Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6: (39 commits)
  [PATCH] fix RLIM_NOFILE handling
  [PATCH] get rid of corner case in dup3() entirely
  [PATCH] remove remaining namei_{32,64}.h crap
  [PATCH] get rid of indirect users of namei.h
  [PATCH] get rid of __user_path_lookup_open
  [PATCH] f_count may wrap around
  [PATCH] dup3 fix
  [PATCH] don't pass nameidata to __ncp_lookup_validate()
  [PATCH] don't pass nameidata to gfs2_lookupi()
  [PATCH] new (local) helper: user_path_parent()
  [PATCH] sanitize __user_walk_fd() et.al.
  [PATCH] preparation to __user_walk_fd cleanup
  [PATCH] kill nameidata passing to permission(), rename to inode_permission()
  [PATCH] take noexec checks to very few callers that care
  Re: [PATCH 3/6] vfs: open_exec cleanup
  [patch 4/4] vfs: immutable inode checking cleanup
  [patch 3/4] fat: dont call notify_change
  [patch 2/4] vfs: utimes cleanup
  [patch 1/4] vfs: utimes: move owner check into inode_change_ok()
  [PATCH] vfs: use kstrdup() and check failing allocation
  ...

1 files changed, 17 insertions, 16 deletions

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 9679fcbdeaa0..61d625136813 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -64,11 +64,6 @@ static int locate_fd(unsigned int orig_start, int cloexec)
         struct fdtable *fdt;
 
         spin_lock(&files->file_lock);
-
-        error = -EINVAL;
-        if (orig_start >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
-                goto out;
-
 repeat:
         fdt = files_fdtable(files);
         /*
@@ -83,10 +78,6 @@ repeat:
         if (start < fdt->max_fds)
                 newfd = find_next_zero_bit(fdt->open_fds->fds_bits,
                                            fdt->max_fds, start);
-        
-        error = -EMFILE;
-        if (newfd >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
-                goto out;
 
         error = expand_files(files, newfd);
         if (error < 0)
@@ -135,20 +126,20 @@ asmlinkage long sys_dup3(unsigned int oldfd, unsigned int newfd, int flags)
         if ((flags & ~O_CLOEXEC) != 0)
                 return -EINVAL;
 
+        if (unlikely(oldfd == newfd))
+                return -EINVAL;
+
         spin_lock(&files->file_lock);
         if (!(file = fcheck(oldfd)))
                 goto out_unlock;
-        err = newfd;
-        if (newfd == oldfd)
-                goto out_unlock;
-        err = -EBADF;
-        if (newfd >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
-                goto out_unlock;
         get_file(file);                 /* We are now finished with oldfd */
 
         err = expand_files(files, newfd);
-        if (err < 0)
+        if (unlikely(err < 0)) {
+                if (err == -EMFILE)
+                        err = -EBADF;
                 goto out_fput;
+        }
 
         /* To avoid races with open() and dup(), we will mark the fd as
          * in-use in the open-file bitmap throughout the entire dup2()
@@ -189,6 +180,14 @@ out_fput:
 
 asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
 {
+        if (unlikely(newfd == oldfd)) { /* corner case */
+                struct files_struct *files = current->files;
+                rcu_read_lock();
+                if (!fcheck_files(files, oldfd))
+                        oldfd = -EBADF;
+                rcu_read_unlock();
+                return oldfd;
+        }
         return sys_dup3(oldfd, newfd, 0);
 }
 
@@ -321,6 +320,8 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
         switch (cmd) {
         case F_DUPFD:
         case F_DUPFD_CLOEXEC:
+                if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
+                        break;
                 get_file(filp);
                 err = dupfd(filp, arg, cmd == F_DUPFD_CLOEXEC);
                 break;