1 files changed, 39 insertions, 21 deletions

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 6fbc9d8fcc36..863b46e0d78a 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -16,6 +16,7 @@
 #include <linux/security.h>
 #include <linux/ptrace.h>
 #include <linux/signal.h>
+#include <linux/rcupdate.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -24,21 +25,25 @@
 void fastcall set_close_on_exec(unsigned int fd, int flag)
 {
         struct files_struct *files = current->files;
+        struct fdtable *fdt;
         spin_lock(&files->file_lock);
+        fdt = files_fdtable(files);
         if (flag)
-                FD_SET(fd, files->close_on_exec);
+                FD_SET(fd, fdt->close_on_exec);
         else
-                FD_CLR(fd, files->close_on_exec);
+                FD_CLR(fd, fdt->close_on_exec);
         spin_unlock(&files->file_lock);
 }
 
 static inline int get_close_on_exec(unsigned int fd)
 {
         struct files_struct *files = current->files;
+        struct fdtable *fdt;
         int res;
-        spin_lock(&files->file_lock);
-        res = FD_ISSET(fd, files->close_on_exec);
-        spin_unlock(&files->file_lock);
+        rcu_read_lock();
+        fdt = files_fdtable(files);
+        res = FD_ISSET(fd, fdt->close_on_exec);
+        rcu_read_unlock();
         return res;
 }
 
@@ -54,24 +59,26 @@ static int locate_fd(struct files_struct *files,
         unsigned int newfd;
         unsigned int start;
         int error;
+        struct fdtable *fdt;
 
         error = -EINVAL;
         if (orig_start >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
                 goto out;
 
 repeat:
+        fdt = files_fdtable(files);
         /*
          * Someone might have closed fd's in the range
-         * orig_start..files->next_fd
+         * orig_start..fdt->next_fd
          */
         start = orig_start;
-        if (start < files->next_fd)
-                start = files->next_fd;
+        if (start < fdt->next_fd)
+                start = fdt->next_fd;
 
         newfd = start;
-        if (start < files->max_fdset) {
-                newfd = find_next_zero_bit(files->open_fds->fds_bits,
-                        files->max_fdset, start);
+        if (start < fdt->max_fdset) {
+                newfd = find_next_zero_bit(fdt->open_fds->fds_bits,
+                        fdt->max_fdset, start);
         }
         
         error = -EMFILE;
@@ -89,9 +96,15 @@ repeat:
         if (error)
                 goto repeat;
 
-        if (start <= files->next_fd)
-                files->next_fd = newfd + 1;
-        
+        /*
+         * We reacquired files_lock, so we are safe as long as
+         * we reacquire the fdtable pointer and use it while holding
+         * the lock, no one can free it during that time.
+         */
+        fdt = files_fdtable(files);
+        if (start <= fdt->next_fd)
+                fdt->next_fd = newfd + 1;
+
         error = newfd;
         
 out:
@@ -101,13 +114,16 @@ out:
 static int dupfd(struct file *file, unsigned int start)
 {
         struct files_struct * files = current->files;
+        struct fdtable *fdt;
         int fd;
 
         spin_lock(&files->file_lock);
         fd = locate_fd(files, file, start);
         if (fd >= 0) {
-                FD_SET(fd, files->open_fds);
-                FD_CLR(fd, files->close_on_exec);
+                /* locate_fd() may have expanded fdtable, load the ptr */
+                fdt = files_fdtable(files);
+                FD_SET(fd, fdt->open_fds);
+                FD_CLR(fd, fdt->close_on_exec);
                 spin_unlock(&files->file_lock);
                 fd_install(fd, file);
         } else {
@@ -123,6 +139,7 @@ asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
         int err = -EBADF;
         struct file * file, *tofree;
         struct files_struct * files = current->files;
+        struct fdtable *fdt;
 
         spin_lock(&files->file_lock);
         if (!(file = fcheck(oldfd)))
@@ -148,13 +165,14 @@ asmlinkage long sys_dup2(unsigned int oldfd, unsigned int newfd)
 
         /* Yes. It's a race. In user space. Nothing sane to do */
         err = -EBUSY;
-        tofree = files->fd[newfd];
-        if (!tofree && FD_ISSET(newfd, files->open_fds))
+        fdt = files_fdtable(files);
+        tofree = fdt->fd[newfd];
+        if (!tofree && FD_ISSET(newfd, fdt->open_fds))
                 goto out_fput;
 
-        files->fd[newfd] = file;
-        FD_SET(newfd, files->open_fds);
-        FD_CLR(newfd, files->close_on_exec);
+        rcu_assign_pointer(fdt->fd[newfd], file);
+        FD_SET(newfd, fdt->open_fds);
+        FD_CLR(newfd, fdt->close_on_exec);
         spin_unlock(&files->file_lock);
 
         if (tofree)