author: Andrew Morton <akpm@linux-foundation.org> 2013-07-08 14:24:15 -0700
committer: Al Viro <viro@zeniv.linux.org.uk> 2013-07-13 13:27:42 +0400
commit: 64372501e2af9b11e2ffd1ff79345dc4b1abe539
parent: bb458c644a59dbba3a1fe59b27106c5e68e1c4bd
Commit Summary:
Diffstat:
1 file changed, 6 insertions, 0 deletions
diff --git a/fs/file_table.c b/fs/file_table.c
index 08e719b884ca..b9a77ad08b4d 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -313,6 +313,12 @@ void fput(struct file *file)
init_task_work(&file->f_u.fu_rcuhead, ____fput);
if (!task_work_add(task, &file->f_u.fu_rcuhead, true))
return;
+ /*
+ * After this task has run exit_task_work(),
+ * task_work_add() will fail. free_ipc_ns()->
+ * shm_destroy() can do this. Fall through to delayed
+ * fput to avoid leaking *file.
+ */
}
spin_lock_irqsave(&delayed_fput_lock, flags);
list_add(&file->f_u.fu_list, &delayed_fput_list);