2.6.25.2

 fs

diff --git a/fs/locks.c b/fs/locks.c
index 43c0af2..159e0f6 100644
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1750,6 +1750,7 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd,
    struct file_lock *file_lock = locks_alloc_lock();
    struct flock flock;
    struct inode *inode;
+   struct file *f;
    int error;
 
    if (file_lock == NULL)
@@ -1822,7 +1823,15 @@ again:
     * Attempt to detect a close/fcntl race and recover by
     * releasing the lock that was just acquired.
     */
-   if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
+   /*
+    * we need that spin_lock here - it prevents reordering between
+    * update of inode->i_flock and check for it done in close().
+    * rcu_read_lock() wouldn't do.
+    */
+   spin_lock(¤t->files->file_lock);
+   f = fcheck(fd);
+   spin_unlock(¤t->files->file_lock);
+   if (!error && f != filp && flock.l_type != F_UNLCK) {
       flock.l_type = F_UNLCK;
       goto again;
    }
@@ -1878,6 +1887,7 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd,
    struct file_lock *file_lock = locks_alloc_lock();
    struct flock64 flock;
    struct inode *inode;
+   struct file *f;
    int error;
 
    if (file_lock == NULL)
@@ -1950,7 +1960,10 @@ again:
     * Attempt to detect a close/fcntl race and recover by
     * releasing the lock that was just acquired.
     */
-   if (!error && fcheck(fd) != filp && flock.l_type != F_UNLCK) {
+   spin_lock(¤t->files->file_lock);
+   f = fcheck(fd);
+   spin_unlock(¤t->files->file_lock);
+   if (!error && f != filp && flock.l_type != F_UNLCK) {
       flock.l_type = F_UNLCK;
       goto again;
    }