1 files changed, 29 insertions, 18 deletions

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 6fbc9d8fcc36..bfecc6238083 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -24,20 +24,24 @@
 void fastcall set_close_on_exec(unsigned int fd, int flag)
 {
         struct files_struct *files = current->files;
+        struct fdtable *fdt;
         spin_lock(&files->file_lock);
+        fdt = files_fdtable(files);
         if (flag)
-                FD_SET(fd, files->close_on_exec);
+                FD_SET(fd, fdt->close_on_exec);
         else
-                FD_CLR(fd, files->close_on_exec);
+                FD_CLR(fd, fdt->close_on_exec);
         spin_unlock(&files->file_lock);
 }
 
 static inline int get_close_on_exec(unsigned int fd)
 {
         struct files_struct *files = current->files;
+        struct fdtable *fdt;
         int res;
         spin_lock(&files->file_lock);
-        res = FD_ISSET(fd, files->close_on_exec);
+        fdt = files_fdtable(files);
+        res = FD_ISSET(fd, fdt->close_on_exec);
         spin_unlock(&files->file_lock);
         return res;
 }
@@ -54,24 +58,26 @@ static int locate_fd(struct files_struct *files,
         unsigned int newfd;
         unsigned int start;
         int error;
+        struct fdtable *fdt;
 
         error = -EINVAL;
         if (orig_start >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
                 goto out;
 
+        fdt = files_fdtable(files);
 repeat:
         /*
          * Someone might have closed fd's in the range
-         * orig_start..files->next_fd
+         * orig_start..fdt->next_fd
          */
         start = orig_start;
-        if (start < files->next_fd)
-                start = files->next_fd;
+        if (start < fdt->next_fd)
+                start = fdt->next_fd;
 
         newfd = start;
-        if (start < files->max_fdset) {
-                newfd = find_next_zero_bit(files->open_fds->fds_bits,
-                        files->max_fdset, start);
+        if (start < fdt->max_fdset) {
+                newfd = find_next_zero_bit(fdt->open_fds->fds_bits,
+                        fdt->max_fdset, start);
         }
         
         error = -EMFILE;
@@ -89,8 +95,8 @@ repeat:
         if (error)
                 goto repeat;
 
-        if (start <= files->next_fd)
-                files->next_fd = newfd + 1;
+        if (start <= fdt->next_fd)
+                fdt->next_fd = newfd + 1;
         
         error = newfd;
         
@@ -101,13 +107,16 @@ out:
 static int dupfd(struct file *file, unsigned int start)
 {
         struct files_struct * files = current->files;
+        struct fdtable *fdt;
         int fd;
 
         spin_lock(&files->file_lock);
         fd = locate_fd(files, file, start);
         if (fd >= 0) {
-                FD_SET(fd, files->open_fds);
-                FD_CLR(fd, files->close_on_exec);
+                /* locate_fd() may have expanded fdtable, load the ptr */
+                fdt = files_fdtable(files);
+                FD_SET(fd, fdt->open_fds);
+                FD_CLR(fd, fdt->close_on_exec);
                 spin_unlock(&files->file_lock);
                 fd_install(fd, file);
         } else {
@@ -123,6 +132,7 @@ asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
         int err = -EBADF;
         struct file * file, *tofree;
         struct files_struct * files = current->files;
+        struct fdtable *fdt;
 
         spin_lock(&files->file_lock);
         if (!(file = fcheck(oldfd)))
@@ -148,13 +158,14 @@ asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
 
         /* Yes. It's a race. In user space. Nothing sane to do */
         err = -EBUSY;
-        tofree = files->fd[newfd];
-        if (!tofree && FD_ISSET(newfd, files->open_fds))
+        fdt = files_fdtable(files);
+        tofree = fdt->fd[newfd];
+        if (!tofree && FD_ISSET(newfd, fdt->open_fds))
                 goto out_fput;
 
-        files->fd[newfd] = file;
-        FD_SET(newfd, files->open_fds);
-        FD_CLR(newfd, files->close_on_exec);
+        fdt->fd[newfd] = file;
+        FD_SET(newfd, fdt->open_fds);
+        FD_CLR(newfd, fdt->close_on_exec);
         spin_unlock(&files->file_lock);
 
         if (tofree)