Commit d2ea4d254d04 for kernel

commit d2ea4d254d04a89e17504af0230c7268e3cac6bf
Author: Christian Brauner <brauner@kernel.org>
Date:   Sat Dec 13 08:45:23 2025 +0100

    file: ensure cleanup

    Brown paper bag time. This is a silly oversight where I missed to drop
    the error condition checking to ensure we clean up on early error
    returns. I have an internal unit testset coming up for this which will
    catch all such issues going forward.

    Reported-by: Chris Mason <clm@fb.com>
    Reported-by: Jeff Layton <jlayton@kernel.org>
    Fixes: 011703a9acd7 ("file: add FD_{ADD,PREPARE}()")
    Signed-off-by: Christian Brauner <brauner@kernel.org>
    Reviewed-by: Jeff Layton <jlayton@kernel.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/include/linux/file.h b/include/linux/file.h
index cf389fde9bc2..27484b444d31 100644
--- a/include/linux/file.h
+++ b/include/linux/file.h
@@ -161,12 +161,10 @@ typedef struct fd_prepare class_fd_prepare_t;
 /* Do not use directly. */
 static inline void class_fd_prepare_destructor(const struct fd_prepare *fdf)
 {
-	if (unlikely(fdf->err)) {
-		if (likely(fdf->__fd >= 0))
-			put_unused_fd(fdf->__fd);
-		if (unlikely(!IS_ERR_OR_NULL(fdf->__file)))
-			fput(fdf->__file);
-	}
+	if (unlikely(fdf->__fd >= 0))
+		put_unused_fd(fdf->__fd);
+	if (unlikely(!IS_ERR_OR_NULL(fdf->__file)))
+		fput(fdf->__file);
 }

 /* Do not use directly. */
@@ -230,7 +228,8 @@ static inline int class_fd_prepare_lock_err(const struct fd_prepare *fdf)
 		VFS_WARN_ON_ONCE(fdp->__fd < 0);               \
 		VFS_WARN_ON_ONCE(IS_ERR_OR_NULL(fdp->__file)); \
 		fd_install(fdp->__fd, fdp->__file);            \
-		fdp->__fd;                                     \
+		retain_and_null_ptr(fdp->__file);              \
+		take_fd(fdp->__fd);                            \
 	})

 /* Do not use directly. */