2 files changed, 82 insertions, 138 deletions

diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 4dd873e3a1bb..be1cb909d8c0 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -42,6 +42,8 @@
 #include <net/9p/client.h>
 #include <net/9p/transport.h>
 
+#include <linux/syscalls.h> /* killme */
+
 #define P9_PORT 564
 #define MAX_SOCK_BUF (64*1024)
 #define MAXPOLLWADDR    2
@@ -788,24 +790,41 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
 
 static int p9_socket_open(struct p9_client *client, struct socket *csocket)
 {
-        int fd, ret;
+        struct p9_trans_fd *p;
+        int ret, fd;
+
+        p = kmalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+        if (!p)
+                return -ENOMEM;
 
         csocket->sk->sk_allocation = GFP_NOIO;
         fd = sock_map_fd(csocket, 0);
         if (fd < 0) {
                 P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to map fd\n");
+                sock_release(csocket);
+                kfree(p);
                 return fd;
         }
 
-        ret = p9_fd_open(client, fd, fd);
-        if (ret < 0) {
-                P9_EPRINTK(KERN_ERR, "p9_socket_open: failed to open fd\n");
+        get_file(csocket->file);
+        get_file(csocket->file);
+        p->wr = p->rd = csocket->file;
+        client->trans = p;
+        client->status = Connected;
+
+        sys_close(fd);  /* still racy */
+
+        p->rd->f_flags |= O_NONBLOCK;
+
+        p->conn = p9_conn_create(client);
+        if (IS_ERR(p->conn)) {
+                ret = PTR_ERR(p->conn);
+                p->conn = NULL;
+                kfree(p);
+                sockfd_put(csocket);
                 sockfd_put(csocket);
                 return ret;
         }
-
-        ((struct p9_trans_fd *)client->trans)->rd->f_flags |= O_NONBLOCK;
-
         return 0;
 }
 
@@ -883,7 +902,6 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         struct socket *csocket;
         struct sockaddr_in sin_server;
         struct p9_fd_opts opts;
-        struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
         err = parse_opts(args, &opts);
         if (err < 0)
@@ -897,12 +915,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
         sin_server.sin_family = AF_INET;
         sin_server.sin_addr.s_addr = in_aton(addr);
         sin_server.sin_port = htons(opts.port);
-        sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
+        err = sock_create_kern(PF_INET, SOCK_STREAM, IPPROTO_TCP, &csocket);
 
-        if (!csocket) {
+        if (err) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_tcp: problem creating socket\n");
-                err = -EIO;
-                goto error;
+                return err;
         }
 
         err = csocket->ops->connect(csocket,
@@ -912,30 +929,11 @@ p9_fd_create_tcp(struct p9_client *client, const char *addr, char *args)
                 P9_EPRINTK(KERN_ERR,
                         "p9_trans_tcp: problem connecting socket to %s\n",
                         addr);
-                goto error;
-        }
-
-        err = p9_socket_open(client, csocket);
-        if (err < 0)
-                goto error;
-
-        p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                goto error;
-        }
-
-        return 0;
-
-error:
-        if (csocket)
                 sock_release(csocket);
+                return err;
+        }
 
-        kfree(p);
-
-        return err;
+        return p9_socket_open(client, csocket);
 }
 
 static int
@@ -944,49 +942,33 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args)
         int err;
         struct socket *csocket;
         struct sockaddr_un sun_server;
-        struct p9_trans_fd *p = NULL; /* this gets allocated in p9_fd_open */
 
         csocket = NULL;
 
         if (strlen(addr) > UNIX_PATH_MAX) {
                 P9_EPRINTK(KERN_ERR, "p9_trans_unix: address too long: %s\n",
                         addr);
-                err = -ENAMETOOLONG;
-                goto error;
+                return -ENAMETOOLONG;
         }
 
         sun_server.sun_family = PF_UNIX;
         strcpy(sun_server.sun_path, addr);
-        sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        err = sock_create_kern(PF_UNIX, SOCK_STREAM, 0, &csocket);
+        if (err < 0) {
+                P9_EPRINTK(KERN_ERR, "p9_trans_unix: problem creating socket\n");
+                return err;
+        }
         err = csocket->ops->connect(csocket, (struct sockaddr *)&sun_server,
                         sizeof(struct sockaddr_un) - 1, 0);
         if (err < 0) {
                 P9_EPRINTK(KERN_ERR,
                         "p9_trans_unix: problem connecting socket: %s: %d\n",
                         addr, err);
-                goto error;
-        }
-
-        err = p9_socket_open(client, csocket);
-        if (err < 0)
-                goto error;
-
-        p = (struct p9_trans_fd *) client->trans;
-        p->conn = p9_conn_create(client);
-        if (IS_ERR(p->conn)) {
-                err = PTR_ERR(p->conn);
-                p->conn = NULL;
-                goto error;
-        }
-
-        return 0;
-
-error:
-        if (csocket)
                 sock_release(csocket);
+                return err;
+        }
 
-        kfree(p);
-        return err;
+        return p9_socket_open(client, csocket);
 }
 
 static int
@@ -994,7 +976,7 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 {
         int err;
         struct p9_fd_opts opts;
-        struct p9_trans_fd *p = NULL; /* this get allocated in p9_fd_open */
+        struct p9_trans_fd *p;
 
         parse_opts(args, &opts);
 
@@ -1005,21 +987,19 @@ p9_fd_create(struct p9_client *client, const char *addr, char *args)
 
         err = p9_fd_open(client, opts.rfd, opts.wfd);
         if (err < 0)
-                goto error;
+                return err;
 
         p = (struct p9_trans_fd *) client->trans;
         p->conn = p9_conn_create(client);
         if (IS_ERR(p->conn)) {
                 err = PTR_ERR(p->conn);
                 p->conn = NULL;
-                goto error;
+                fput(p->rd);
+                fput(p->wr);
+                return err;
         }
 
         return 0;
-
-error:
-        kfree(p);
-        return err;
 }
 
 static struct p9_trans_module p9_tcp_trans = {
diff --git a/net/socket.c b/net/socket.c
index b94c3dd71015..dbfdfa96d29b 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -355,68 +355,61 @@ static const struct dentry_operations sockfs_dentry_operations = {
  *      but we take care of internal coherence yet.
  */
 
-static int sock_alloc_fd(struct file **filep, int flags)
+static int sock_alloc_file(struct socket *sock, struct file **f, int flags)
 {
+        struct qstr name = { .name = "" };
+        struct path path;
+        struct file *file;
         int fd;
 
         fd = get_unused_fd_flags(flags);
-        if (likely(fd >= 0)) {
-                struct file *file = get_empty_filp();
-
-                *filep = file;
-                if (unlikely(!file)) {
-                        put_unused_fd(fd);
-                        return -ENFILE;
-                }
-        } else
-                *filep = NULL;
-        return fd;
-}
-
-static int sock_attach_fd(struct socket *sock, struct file *file, int flags)
-{
-        struct dentry *dentry;
-        struct qstr name = { .name = "" };
+        if (unlikely(fd < 0))
+                return fd;
 
-        dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
-        if (unlikely(!dentry))
+        path.dentry = d_alloc(sock_mnt->mnt_sb->s_root, &name);
+        if (unlikely(!path.dentry)) {
+                put_unused_fd(fd);
                 return -ENOMEM;
+        }
+        path.mnt = mntget(sock_mnt);
 
-        dentry->d_op = &sockfs_dentry_operations;
+        path.dentry->d_op = &sockfs_dentry_operations;
         /*
          * We dont want to push this dentry into global dentry hash table.
          * We pretend dentry is already hashed, by unsetting DCACHE_UNHASHED
          * This permits a working /proc/$pid/fd/XXX on sockets
          */
-        dentry->d_flags &= ~DCACHE_UNHASHED;
-        d_instantiate(dentry, SOCK_INODE(sock));
+        path.dentry->d_flags &= ~DCACHE_UNHASHED;
+        d_instantiate(path.dentry, SOCK_INODE(sock));
+        SOCK_INODE(sock)->i_fop = &socket_file_ops;
 
-        sock->file = file;
-        init_file(file, sock_mnt, dentry, FMODE_READ | FMODE_WRITE,
+        file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
                   &socket_file_ops);
-        SOCK_INODE(sock)->i_fop = &socket_file_ops;
+        if (unlikely(!file)) {
+                /* drop dentry, keep inode */
+                atomic_inc(&path.dentry->d_inode->i_count);
+                path_put(&path);
+                put_unused_fd(fd);
+                return -ENFILE;
+        }
+
+        sock->file = file;
         file->f_flags = O_RDWR | (flags & O_NONBLOCK);
         file->f_pos = 0;
         file->private_data = sock;
 
-        return 0;
+        *f = file;
+        return fd;
 }
 
 int sock_map_fd(struct socket *sock, int flags)
 {
         struct file *newfile;
-        int fd = sock_alloc_fd(&newfile, flags);
-
-        if (likely(fd >= 0)) {
-                int err = sock_attach_fd(sock, newfile, flags);
+        int fd = sock_alloc_file(sock, &newfile, flags);
 
-                if (unlikely(err < 0)) {
-                        put_filp(newfile);
-                        put_unused_fd(fd);
-                        return err;
-                }
+        if (likely(fd >= 0))
                 fd_install(fd, newfile);
-        }
+
         return fd;
 }
 
@@ -1390,29 +1383,19 @@ SYSCALL_DEFINE4(socketpair, int, family, int, type, int, protocol,
         if (err < 0)
                 goto out_release_both;
 
-        fd1 = sock_alloc_fd(&newfile1, flags & O_CLOEXEC);
+        fd1 = sock_alloc_file(sock1, &newfile1, flags);
         if (unlikely(fd1 < 0)) {
                 err = fd1;
                 goto out_release_both;
         }
 
-        fd2 = sock_alloc_fd(&newfile2, flags & O_CLOEXEC);
+        fd2 = sock_alloc_file(sock2, &newfile2, flags);
         if (unlikely(fd2 < 0)) {
                 err = fd2;
-                put_filp(newfile1);
-                put_unused_fd(fd1);
-                goto out_release_both;
-        }
-
-        err = sock_attach_fd(sock1, newfile1, flags & O_NONBLOCK);
-        if (unlikely(err < 0)) {
-                goto out_fd2;
-        }
-
-        err = sock_attach_fd(sock2, newfile2, flags & O_NONBLOCK);
-        if (unlikely(err < 0)) {
                 fput(newfile1);
-                goto out_fd1;
+                put_unused_fd(fd1);
+                sock_release(sock2);
+                goto out;
         }
 
         audit_fd_pair(fd1, fd2);
@@ -1438,16 +1421,6 @@ out_release_1:
         sock_release(sock1);
 out:
         return err;
-
-out_fd2:
-        put_filp(newfile1);
-        sock_release(sock1);
-out_fd1:
-        put_filp(newfile2);
-        sock_release(sock2);
-        put_unused_fd(fd1);
-        put_unused_fd(fd2);
-        goto out;
 }
 
 /*
@@ -1551,17 +1524,13 @@ SYSCALL_DEFINE4(accept4, int, fd, struct sockaddr __user *, upeer_sockaddr,
          */
         __module_get(newsock->ops->owner);
 
-        newfd = sock_alloc_fd(&newfile, flags & O_CLOEXEC);
+        newfd = sock_alloc_file(newsock, &newfile, flags);
         if (unlikely(newfd < 0)) {
                 err = newfd;
                 sock_release(newsock);
                 goto out_put;
         }
 
-        err = sock_attach_fd(newsock, newfile, flags & O_NONBLOCK);
-        if (err < 0)
-                goto out_fd_simple;
-
         err = security_socket_accept(sock, newsock);
         if (err)
                 goto out_fd;
@@ -1591,11 +1560,6 @@ out_put:
         fput_light(sock->file, fput_needed);
 out:
         return err;
-out_fd_simple:
-        sock_release(newsock);
-        put_filp(newfile);
-        put_unused_fd(newfd);
-        goto out_put;
 out_fd:
         fput(newfile);
         put_unused_fd(newfd);