Merge tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull file descriptor fix from Al Viro:
 "Fix for breakage in #work.fd this window"

* tag 'pull-work.fd-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  fix the breakage in close_fd_get_file() calling conventions change

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 9e0982289ddede54c8ab15d1d7d3e7aa41bbb40c..362c0deb65f1138e4640dd5278ee39ba1ec905e1 100644 (file)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1886,6 +1886,8 @@ static void binder_deferred_fd_close(int fd)
        init_task_work(&twcb->twork, binder_do_fd_close);
        twcb->file = close_fd_get_file(fd);
        if (twcb->file) {
+               // pin it until binder_do_fd_close(); see comments there
+               get_file(twcb->file);
                filp_close(twcb->file, current->files);
                task_work_add(current, &twcb->twork, TWA_RESUME);
        } else {

diff --git a/fs/file.c b/fs/file.c
index dd6692048f4f1111dc7047b964723ff0d03ebafb..3bcc1ecc314a78e90daedecf6a7ec575c642504a 100644 (file)
--- a/fs/file.c
+++ b/fs/file.c
@@ -800,8 +800,7 @@ struct file *__close_fd_get_file(unsigned int fd)
 
 /*
  * variant of close_fd that gets a ref on the file for later fput.
- * The caller must ensure that filp_close() called on the file, and then
- * an fput().
+ * The caller must ensure that filp_close() called on the file.
  */
 struct file *close_fd_get_file(unsigned int fd)
 {

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 86f9df56526b2d13060f43eff1dd74d7635b4114..3aab4182fd892173e16b900fa437d47094195db0 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -6010,7 +6010,7 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
        struct files_struct *files = current->files;
        struct io_close *close = &req->close;
        struct fdtable *fdt;
-       struct file *file = NULL;
+       struct file *file;
        int ret = -EBADF;
 
        if (req->close.file_slot) {
@@ -6029,7 +6029,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
                        lockdep_is_held(&files->file_lock));
        if (!file || file->f_op == &io_uring_fops) {
                spin_unlock(&files->file_lock);
-               file = NULL;
                goto err;
        }
 
@@ -6049,8 +6048,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags)
 err:
        if (ret < 0)
                req_set_fail(req);
-       if (file)
-               fput(file);
        __io_req_complete(req, issue_flags, ret, 0);
        return 0;
 }