Merge tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
Pull file descriptor fix from Al Viro:
"Fix for breakage in #work.fd this window"
* tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
fix the breakage in close_fd_get_file() calling conventions change
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 9e09822..362c0de 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1886,6 +1886,8 @@
init_task_work(&twcb->twork, binder_do_fd_close);
twcb->file = close_fd_get_file(fd);
if (twcb->file) {
+ // pin it until binder_do_fd_close(); see comments there
+ get_file(twcb->file);
filp_close(twcb->file, current->files);
task_work_add(current, &twcb->twork, TWA_RESUME);
} else {
diff --git a/fs/file.c b/fs/file.c
index dd66920..3bcc1ec 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -800,8 +800,7 @@
/*
* variant of close_fd that gets a ref on the file for later fput.
- * The caller must ensure that filp_close() called on the file, and then
- * an fput().
+ * The caller must ensure that filp_close() called on the file.
*/
struct file *close_fd_get_file(unsigned int fd)
{
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 86f9df5..3aab418 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6010,7 +6010,7 @@
struct files_struct *files = current->files;
struct io_close *close = &req->close;
struct fdtable *fdt;
- struct file *file = NULL;
+ struct file *file;
int ret = -EBADF;
if (req->close.file_slot) {
@@ -6029,7 +6029,6 @@
lockdep_is_held(&files->file_lock));
if (!file || file->f_op == &io_uring_fops) {
spin_unlock(&files->file_lock);
- file = NULL;
goto err;
}
@@ -6049,8 +6048,6 @@
err:
if (ret < 0)
req_set_fail(req);
- if (file)
- fput(file);
__io_req_complete(req, issue_flags, ret, 0);
return 0;
}
