vfs/fsnotify: fsnotify_close can delay the final work in fput

[net-next-2.6.git] / fs / file_table.c

diff --git a/fs/file_table.c b/fs/file_table.c
index 32d12b78bac8e2c05a80dc53386b355bdc10ef73..b8a0bb63cbd7c877cd69ac3b445c385ed2e60ba3 100644 (file)
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -194,14 +194,6 @@ struct file *alloc_file(struct path *path, fmode_t mode,
 }
 EXPORT_SYMBOL(alloc_file);
 
-void fput(struct file *file)
-{
-       if (atomic_long_dec_and_test(&file->f_count))
-               __fput(file);
-}
-
-EXPORT_SYMBOL(fput);
-
 /**
  * drop_file_write_access - give up ability to write to a file
  * @file: the file to which we will stop writing
@@ -227,10 +219,9 @@ void drop_file_write_access(struct file *file)
 }
 EXPORT_SYMBOL_GPL(drop_file_write_access);
 
-/* __fput is called from task context when aio completion releases the last
- * last use of a struct file *.  Do not use otherwise.
+/* the real guts of fput() - releasing the last reference to file
  */
-void __fput(struct file *file)
+static void __fput(struct file *file)
 {
        struct dentry *dentry = file->f_path.dentry;
        struct vfsmount *mnt = file->f_path.mnt;
@@ -239,6 +230,15 @@ void __fput(struct file *file)
        might_sleep();
 
        fsnotify_close(file);
+
+       /*
+        * fsnotify_create_event may have taken one or more references on this
+        * file.  If it did so it left one reference for us to drop to make sure
+        * its calls to fput could not prematurely destroy the file.
+        */
+       if (atomic_long_read(&file->f_count))
+               return fput(file);
+
        /*
         * The function eventpoll_release() should be the first called
         * in the file cleanup chain.
@@ -268,6 +268,14 @@ void __fput(struct file *file)
        mntput(mnt);
 }
 
+void fput(struct file *file)
+{
+       if (atomic_long_dec_and_test(&file->f_count))
+               __fput(file);
+}
+
+EXPORT_SYMBOL(fput);
+
 struct file *fget(unsigned int fd)
 {
        struct file *file;