From 3055627882645f518d34aa26eda51afa59c3feac Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Wed, 11 Dec 2019 14:10:35 -0700 Subject: [PATCH 2485/2944] fs: move filp_close() outside of __close_fd_get_file() fix #32014790 commit 6e802a4ba056a6f2f51ac9d54eead3ed6f9829a2 upstream. Just one caller of this, and just use filp_close() there manually. This is important to allow async close/removal of the fd. [jeffle: Backport Notes] This patch should be a preparation for commit b5dba59e0cf7 ("io_uring: add support for IORING_OP_CLOSE") but sadly we missed it. __close_fd_get_file() was first introduced in commit 80cd795630d6 ("binder: fix use-after-free due to ksys_close() during fdget()"), and drivers/android/binder.c:binder_deferred_fd_close() was the only caller at that time. When Joseph bacported this patch, only the __close_fd_get_file() part was backported. Thus currently io_uring is the only caller of this fucntion. Signed-off-by: Jens Axboe Signed-off-by: Jeffle Xu Reviewed-by: Joseph Qi --- fs/file.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/file.c b/fs/file.c index 7e3349a..473d219 100644 --- a/fs/file.c +++ b/fs/file.c @@ -647,7 +647,9 @@ int __close_fd(struct files_struct *files, unsigned fd) EXPORT_SYMBOL(__close_fd); /* for ksys_close() */ /* - * variant of __close_fd that gets a ref on the file for later fput + * variant of __close_fd that gets a ref on the file for later fput. + * The caller must ensure that filp_close() called on the file, and then + * an fput(). */ int __close_fd_get_file(unsigned int fd, struct file **res) { @@ -667,7 +669,7 @@ int __close_fd_get_file(unsigned int fd, struct file **res) spin_unlock(&files->file_lock); get_file(file); *res = file; - return filp_close(file, files); + return 0; out_unlock: spin_unlock(&files->file_lock); -- 1.8.3.1