summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2022-06-06 03:14:03 +0300
committerLinus Torvalds <torvalds@linux-foundation.org>2022-06-06 03:14:03 +0300
commit6684cf42906ff5f44580e16a1f898e89c19aabd5 (patch)
treeb0370221df3a99967a42455610365043deb36d0b
parent815b196c7057356e7ffa9ce97892cb5fd5de17e0 (diff)
parent40a1926022d128057376d35167128a7c74e3dca4 (diff)
downloadlinux-6684cf42906ff5f44580e16a1f898e89c19aabd5.tar.xz
Merge tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull file descriptor fix from Al Viro: "Fix for breakage in #work.fd this window" * tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: fix the breakage in close_fd_get_file() calling conventions change
-rw-r--r--drivers/android/binder.c2
-rw-r--r--fs/file.c3
-rw-r--r--fs/io_uring.c5
3 files changed, 4 insertions, 6 deletions
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 9e0982289dde..362c0deb65f1 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1886,6 +1886,8 @@ static void binder_deferred_fd_close(int fd)
init_task_work(&twcb->twork, binder_do_fd_close);
twcb->file = close_fd_get_file(fd);
if (twcb->file) {
+ // pin it until binder_do_fd_close(); see comments there
+ get_file(twcb->file);
filp_close(twcb->file, current->files);
task_work_add(current, &twcb->twork, TWA_RESUME);
} else {
diff --git a/fs/file.c b/fs/file.c
index dd6692048f4f..3bcc1ecc314a 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -800,8 +800,7 @@ struct file *__close_fd_get_file(unsigned int fd)
/*
* variant of close_fd that gets a ref on the file for later fput.
- * The caller must ensure that filp_close() called on the file, and then
- * an fput().
+ * The caller must ensure that filp_close() called on the file.
*/
struct file *close_fd_get_file(unsigned int fd)
{
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 86f9df56526b..3aab4182fd89 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6010,7 +6010,7 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
struct files_struct *files = current->files;
struct io_close *close = &req->close;
struct fdtable *fdt;
- struct file *file = NULL;
+ struct file *file;
int ret = -EBADF;
if (req->close.file_slot) {
@@ -6029,7 +6029,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
lockdep_is_held(&files->file_lock));
if (!file || file->f_op == &io_uring_fops) {
spin_unlock(&files->file_lock);
- file = NULL;
goto err;
}
@@ -6049,8 +6048,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
err:
if (ret < 0)
req_set_fail(req);
- if (file)
- fput(file);
__io_req_complete(req, issue_flags, ret, 0);
return 0;
}