From: Andrew Morton <akpm@linux-foundation.org>
Date: Wed, 19 Jun 2013 00:05:20 +0000 (+1000)
Subject: fput-task_work_add-can-fail-if-the-caller-has-passed-exit_task_work-fix
X-Git-Tag: next-20130619~2^2~656
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=17e3675fe3a85641d5413afef3e74066570778d5;p=karo-tx-linux.git

fput-task_work_add-can-fail-if-the-caller-has-passed-exit_task_work-fix

add comment

Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andrey Vagin <avagin@openvz.org>
Cc: David Howells <dhowells@redhat.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

diff --git a/fs/file_table.c b/fs/file_table.c
index 485dc0eddd67..3a2bbc5b2cf5 100644
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -313,6 +313,12 @@ void fput(struct file *file)
 			init_task_work(&file->f_u.fu_rcuhead, ____fput);
 			if (!task_work_add(task, &file->f_u.fu_rcuhead, true))
 				return;
+			/*
+			 * After this task has run exit_task_work(),
+			 * task_work_add() will fail.  free_ipc_ns()->
+			 * shm_destroy() can do this.  Fall through to delayed
+			 * fput to avoid leaking *file.
+			 */
 		}
 		spin_lock_irqsave(&delayed_fput_lock, flags);
 		list_add(&file->f_u.fu_list, &delayed_fput_list);