1 files changed, 21 insertions, 24 deletions

diff --git a/ipc/shm.c b/ipc/shm.c
index fefa00d310fb..d8a38b3be5dd 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1366,15 +1366,14 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
         struct shmid_kernel *shp;
         unsigned long addr = (unsigned long)shmaddr;
         unsigned long size;
-        struct file *file;
+        struct file *file, *base;
         int    err;
         unsigned long flags = MAP_SHARED;
         unsigned long prot;
         int acc_mode;
         struct ipc_namespace *ns;
         struct shm_file_data *sfd;
-        struct path path;
-        fmode_t f_mode;
+        int f_flags;
         unsigned long populate = 0;
 
         err = -EINVAL;
@@ -1407,11 +1406,11 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
         if (shmflg & SHM_RDONLY) {
                 prot = PROT_READ;
                 acc_mode = S_IRUGO;
-                f_mode = FMODE_READ;
+                f_flags = O_RDONLY;
         } else {
                 prot = PROT_READ | PROT_WRITE;
                 acc_mode = S_IRUGO | S_IWUGO;
-                f_mode = FMODE_READ | FMODE_WRITE;
+                f_flags = O_RDWR;
         }
         if (shmflg & SHM_EXEC) {
                 prot |= PROT_EXEC;
@@ -1447,46 +1446,44 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg,
                 goto out_unlock;
         }
 
-        path = shp->shm_file->f_path;
-        path_get(&path);
+        /*
+         * We need to take a reference to the real shm file to prevent the
+         * pointer from becoming stale in cases where the lifetime of the outer
+         * file extends beyond that of the shm segment.  It's not usually
+         * possible, but it can happen during remap_file_pages() emulation as
+         * that unmaps the memory, then does ->mmap() via file reference only.
+         * We'll deny the ->mmap() if the shm segment was since removed, but to
+         * detect shm ID reuse we need to compare the file pointers.
+         */
+        base = get_file(shp->shm_file);
         shp->shm_nattch++;
-        size = i_size_read(d_inode(path.dentry));
+        size = i_size_read(file_inode(base));
         ipc_unlock_object(&shp->shm_perm);
         rcu_read_unlock();
 
         err = -ENOMEM;
         sfd = kzalloc(sizeof(*sfd), GFP_KERNEL);
         if (!sfd) {
-                path_put(&path);
+                fput(base);
                 goto out_nattch;
         }
 
-        file = alloc_file(&path, f_mode,
-                          is_file_hugepages(shp->shm_file) ?
+        file = alloc_file_clone(base, f_flags,
+                          is_file_hugepages(base) ?
                                 &shm_file_operations_huge :
                                 &shm_file_operations);
         err = PTR_ERR(file);
         if (IS_ERR(file)) {
                 kfree(sfd);
-                path_put(&path);
+                fput(base);
                 goto out_nattch;
         }
 
-        file->private_data = sfd;
-        file->f_mapping = shp->shm_file->f_mapping;
         sfd->id = shp->shm_perm.id;
         sfd->ns = get_ipc_ns(ns);
-        /*
-         * We need to take a reference to the real shm file to prevent the
-         * pointer from becoming stale in cases where the lifetime of the outer
-         * file extends beyond that of the shm segment.  It's not usually
-         * possible, but it can happen during remap_file_pages() emulation as
-         * that unmaps the memory, then does ->mmap() via file reference only.
-         * We'll deny the ->mmap() if the shm segment was since removed, but to
-         * detect shm ID reuse we need to compare the file pointers.
-         */
-        sfd->file = get_file(shp->shm_file);
+        sfd->file = base;
         sfd->vm_ops = NULL;
+        file->private_data = sfd;
 
         err = security_mmap_file(file, prot, flags);
         if (err)