diff --git a/[refs] b/[refs]
index 96beb0d0afb0..4dcc68486548 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4d36a9e65d4966b433b2f3424d9457468bc80e00
+refs/heads/master: 9ce209d64d820a6d5ed6b952e2c0f917faad6031
diff --git a/trunk/fs/eventpoll.c b/trunk/fs/eventpoll.c
index 99368bda0261..aec5c13f6341 100644
--- a/trunk/fs/eventpoll.c
+++ b/trunk/fs/eventpoll.c
@@ -930,8 +930,15 @@ static int ep_send_events(struct eventpoll *ep, struct epoll_event __user *event
 	 * inside the main ready-list here.
 	 */
 	for (nepi = ep->ovflist; (epi = nepi) != NULL;
-	     nepi = epi->next, epi->next = EP_UNACTIVE_PTR)
-		list_add_tail(&epi->rdllink, &ep->rdllist);
+	     nepi = epi->next, epi->next = EP_UNACTIVE_PTR) {
+		/*
+		 * If the above loop quit with errors, the epoll item might still
+		 * be linked to "txlist", and the list_splice() done below will
+		 * take care of those cases.
+		 */
+		if (!ep_is_linked(&epi->rdllink))
+			list_add_tail(&epi->rdllink, &ep->rdllist);
+	}
 	/*
 	 * We need to set back ep->ovflist to EP_UNACTIVE_PTR, so that after
 	 * releasing the lock, events will be queued in the normal way inside