flock __user *l)
                 goto out;
         }
 
+again:
         error = flock_to_posix_lock(filp, file_lock, &flock);
         if (error)
                 goto out;
@@ -1646,25 +1650,33 @@ int fcntl_setlk(struct file *filp, unsigned int cmd, struct flock __user *l)
         if (error)
                 goto out;
 
-        if (filp->f_op && filp->f_op->lock != NULL) {
+        if (filp->f_op && filp->f_op->lock != NULL)
                 error = filp->f_op->lock(filp, cmd, file_lock);
-                goto out;
-        }
+        else {
+                for (;;) {
+                        error = __posix_lock_file(inode, file_lock);
+                        if ((error != -EAGAIN) || (cmd == F_SETLK))
+                                break;
+                        error = wait_event_interruptible(file_lock->fl_wait,
+                                        !file_lock->fl_next);
+                        if (!error)
+                                continue;
 
-        for (;;) {
-                error = __posix_lock_file(inode, file_lock);
-                if ((error != -EAGAIN) || (cmd == F_SETLK))
+                        locks_delete_block(file_lock);
                         break;
-                error = wait_event_interruptible(file_lock->fl_wait,
-                                !file_lock->fl_next);
-                if (!error)
-                        continue;
+                }
+        }
 
-                locks_delete_block(file_lock);
-                break;
+        /*
+         * Attempt to detect a close/fcntl race and recover by
+         * releasing the lock that was just acquired.
+         */
+        if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
+                flock.l_type = F_UNLCK;
+                goto again;
         }
 
- out:
+out:
         locks_free_lock(file_lock);
         return error;
 }
@@ -1722,7 +1734,8 @@ out:
 /* Apply the lock described by l to an open file descriptor.
  * This implements both the F_SETLK and F_SETLKW commands of fcntl().
  */
-int fcntl_setlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
+int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
+                struct flock64 __user *l)
 {
         struct file_lock *file_lock = locks_alloc_lock();
         struct flock64 flock;
@@ -1751,6 +1764,7 @@ int fcntl_setlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
                 goto out;
         }
 
+again:
         error = flock64_to_posix_lock(filp, file_lock, &flock);
         if (error)
                 goto out;
@@ -1779,22 +1793,30 @@ int fcntl_setlk64(struct file *filp, unsigned int cmd, struct flock64 __user *l)
         if (error)
                 goto out;
 
-        if (filp->f_op && filp->f_op->lock != NULL) {
+        if (filp->f_op && filp->f_op->lock != NULL)
                 error = filp->f_op->lock(filp, cmd, file_lock);
-                goto out;
-        }
+        else {
+                for (;;) {
+                        error = __posix_lock_file(inode, file_lock);
+                        if ((error != -EAGAIN) || (cmd == F_SETLK64))
+                                break;
+                        error = wait_event_interruptible(file_lock->fl_wait,
+                                        !file_lock->fl_next);
+                        if (!error)
+                                continue;
 
-        for (;;) {
-                error = __posix_lock_file(inode, file_lock);
-                if ((error != -EAGAIN) || (cmd == F_SETLK64))
+                        locks_delete_block(file_lock);
                         break;
-                error = wait_event_interruptible(file_lock->fl_wait,
-                                !file_lock->fl_next);
-                if (!error)
-                        continue;
+                }
+        }
 
-                locks_delete_block(file_lock);
-                break;
+        /*
+         * Attempt to detect a close/fcntl race and recover by
+         * releasing the lock that was just acquired.
+         */
+        if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
+                flock.l_type = F_UNLCK;
+                goto again;
         }
 
 out:
@@ -1886,12 +1908,7 @@ void locks_remove_flock(struct file *filp)
 
         while ((fl = *before) != NULL) {
                 if (fl->fl_file == filp) {
-                        /*
-                         * We might have a POSIX lock that was created at the same time
-                         * the filp was closed for the last time. Just remove that too,
-                         * regardless of ownership, since nobody can own it.
-                         */
-                        if (IS_FLOCK(fl) || IS_POSIX(fl)) {
+                        if (IS_FLOCK(fl)) {
                                 locks_delete_lock(before);
                                 continue;
                         }
@@ -2181,21 +2198,23 @@ void steal_locks(fl_owner_t from)
 {
         struct files_struct *files = current->files;
         int i, j;
+        struct fdtable *fdt;
 
         if (from == files)
                 return;
 
         lock_kernel();
         j = 0;
+        fdt = files_fdtable(files);
         for (;;) {
                 unsigned long set;
                 i = j * __NFDBITS;
-                if (i >= files->max_fdset || i >= files->max_fds)
+                if (i >= fdt->max_fdset || i >= fdt->max_fds)
                         break;
-                set = files->open_fds->fds_bits[j++];
+                set = fdt->open_fds->fds_bits[j++];
                 while (set) {
                         if (set & 1) {
-                                struct file *file = files->fd[i];
+                                struct file *file = fdt->fd[i];
                                 if (file)
                                         __steal_locks(file, from);
                         }