debugfs: fix use-after-free on symlink traversal

[linux.git] / fs / file_table.c

diff --git a/fs/file_table.c b/fs/file_table.c
index 5679e7fcb6b0a47d972b34a58478aeaa1456acf0..155d7514a0943d729f43f7f4560ab9e50fa7a60a 100644 (file)
--- a/fs/file_table.c
+++ b/fs/file_table.c
@@ -326,9 +326,9 @@ void flush_delayed_fput(void)
 
 static DECLARE_DELAYED_WORK(delayed_fput_work, delayed_fput);
 
-void fput(struct file *file)
+void fput_many(struct file *file, unsigned int refs)
 {
-       if (atomic_long_dec_and_test(&file->f_count)) {
+       if (atomic_long_sub_and_test(refs, &file->f_count)) {
                struct task_struct *task = current;
 
                if (likely(!in_interrupt() && !(task->flags & PF_KTHREAD))) {
@@ -347,6 +347,11 @@ void fput(struct file *file)
        }
 }
 
+void fput(struct file *file)
+{
+       fput_many(file, 1);
+}
+
 /*
  * synchronous analog of fput(); for kernel threads that might be needed
  * in some umount() (and thus can't use flush_delayed_fput() without