---

yaml
---
r: 117831
b: refs/heads/master
c: 9ce209d
h: refs/heads/master
i:
  117829: f317150
  117827: 196caaf
  117823: deea774
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4d36a9e65d4966b433b2f3424d9457468bc80e00
+refs/heads/master: 9ce209d64d820a6d5ed6b952e2c0f917faad6031

trunk/fs/eventpoll.c

@@ -930,8 +930,15 @@ static int ep_send_events(struct eventpoll *ep, struct epoll_event __user *event
 	 * inside the main ready-list here.
 	 */
 	for (nepi = ep->ovflist; (epi = nepi) != NULL;
-	     nepi = epi->next, epi->next = EP_UNACTIVE_PTR)
-		list_add_tail(&epi->rdllink, &ep->rdllist);
+	     nepi = epi->next, epi->next = EP_UNACTIVE_PTR) {
+		/*
+		 * If the above loop quit with errors, the epoll item might still
+		 * be linked to "txlist", and the list_splice() done below will
+		 * take care of those cases.
+		 */
+		if (!ep_is_linked(&epi->rdllink))
+			list_add_tail(&epi->rdllink, &ep->rdllist);
+	}
 	/*
 	 * We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after
 	 * releasing the lock, events will be queued in the normal way inside